InternLock Privacy Policy

Information you provide

• Account information: your name and email address
• Profile information: grade/year, country, school, languages, goals, interests, education, experience, activities, projects, achievements, skills, and outreach preferences
• Saved people, Lists, notes, and outreach drafts

Information collected automatically

Usage data such as pages viewed and actions taken (for example, starting a search or saving a person), used to operate and improve the product. This usage data is first-party product analytics and is not derived from Google Workspace APIs.

Google User Data

InternLock may request authorization to use the Gmail API so users can send messages they have explicitly reviewed and approved.

Signing in with Google authenticates your account only. It does not by itself give InternLock access to your Gmail. Connecting Gmail for sending is a separate authorization you choose to grant from within the app.

InternLock requests the Gmail scope: https://www.googleapis.com/auth/gmail.send

This permission is used only to send user-approved email messages from the user's connected Gmail account.

InternLock does not use this permission to read users' inboxes, email history, labels, contacts, attachments, or previously sent messages.

When you connect your own Gmail account, InternLock requests a single, send-only Google authorization scope: https://www.googleapis.com/auth/gmail.send.

InternLock uses this authorization only to send the specific messages you have reviewed and approved, from your own Gmail account, one message at a time.

InternLock does not read your inbox, message bodies, message history, mailbox metadata, labels, attachments, or contacts. InternLock does not fetch sent messages back from Gmail.

InternLock does not store your connected Google email address, your Google account identifier, or any Gmail content in its own database. The Gmail connection itself (including OAuth tokens) is stored and managed by the app's hosting platform on the server side; the app's code receives only a connection-status signal and uses the send-only token at the moment you choose to send.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

InternLock does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

InternLock does not transfer Google Workspace-derived data to third parties for advertising, retargeting, data-broker sales, credit decisions, advertising profiles, or any AI model training.

InternLock does not use Google Workspace API data for targeted advertising, behavioral advertising, data brokerage, generalized AI model training, or unrelated secondary purposes.

You can disconnect Gmail at any time from My Profile. Disconnecting revokes the stored Gmail authorization server-side, and the app immediately loses the ability to send from your account. You can also revoke InternLock's access directly through your Google Account permissions page. To request deletion of data associated with your account, contact us through the contact page (choose “Privacy”).

Data Protection and Security

• Encrypted transmission: all traffic to and from the app, and all calls to the Gmail send API and other third-party APIs, travel over encrypted HTTPS/TLS connections.
• Server-side secrets: Google OAuth tokens, the payment processor key, and the professional-email-lookup API key are stored server-side as managed secrets. They are never placed in the app's frontend code or sent to the browser.
• Per-user access isolation: database access rules restrict your profile, Lists, saved people, outreach, and billing state to your own account. Other users cannot read them.
• Least-privilege authorization: the app requests only the gmail.send scope, not read, modify, or full-mailbox access, and requests no Google Contacts, Drive, or Calendar access.
• Restricted internal access: the Gmail connection is used only at the moment you approve a send. No one operating InternLock reads your Gmail through the app.
• Logging and error handling: operational logs record errors and usage counts. Logs do not include OAuth tokens, Gmail message content, or email credentials.
• Retention and deletion: Gmail authorization is removed when you disconnect. You can request account and data deletion at any time through the contact page.
• No security measure is perfect, and InternLock does not claim that its systems are immune to compromise. If you believe your data has been affected, contact us immediately through the contact page.

Artificial Intelligence and Google Workspace Data

InternLock uses AI and machine-learning features for specific product functions: finding publicly available professional contacts (People Finder), writing personalized outreach drafts, and generating reports and recommendations.

The data these AI features may process is: information you enter in your InternLock profile, your search goals and preferences, and publicly available professional information (names, roles, organizations, public profiles) about the people the app finds for you.

Google Workspace API data is not provided to InternLock's AI/ML functionality. InternLock's AI features run entirely separately from Gmail: an AI system never receives your Gmail authorization, tokens, inbox data, message history, contacts, or labels.

InternLock may generate an outreach draft using InternLock profile information and publicly sourced professional information.

The user reviews and approves the recipient, subject, and message.

Only after user approval is Gmail used as the delivery mechanism to send the approved message.

Google Workspace API data is not passed into the AI drafting process.

InternLock does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Because Google Workspace API data is not passed into InternLock's AI features, no Google Workspace data is transferred to any AI provider for processing.

AI and service providers

Hosting, database, authentication, and the managed AI service used for People Finder searches, outreach drafts, and reports are provided by Base44, the platform InternLock runs on. Base44 manages the underlying AI provider and model routing: it may use third-party AI providers such as Anthropic, Google, and OpenAI. InternLock does not hold those providers' API keys and does not control or expose the exact downstream model selected for each request.

Google provides the Gmail send-only authorization you connect for delivery.

Hunter.io is used, on your explicit action, to look up a professionally formatted work email address for a specific person you chose to contact, based on their organization's public domain.

Payments are processed by Stripe. InternLock does not store your full card number. We keep subscription status, plan, and billing dates so your plan works correctly.

Who can see your data

Your profile, Lists, saved people, outreach, and billing state are private to your account. Other users cannot see them. We do not sell your personal information.

Professional contact information

InternLock surfaces publicly available professional information (such as a name, role, organization, and work email). We do not collect home addresses or personal contact details.

Your choices

• Edit or clear your profile information at any time from My Profile
• Disconnect Gmail from My Profile (this revokes the stored authorization server-side)
• Revoke InternLock's Google access at any time from your Google Account permissions page
• Cancel your subscription from the subscription-management page
• Request account deletion or ask a privacy question through the contact page (choose "Privacy")

Changes

We may update this policy. Significant changes will be communicated in the app or by email.

Contact

Privacy questions and deletion requests: internlock.com/contact.