Home/Legal/Gmail
Integrations

How we use Gmail data

In plain English: what happens when you connect Gmail, which scopes we request, and the Limited Use limits we operate under, written for a quick read.

Last reviewed September 23, 2026v1.47 min read

Overview

This page explains, in plain English, what happens when you connect your Gmail account to ClaimStation. We wrote it so you can read it in a few minutes before granting access, and so Google's OAuth-verification reviewers can confirm we operate within the Google API Services User Data Policy, including the Limited Use requirements for Gmail data. In short: ClaimStation reads your mail to file carrier and client messages to the right claim, and the text of those messages is processed by Google's Gemini API to do that and to draft replies. Attorney and custody-app mail on your firm's privilege list never reaches Gemini.

01Why you might connect Gmail#

Public adjusters live in their inbox. Carrier denials, reservations of rights, settlement offers, engineer reports, payment notices, they all arrive there, mixed in with marketing, family email, and other noise. ClaimStation connects to your Gmail so it can:

  • File inbound carrier and client emails to the matching claim, so the file is complete.
  • Pull key dates and facts from carrier letters (a denial date, a request for information) into the claim, so deadline clocks and next steps stay accurate.
  • Use the filed mail in claim summaries and settlement reviews inside ClaimStation.
  • Place reply drafts in your Gmail Drafts folder, when you press a button or when a carrier message needs a reply. The system drafts; you send. ClaimStation never sends from your Gmail.

02Scopes we request and why#

ScopeWhat it allowsWhy ClaimStation needs it
gmail.readonlyRead your Gmail messages, headers, attachments, and labels.To find carrier and client emails relating to your claims and file them to the corresponding claim. Without read access, the claim correspondence inbox cannot exist.
gmail.composeCreate draft messages in your Gmail account.To place reply drafts in your Gmail Drafts folder: when you press "Draft reply," and on its own when a carrier message (a denial, a request for information, a settlement offer and the like) needs a reply. You review, edit, and click send inside Gmail. We do not send anything on your behalf.
openid + userinfo.emailYour Google account email address.To confirm which Gmail inbox is connected so we can show it to you in Settings and refuse to mix two inboxes' content.

We do not request gmail.send, gmail.modify, or any "full mailbox" scope. The minimum set above is what the product requires.

03What we do with the data, concretely#

  1. You authorize. You click "Connect Gmail" inside ClaimStation. Google shows you the standard consent screen. You see the scopes above and click Allow.
  2. We store the tokens. The refresh token is encrypted with AES-256-GCM before it is written to our database. The short-lived access token is stored server-side only. Neither is ever sent to your browser.
  3. We import your recent history. When you first connect, ClaimStation imports the sender, recipients, subject and date of the last two years of mail, skipping the Promotions and Social tabs. It does not import message text at this step and does not send anything to AI. It fetches the text later only for messages filed to a claim, or when you open a message.
  4. We watch for new mail. Google Cloud Pub/Sub tells us when new mail arrives, and we also check every 15 minutes in case a notice was missed.
  5. We apply the privilege filter. Before any message text reaches the AI or our database, the sender is checked against your firm's privilege list. This happens for new mail and for the history import. Mail from a listed custody-app or family-court domain is discarded. Mail from a listed attorney domain is recorded by sender, recipients, subject and date only; its text is never stored and never sent to the AI. Mail you send to a listed address is not imported. Every firm starts with a default list, and firm users cannot turn the filter off. The filter works from the list: mail from an address that is not on it is treated as ordinary mail, so contact support to add the domains your firm deals with.
  6. Google Gemini classifies the message. For mail that passes the filter, the sender, recipients, subject and text are sent to Google's Gemini API under ClaimStation's paid account. Gemini decides what kind of message it is (a denial, a request for information, a settlement offer, an engineer report, something else), which claim it belongs to, and which dates and facts matter.
  7. We file it. The message text, sender, recipients, date and Gmail message ID are written to the correspondence table, inside your firm's workspace. You read it on the claim.
  8. A draft may be placed. When you press "Draft reply," or when a carrier message needs a reply, Gemini writes a draft and ClaimStation places it in your Gmail Drafts folder using gmail.compose. You open it in Gmail, edit, and send it yourself. ClaimStation never sends.

04The Limited Use commitments#

Adheres to Google's Limited Use requirements

ClaimStation's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • Only for the features described above. Gmail data is used only to file mail to your claims, keep each claim's dates and facts current, show the mail in claim summaries, and draft replies. Not for any other product, not for any other purpose.
  • No advertising. ClaimStation does not serve advertising. We do not use Gmail data for advertising, profiling, or analytics-by-third-party.
  • No transfer to third parties except as necessary to provide the features, or as required by law. The AI step above is the main one: message text goes to Google's Gemini API to classify and draft. Our hosting and database providers store it. The full list is in our Privacy Policy.
  • No humans reading your mail. ClaimStation employees do not read your Gmail data except (i) with your explicit consent, (ii) to investigate suspected abuse or a security incident, (iii) to comply with law, or (iv) where the data is aggregated and anonymized for our own operations.
  • Never used for AI training. ClaimStation does not use Gmail data to develop, improve, or train generalized or generative AI / ML models.

05Disconnecting#

You can disconnect at any time from Settings → Integrations → Gmail → Disconnect. On disconnect:

  1. We call Google's revoke endpoint to invalidate the refresh token.
  2. We delete the stored credential from our database. After this point we have no further ability to read your Gmail.
  3. Mail already imported stays. Mail filed to a claim is part of that claim's file and is kept with it. There is no button to delete imported mail or your account: email support@claim-station.com and ClaimStation staff handle it by hand within 30 days of a verified written request. See /data-deletion.

You can also revoke ClaimStation from your Google account at myaccount.google.com/permissions. Doing it that way produces the same result on our side: API calls fail and the stored token becomes useless.

06Security#

  • OAuth refresh tokens encrypted with authenticated AES-256-GCM at rest.
  • Tokens never logged, never sent to the browser, never available outside the server boundary.
  • Webhook endpoints validated with a Pub/Sub verification token.
  • Row-level security in Postgres scoping every read to the authorized workspace.
  • See our security overview for the full set of controls.

07Questions#

Email privacy@claim-station.com. We'll answer in business-day time.