# Google API Limited Use | onmsg

> How onmsg uses Google user data from the Gmail and Google Workspace APIs, and its compliance with the Limited Use requirements of the Google API Services User Data Policy.

URL: https://onmsg.app/google-limited-use/

# Google API Limited Use

Last updated: September 14, 2026

## Limited Use compliance statement

**The use of raw or derived user data received from Google Workspace APIs and Google APIs will adhere to the Google User Data Policy, including the Limited Use requirements.** onmsg's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

## What onmsg receives from Google, and why

A business connects a Gmail or Google Workspace mailbox so that customer email appears as conversations in its shared onmsg inbox. onmsg requests three Google scopes and uses each one only for that purpose:

-   `gmail.readonly` reads new messages arriving in the connected mailbox's Inbox so the business's staff can see and answer customer email. Reading is limited to new Inbox mail since the mailbox was connected; newsletters, receipts and automated notifications are detected and skipped; attachment contents are not downloaded.
-   `gmail.send` sends the replies staff write in onmsg, as threaded responses from the connected address to an existing inbound message. onmsg never sends unsolicited or bulk email.
-   `userinfo.email` identifies which mailbox was connected, so the connection can be labelled and duplicate connections of the same mailbox avoided.

## What onmsg never does with Google user data

-   We do not transfer it to any artificial-intelligence or machine-learning service. It is never sent to onmsg's platform AI, to a bring-your-own-key provider, to a model gateway or aggregator, or to any other machine-learning service.
-   We do not use it to create, train, fine-tune, evaluate or improve generalised or foundational machine-learning or artificial-intelligence models, and we do not permit anyone else to do so.
-   We do not sell it, do not use it for advertising, and do not use it for profiling or eligibility decisions about creditworthiness or lending.
-   We do not let humans read it, except with the business's explicit consent for support, or where necessary for security, abuse investigation or legal compliance.
-   We do not operate a self-hosted or offline model. Every model onmsg can use is a third-party API service, and none of them receives Google user data.

This applies to Microsoft mailbox data in exactly the same way. Mailbox conversations are answered by the business's own staff; where a conversation flow would need a model on a channel, onmsg hands the conversation to a person instead of calling one.

## What we store, and for how long

We store the message text, sender, subject and metadata of ingested messages, and a reference to attachments; we do not download attachment contents. The storing business controls retention through its plan's retention setting. Disconnecting a mailbox deletes the stored credentials immediately, and a request to [hello@onmsg.app](mailto:hello@onmsg.app) is completed within 30 days. See the [privacy policy](https://onmsg.app/privacy-policy/) for the full description.

## How to revoke access

Disconnect the mailbox in the business's onmsg Channels settings, or remove onmsg's access at [myaccount.google.com/permissions](https://myaccount.google.com/permissions).