Security & Privacy for Teams

Last updated: 10/23/2026

Short version: Text2Event reads only the email you ask it to read, turns it into a calendar event, and does not keep the email. This page explains the details for teams evaluating the service. The legal text is in our Privacy Policy.

What we access

• Gmail add-on: only the message you have open, and only when you click. We request the narrowest Gmail scope (current message), not access to your mailbox. We never search, list or read other messages.
• Chrome extension: reads the text you select or the message you ask it to convert. It does not run in the background on your mail.
• Google Calendar (optional): if you connect it, we create events you asked for. We do not read your existing calendar content for any other purpose.

What happens to an email

1. You click the button. The subject and text of that one message are sent to our server over HTTPS.
2. The text is passed to an AI model that extracts the event details (title, time, place, attendees).
3. You receive the event. We do not save the email, its attachments, or the extracted text in a database.

What we store, and for how long

• Account: email address, display name and subscription status, until you delete the account.
• Usage record: a technical record per request (time, IP address, country, browser, success or failure, account ID). It contains no email content.
• Download link files: when you ask for an .ics download link, the generated file is held in a private store and automatically deleted after 2 days.
• Server logs: operational logs are kept for 30 days and then deleted.
• Payments: handled by Paddle. We never see card details.

Who processes data (subprocessors)

• Anthropic (Claude API): AI extraction of event details. We use the API, which Anthropic does not use to train its models by default.
• Amazon Web Services: hosting, database and file storage (United States).
• Clerk: sign-in and account management.
• Paddle: payments and invoicing (merchant of record).
• Google: Calendar API and, for voice input, speech-to-text.
• Resend: transactional and product email.

We will update this list before adding a new subprocessor.

Where data is processed

Our infrastructure runs in the United States. For customers in the EU, UK or Switzerland, transfers rely on Standard Contractual Clauses.

Security measures

• HTTPS (TLS) for all traffic.
• Signed-in requests are verified with short-lived tokens. Add-on requests are verified against Google identity.
• Private storage with no public access. Download files use unguessable random names.
• Least-privilege cloud permissions and a web application firewall with rate limiting in front of the API.
• Secrets are kept in server configuration, never in the apps.

Your controls

• Delete your account and data at any time by writing to info@text2event.com. We act within 30 days.
• Request access to, or correction of, the account data we hold.
• Remove the Gmail add-on or Chrome extension at any time. Access stops immediately.

For teams and companies

• A Data Processing Agreement (DPA) is available on request.
• We will answer your security questionnaire. Send it to info@text2event.com.
• Report a security issue to the same address. We will acknowledge it within 2 business days and notify affected customers of a confirmed personal data breach within 72 hours.

What we do not do

• We do not sell data or use it for advertising.
• We do not read your email other than the message you ask us to convert.
• We do not use your emails to train AI models.