Privacy Policy

1. Introduction

LexaKeep ("we", "our") is a browser extension and web service developed by Lumerexa that tracks the state of your business conversations in Gmail: who is waiting on whom, what was promised, what changed, and what to do next. This policy explains what data LexaKeep touches, where it lives, and the choices you have. It applies to the LexaKeep extension and the lexakeep.lumerexa.com website.

Our guiding principle is state, not content: we store what a conversation means for you, not the conversation itself.

LexaKeep uses the Google user data it receives only to provide the features you see in the product. We do not use it for advertising, we do not sell or transfer it, and we do not use it to train AI models. See section 9.

2. Information We Collect

Account information. When you sign in with Google we receive and store the email address, display name and profile picture of your Google account. We also store your settings: timezone, brief hour, language, whether inbox badges are on, how many days pass before a follow-up is prepared, whether the promise check runs while you write, your plan, and the end date of a trial if one applies. We never see your Google password, and we do not receive or store any Google access token beyond the sign-in itself.

Gmail access. With your consent we read messages in threads you take part in, going back the number of days your plan allows when you first connect, and new messages as they arrive. Newsletters, notifications and other automated mail are recognised from their headers and skipped. We store a securely encrypted refresh token so LexaKeep can keep your sidebar current.

Structured conversation state. For each analysed thread we store metadata (subject, participants, dates, direction, word counts) and the results of analysis: waiting state and the ask in one sentence, commitments with a short source quote (up to 200 characters), detected facts and changes with a short quote (up to 150 characters), thread stage and milestones, open questions, the suggested next action and its reason, and the Reply Studio briefing for threads you open (what the sender wants, key points, three reply ideas). A snippet of up to 200 characters per message is kept for display. Per contact we keep counters and a plain-words reply habit (for example "usually replies in 1–2 days"), computed from message timestamps.

Things you add yourself. Notes you write on a contact card, stage overrides, snoozes, follow-up reminders (thread id, message id and the time you chose), and every confirm, dismiss, done or "not useful" decision. Your notes are never sent to an AI model.

What we do not keep. Raw email bodies are not stored. The extension reads the conversation you have open in Gmail and sends its text to our server; during analysis a normalised message body is held in a temporary table for at most 15 minutes and then deleted. When the promise check runs while you write, the text of your draft is sent the same way, held under the same 15-minute rule, and only the detected promise sentence is kept if you choose to track it. Reply drafts you generate are written into your compose window and are not kept by us. Nothing is read while Gmail is closed.

Usage counters. To operate the service we keep per-day counters and, for each AI request, the stage, model name, token counts, latency and whether the answer validated. These are numbers and identifiers only, never the text that was sent, and they exist solely to enforce your plan's limits. They are not derived from the content of your email.

3. How AI Processing Works

• Only the normalised text of the last ten messages of a single thread is sent to an AI model for one analysis step. Your whole inbox is never sent in one request. The promise check sends only the draft you are writing.
• We use models from leading providers such as Anthropic and OpenAI, accessed through the OpenRouter API. Which model runs each step is chosen by us; in Reply Studio you can pick between the models we have enabled for your plan. Providers process requests transiently under their API terms and do not use your content to train their models.
• AI output is validated against a fixed schema; it can only produce categorical results (a stage, a commitment sentence, a confidence level, a reply idea) — never free-form storage of your email.
• Due dates are computed by a deterministic parser from the message date and your timezone, not by the AI.
• Every extraction carries a confidence of high, medium or low. Low is shown as "possible". We never show percentages or scores.

4. What LexaKeep Never Does

• It never sends, archives or deletes email, and it never writes anything into your mailbox: drafts are placed in your compose window for you to review. When you press Send in Gmail, the promise check may pause the send once to ask whether to track a promise; it never blocks it.
• It requests no Gmail permission at all. Google sign-in gives us only your email address and basic profile (openid, userinfo.email, userinfo.profile). LexaKeep cannot reach your mailbox through Google; it only sees what is on your screen while you use Gmail with the extension installed.
• It never shows scores, percentages or predictions about people.
• We do not embed analytics, advertising or fingerprinting trackers in the extension or on this website.
• We do not sell, rent or share your personal data with third parties for marketing purposes — ever.
• We do not use your Gmail data to train AI models, and we do not use it to build any product other than the LexaKeep features described here.

5. Inbox Badges

The extension draws small status badges next to inbox rows (Reply, Waiting, Promised, Overdue, Changed, Follow-up ready). They are rendered on the page by the extension only; nothing is written into your Gmail account, so they are not visible on your phone or in other clients. For rows you have not opened, the extension reads the sender, subject and date shown in the list to mark threads that may be waiting on you. You can turn badges off in the sidebar Settings.

Inbox badges are drawn by the extension next to the subject line. To show them, the extension sends the thread ids of the rows on screen to our service in one request and receives their state. No subject or body leaves the page.

6. Browser Permissions, Explained

• mail.google.com — required to show the side panel, badges, the thread notice and the compose bar inside Gmail. The extension does not read email content from the page; it identifies which thread or draft is open and asks our service for that item's state.
• lexakeep.lumerexa.com — the only server the extension talks to.
• identity — used to sign you in through Google securely.
• storage — keeps your sign-in token, language and model choice on your device, and the currently open thread for the current browser session. Nothing else is stored in the browser.
• scripting and sidePanel — needed to load the Gmail bridge and to open the side panel.

7. Website and Cookies

When you sign in on lexakeep.lumerexa.com to manage your plan, we set one session cookie (lk_session, valid for 7 days, not readable by scripts). There are no advertising or analytics cookies.

8. Third-Party Services

We rely on a small number of providers to run LexaKeep: Google (sign-in only), AI model providers reached through OpenRouter, Resend for the optional Morning Brief email, and Lemon Squeezy for payments. Payment card details are handled entirely by Lemon Squeezy and never reach our servers.

9. How We Use Google User Data (Limited Use)

LexaKeep's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide the user-facing features of LexaKeep described in this policy: identifying your account and showing who is waiting on whom, tracking commitments, detecting changes, suggesting the next step and writing reply drafts you request. It is used for no other purpose. Note that LexaKeep does not access Gmail through Google APIs; conversation text comes only from the page you have open.

Specifically, we do not:

• transfer or sell Google user data to third parties for advertising, marketing, market research, credit scoring or any similar purpose;
• use Google user data to serve advertisements of any kind;
• use Google user data to train, fine-tune or otherwise improve generalised or public AI or machine-learning models, our own or anyone else's;
• allow humans to read your Google user data, except with your explicit permission for a support request you raise, where it is necessary for security, or to comply with the law.

Where we rely on a processor to deliver a feature you asked for (an AI provider that writes a reply draft, for example), that provider may process the data only to return the result to you, under its API terms, and may not use it to train its models or for any purpose of its own.

10. Data Retention & Deletion

• Conversation state is kept while your account is active so the sidebar stays useful. Items you close on the Waiting board stay in the Done tab for 14 days so you can undo.
• Temporary message and draft bodies are deleted within 15 minutes of analysis.
• Choose Delete all my data in the side panel Settings or on your account dashboard: within 24 hours every record is permanently deleted. You can also request this at support@lumerexa.com. LexaKeep holds no Google access token, so there is nothing to revoke; you may still remove LexaKeep from your Google account's connected apps.
• You can revoke LexaKeep's access at any time from your Google Account permissions page.

11. Security

All traffic is encrypted in transit. Google refresh tokens are encrypted at rest with a key that is not stored in the database. Server logs contain identifiers only — never message bodies, addresses or subject lines. Access to production systems is limited to the people who operate the service.

12. Your Rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, or to object to certain processing. Email support@lumerexa.com and we will respond within 30 days.

13. Children's Privacy

LexaKeep is not directed at children under 16 and we do not knowingly collect their data.

14. Changes to This Policy

We may update this policy as the product evolves. Material changes will be announced in the extension or by email before they take effect. The date at the top always reflects the latest version.

15. Contact

Lumerexa · support@lumerexa.com