Data use and AI

We can hold account data, connected work data, professional profile data, and results made from it.

• Account and sign-in data, such as name, email, and account IDs.
• Email headers and labels, calendar events, contacts, and connected account details.
• Professional profile, employer, role, and social connection data.
• User-made lists, notes, searches, sharing rules, and app settings.
• Results such as merged identities, relationship strength, paths, and suggested matches.
• Support, security, and service logs.

By default, we read email headers and labels, not the body. A user can grant wider access for a feature that needs content.

The default Google scope is gmail.metadata. The default Microsoft scope is Mail.ReadBasic. Both exclude the email body.

We also support clear, feature-led permission upgrades. A wider read scope can let a feature read and store body text. The user sees the added permission in the provider consent step.

By default, we can read calendar events but cannot change them.

Event data can include the title, times, attendees, organizer, location, status, and event text supplied by Google or Microsoft. We use it to find people and relationship signals.

Yes. We can add professional data from public or paid sources when a feature needs it.

A lookup may send a name, work email, company, domain, or profile clue to an enrichment or search provider. We use the result to fill gaps or improve a match.

The providers page lists the services used for this work.

AI search uses OpenAI and Google Gemini. For identity matching, OpenRouter processes names and email addresses from connected accounts.

We do not send any other email metadata or body content, or any calendar event metadata or text, to AI providers.

AI providers do not use customer data for training or service improvement. Graph One may use some names and email addresses from connected accounts to test and improve its own identity-matching system.

OpenAI, Google Gemini, OpenRouter, and the model endpoints used through OpenRouter do not use the customer data we send them for training or service improvement.

We may use some names and email addresses from connected accounts to test and improve our own identity-matching system. This does not train or improve a provider's model.

OpenAI may retain content for up to 30 days for abuse monitoring. Google logs content for abuse prevention but does not publish the period. OpenRouter does not retain prompts or responses.

We use Google Analytics on the website and PostHog's EU cloud in the product.

Product events can include account and use details such as email, name, connected account count, and setup state. Cookie choices and the public cookie policy govern website tracking.