Privacy — AI Workforce

Published October 6, 2026

AI Workforce is operated by Michael Orloff Consulting for Michael Orloff's own authorized accounts. Contact michael@orloff.ca for support, access, privacy or deletion requests. Connected correspondence may contain information about other people.

Email and reporting data. Enabled email connections retrieve and store message bodies, subjects, addresses, headers, attachments and related work records. Supported Gmail actions include archive and unarchive operations. Deleting a message in Gmail does not delete AI Workforce's independent copy. Google Analytics and Search Console use separate reporting authorization to retrieve property information and reports. Reporting authorization is not authorization to process email.

Current retention and approved policy. The approved email-content policy is 12 calendar months from the reliable original provider sent/received timestamp, calculated in America/Winnipeg. An invalid anniversary day is clamped to the month's last day. Importing or reimporting does not restart retention. Missing or unreliable dates require review rather than substitution with import time. This policy is not yet comprehensively enforced by the running application. Existing records will not be deleted by the proposed enforcement workflow until implementation, validation and separate authorization are complete.

The intended policy covers bodies, attachments, previews, copied excerpts and email-derived content. Mixed-source records require source reconciliation; recent content must not extend an older contribution's retention. Independently authored project documents are outside this email policy. Temporary attachments may become eligible for earlier cleanup; the 12-month maximum does not guarantee availability for that entire period.

Deletion evidence and holds. Proposed enforcement will retain content-free deletion evidence for 24 calendar months: counts, timestamps, policy version and outcome, excluding subjects, bodies, addresses, attachments and provider payloads. Holds require a reason, owner and review date. These controls are under implementation and do not alter existing backup holds. Minimal suppression identifiers needed to prevent reimport are separate from deletion evidence; their lifecycle must cover retained backup and reimport risks.

Backups. Existing backup definitions and preservation holds govern backup copies separately. Live-content expiry does not promise immediate erasure from every backup. A proposed restoration gate must apply current retention and suppression evidence before restored content is exposed or processed. That end-to-end safeguard is not yet verified. This policy does not authorize deleting historical backups or unrelated project documents.

AI processing. Enabled workflows may send relevant message content and related work context to the OpenAI API for triage, draft replies, request interpretation and worker assistance. Current production payloads can include identifiers, sender information, subjects, bodies and prior context. Draft controls propose per-account authorization, smaller bounded payloads, provenance checks and store:false for compatible stateless workflows; these controls are not active in production. Address removal is not anonymization. Neither application deletion nor store:false establishes provider-side deletion or Zero Data Retention.

Access and service providers. The application and privileged administrators can access stored data for authorized operation. Hosting, API processing and configured backup providers have separate technical and contractual access controls. The current review does not establish that no provider personnel can access data. Hostinger hosts the application; configured OneDrive backup workflows store encrypted archives. Other document transfers are not automatically encrypted backups.

Access revocation and requests. Google access may be revoked in Google Account settings. Revocation stops future authorized Google access but does not erase stored copies or necessarily stop every local workflow. Contact michael@orloff.ca for a scoped request. Removal requires identity, dependency and hold assessment; no unimplemented deletion deadline or provider-erasure guarantee is promised.

AI Workforce's use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements. Any organizational restrictions on a connected account also apply. Fora authorization for independent storage, AI processing, hosting and backups remains unresolved; account ownership alone does not establish that authorization.