How we use Gmail data

Public adjusters live in their inbox. Carrier denials, reservations of rights, settlement offers, engineer reports, payment notices, they all arrive there, mixed in with marketing, family email, and other noise. ClaimStation connects to your Gmail so we can:

• Pull inbound carrier and client emails into the matching claim record, so the file is complete and the next-step prompt in your dashboard is accurate.
• Surface time-sensitive carrier messages (a denial, a ROR, a settlement counter) at the top of your inbox view so you don't miss a statutory deadline.
• Let you press a button and have a reply drafted into Gmail for your review and sending. The system drafts; you commit. We never auto-send.

We do not request gmail.send, gmail.modify, or any "full mailbox" scope. The minimum set above is what the product requires.

1. You authorize. You click "Connect Gmail" inside ClaimStation. Google shows you the standard consent screen. You see the scopes above and click Allow.
2. We store the refresh token. Encrypted at rest with AES-256-GCM, server-side only. The plaintext token never leaves the server boundary.
3. We watch for new mail. Either via Google Pub/Sub push notifications (recommended), or by polling every few minutes. Either way, ClaimStation only acts on newly arriving messages.
4. We apply the privilege filter. Before any message body reaches the AI classifier or our database, it passes through a hard-coded filter that drops messages from attorney domains and family-court / custody-app domains. Those messages are not stored beyond a one-line audit log entry. This filter cannot be disabled by your firm's admin; it can only be extended to add more privileged domains.
5. We classify the message. Non-privileged messages are sent to Anthropic's Claude (Haiku 4.5) under our zero-data-retention enterprise tier. The classifier decides whether the message is carrier correspondence, a settlement offer, a denial, a ROR, an engineer report, or something else, and which claim it belongs to.
6. We file it. The message body, sender, timestamp, and Gmail message ID are written to the correspondence table, scoped to your firm's workspace. You can read it from the claim screen, mark it as handled, or delete it.
7. You draft a reply (optional). If you press "Draft reply," ClaimStation creates a draft inside your Gmail Drafts folder using the gmail.compose scope. You open it in Gmail, edit, and send from Gmail. ClaimStation never sends.

You can disconnect at any time from Settings → Integrations → Gmail → Disconnect. On disconnect:

1. We call Google's revoke endpoint to invalidate the refresh token server-side.
2. We delete the encrypted credential row from our database. After this point we have no further ability to read your Gmail.
3. Imported correspondence that we already stored in your firm's claim records remains, those are your work product. You can delete individual messages from the claim view, or delete the claim entirely, or delete your account at /data-deletion.

You can also revoke ClaimStation from your Google account at myaccount.google.com/permissions. Doing it that way produces the same result on our side: API calls fail and the stored token becomes useless.

• OAuth tokens encrypted with authenticated AES-256-GCM at rest.
• Tokens never logged, never sent to the browser, never available outside the server boundary.
• Webhook endpoints validated with a Pub/Sub verification token.
• Row-level security in Postgres scoping every read to the authorized workspace.
• See our security overview for the full set of controls.

Email privacy@claim-station.com. We'll answer in business-day time.