Who the controller is
The data controller is Dragen Group, contact: kontakt@dragen.pl. Please use the same address for any question about personal data.
The dragengroup.com website
The site is static. We use no tracking cookies, we do no profiling, and we embed no third-party analytics. The server keeps standard access logs (IP address, request time, requested path) for security and diagnostics only, and deletes them after 30 days.
If you email us, we process the content of that correspondence in order to reply, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
Dragen Brain - mailbox access
Dragen Brain is an application for business customers that reads a nominated mailbox and organises incoming commercial correspondence. This section describes what happens to the data in that mailbox, and it applies to access granted by signing in with Google.
The scope we request and why
When connecting a Google mailbox we request the https://mail.google.com/ scope. It is the only scope Google offers for the IMAP protocol - a narrower scope does not permit reading messages over IMAP. We use it solely to read new messages in the nominated folder.
What we actually do with messages
- fetch unread messages from the nominated folder,
- store the sender, subject, body and message identifier,
- send the subject and body to a language model provider in order to recognise the type of enquiry and extract logistics data (route, cargo, dates),
- create from that an enquiry record visible to the operator.
We do not read or index the mailbox outside the nominated folder. We do not send messages on your behalf without an operator decision recorded in the event log.
What we do not do
We do not use data from your mailbox to train models. We do not sell it, do not share it for advertising, and do not pass it to anyone other than the processors listed below.
Who we entrust data to
- A language model provider - message content is sent for processing. The provider and the processing region are shown in the application on the AI settings screen and may differ between deployments.
- An infrastructure provider - the server running the application and its database.
We have a data processing agreement with every processor. Where processing takes place outside the European Economic Area, the application says so.
How long we keep it
Correspondence and the enquiries created from it are kept for the term of the customer agreement. After it ends we delete the data within 30 days, unless law requires longer retention.
How to disconnect a mailbox
Access can be withdrawn at any time: in the application, under mailbox settings, or directly in your Google account at myaccount.google.com/permissions. Withdrawal takes effect immediately and does not require a password change. Deletion of data already collected happens on request sent to kontakt@dragen.pl.
Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection, and the right to lodge a complaint with the President of the Personal Data Protection Office in Poland.
Security
Mailbox credentials are encrypted in the database. Connections to mail servers require a verified TLS certificate. The application requires authentication, and roles limit what each user can reach.
Changes
We notify affected customers of material changes to this policy by email. The date of the last update is shown at the top of this page.