Privacy Policy

Mail2Task AI is a Chrome extension operated by OTO ("we", "us"). It helps employees turn work content — a Gmail email they are reading, text they have selected, or the visible text of a webpage — into a task in their own ClickUp account.

This policy explains what data the extension and its service process, why, where it is processed, how long it is kept, and how you can contact us about privacy.

Google sign-in data. When you sign in, we receive your name, email address and Google account identifier. This is used for identity only.

Content you choose to analyze. Only when you explicitly click the analyze button does the extension read and send the relevant content: for Gmail Email, the sender, subject and body of the email you have open; for Selected Text, the text you highlighted; for Current Page, the visible text of the page.

ClickUp data. When you connect ClickUp, we store the identifiers needed to create tasks on your behalf: your ClickUp access token, ClickUp user ID, name, email, workspace names, your selected task list, default assignee and favorite lists.

Extension session data. A random session token that links the extension installed in your browser to your signed-in account, plus technical records needed to operate and troubleshoot the service.

We do not collect your Gmail messages in the background, we do not read your Google Workspace data, and we do not scan pages you visit unless you ask for an analysis.

Identity data: to authenticate you and restrict access to employees of OTO (@tryoto.com accounts) — performance of a contract / legitimate interest.

Analyzed content: to detect a potential task and pre-fill a task suggestion for you — performance of a contract, based on your explicit request each time.

ClickUp data: to create tasks in your own ClickUp workspace and to show your lists and teammates — performance of a contract, connected at your instruction.

Content is processed only on demand. When you click Analyze, the extension sends the extracted text over an encrypted (HTTPS) connection to our backend, which forwards it to an AI model provider to generate the task suggestion. The analyzed text is not retained after the suggestion is returned to you.

Task creation happens on our backend, which calls the ClickUp API using your stored ClickUp connection. Your ClickUp access token is never sent to or stored in the browser.

Sign-in is handled by Google through our managed authentication provider; the extension receives only its own session token — never your Google password and never a ClickUp token.

• Google Sign-In — identity verification only (name, email, @tryoto.com restriction). No Gmail API access and no Google Workspace data access is requested or used.
• AI model provider — receives the text you chose to analyze, only to generate the task suggestion; it is not used to train models.
• ClickUp — receives task-creation requests on your behalf and your stored ClickUp connection authorizes them.
• Hosting provider — serves the website, backend endpoints and this policy.

We do not sell your data, share it for advertising, or use it for profiling or targeted ads.

ClickUp access tokens are encrypted with AES-256-GCM and stored server-side in tables that only the backend can read. The extension stores only its own session token. All traffic uses HTTPS. Access to analyzed content is limited to the processing needed to produce your suggestion.

Analyzed email, selection or page text is processed in memory to produce your suggestion and is not stored afterwards.

Your ClickUp connection and preferences are kept while your account is connected. You can remove them at any time with Disconnect ClickUp (in the extension's ClickUp Settings) or by contacting us; this deletes the stored token and preferences from our servers. ClickUp itself may retain data under its own privacy policy.

You can also sign out, which revokes the extension's session token. Account deletion requests remove your sign-in identity and any remaining connection data.

Depending on your location, you may have rights to access, correct, export or delete your personal data, and to object to or restrict processing. To exercise any of these rights, contact us using the details below and we will respond within the timeframe required by applicable law.

Mail2Task AI is a workplace tool for OTO employees and is not directed at children.

We may update this policy as the extension evolves. The latest version is always available at this page, and material changes will be communicated to employees.

For any privacy question, request or complaint regarding Mail2Task AI, contact OTO at betul@tryoto.com.