Privacy Policy

Effective October 20, 2026

This Privacy Policy explains how XT4 Enterprises (“XT4”, “we”, “us”) collects, uses, stores and shares personal data when you use MyGorilla at https://mygorilla.com (the “Service”). It applies to visitors to our website, to the people who sign in to the Service (“agents”), and to the data in mailboxes that a workspace connects to the Service.

1. Who we are and our role

For account information, billing and website analytics we act as the data controller. For the contents of connected mailboxes and the tickets, customer records and messages created from them (“Customer Data”), we act as a processor on behalf of the workspace that connected the mailbox, which is the controller. If you emailed a company that uses MyGorilla, that company decides how your message is handled; please direct requests about it to them, and we will assist them.

2. Data we collect

Account data

Name, email address and profile image from the sign-in method you choose (email code or Google sign-in).
Workspace name, team membership and role.
Billing details handled by Stripe: we receive your Stripe customer and subscription identifiers, plan, seat count and invoice status. We never see or store full card numbers.

Connected mailbox data

When a workspace admin connects a Gmail, Google Workspace or Microsoft 365 mailbox, we access that mailbox through Google’s Gmail API or Microsoft’s Graph API with the permissions the admin approves. From that mailbox we collect:

the mailbox address and display name;
inbound messages received by the mailbox: sender and recipient addresses, subject, date, message body (text and HTML), threading headers, and the names, sizes and types of attachments;
messages our Service sends from the mailbox on the workspace’s behalf; and
OAuth access and refresh tokens that let us keep reading and sending without asking the admin to sign in again.

Attachment files themselves are not copied to our servers. When an agent opens an attachment we fetch it from the mailbox at that moment and stream it to the agent’s browser.

Usage, cookies and analytics

Server logs with IP address, browser type, pages requested and timestamps, kept for a limited period for security and troubleshooting.
Cookies strictly necessary to keep you signed in and to protect sign-in and mailbox connection flows against forgery.
On our public website pages (not inside the signed-in Service) we use Google Analytics to understand how visitors find and use the site. Google Analytics sets its own cookies and receives your IP address, device and browser details and the pages you view; Google processes this data under its own privacy policy. We do not use advertising cookies, and we do not send ticket, mailbox or customer data to any analytics tool.

3. How we use data

To provide the Service: turning inbound email into tickets, letting agents reply, grouping customers by company, and keeping conversations threaded.
To operate your account: sign-in, workspace membership, seat counting and billing.
To secure and support the Service: preventing abuse, diagnosing problems, and responding to your requests.
To communicate with workspace admins about the Service, such as billing notices, security notices and changes to these terms.

We do not sell personal data. We do not use Customer Data or mailbox data for advertising, for profiling unrelated to providing the Service, or to develop or train generalized artificial-intelligence or machine-learning models.

4. Google user data and Limited Use

MyGorilla’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, for data obtained through the Gmail API:

we only use it to provide and improve the user-facing help desk features described above;
we do not transfer it to others except as necessary to provide those features (to the subprocessors listed below), to comply with law, or as part of a merger or acquisition with notice to you;
we do not use it for serving advertisements; and
humans at XT4 do not read it unless the workspace has asked us for support, it is necessary for security purposes such as investigating abuse, we are required to by law, or it has been aggregated and anonymized.

Microsoft 365 mailbox data is handled under the same limits.

5. Sharing and subprocessors

We share personal data only with the service providers that help us run MyGorilla, each bound by contract to protect it:

Railway: application hosting (United States).
Neon: managed PostgreSQL database hosting (United States).
Clerk: authentication, user and organization management.
Stripe: subscription billing and payment processing.
Google: Gmail API access for mailboxes you connect, and Google sign-in.
Microsoft: Microsoft Graph API access for Microsoft 365 mailboxes you connect.

We may also disclose data when required by law or legal process, to protect the rights, safety or property of XT4, our users or the public, or in connection with a merger, acquisition or sale of assets, in which case we will notify affected workspaces.

6. Retention and deletion

Tickets and messages are kept for as long as the workspace keeps them. Agents can delete tickets, and admins can delete customer and company records, at any time.
Disconnecting a mailbox deletes its OAuth tokens immediately and stops all access to that mailbox. Tickets already created remain in the workspace.
Closing a workspace deletes its Customer Data, mailbox tokens and account records within 30 days. Encrypted backups expire on a rolling schedule of up to 30 additional days.
Billing records are kept as long as required by tax and accounting law.

You can also revoke MyGorilla’s access from your Google Account permissions page or your Microsoft account’s app permissions at any time; we will then be unable to read or send from that mailbox.

7. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Mailbox OAuth refresh tokens are additionally encrypted at the application level with a key held separately from the database. Access to production systems is limited to XT4 personnel who need it, protected by multi-factor authentication, and logged. No method of transmission or storage is completely secure; if we learn of a breach affecting your data we will notify affected workspaces without undue delay.

8. Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, or to object to certain processing. Agents can update their profile from the Service; workspace admins can export and delete workspace data on request. To exercise any right, email [email protected]. We will respond within 30 days and may need to verify your identity. If you are in the EEA, UK or Switzerland you may also complain to your local data protection authority. Residents of California and other US states with privacy laws have the rights those laws provide, and we do not sell or share personal data for cross-context behavioral advertising.

9. International transfers

We are based in the United States and our subprocessors store data primarily in the United States. If you use the Service from elsewhere, your data will be transferred to and processed in the United States under appropriate safeguards, including standard contractual clauses where required.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. The current version is always at https://mygorilla.com/privacy with its effective date. For material changes we will notify workspace admins by email or in the Service before they take effect.

12. Contact

Privacy questions and requests: [email protected]. General support: [email protected]. See also our Terms of Service.