How Adinath PO Desk handles data

Adinath Offset is an offset printing press in Wadhwan City, Surendranagar district, Gujarat, India. We build and operate Adinath PO Desk for our own staff; no other company uses it. Adinath Offset is the data controller for everything described here.

For any question about this policy, to ask what we hold about you, or to ask us to correct or delete it, email adinathoffset@gmail.com. We answer within 30 days.

Adinath PO Desk watches the Gmail mailboxes that Adinath Offset uses to receive orders, detects purchase orders (POs) in incoming mail, reads them into structured jobs, tracks each job through design, proofing, planning, production, dispatch and accounts, sends acknowledgements and follow-ups back to the customer, and reminds our staff when work is late. It replaces a process that was previously done by hand from a shared inbox.

Only employees of Adinath Offset can sign in. Accounts are created by an administrator; there is no self-service sign-up. The only Google accounts the app ever connects to are the company's own order mailboxes, connected deliberately by an administrator from the settings page.

The permission we ask for. When an administrator connects a company mailbox, the app sends them to Google's consent screen and requests exactly one OAuth scope: https://www.googleapis.com/auth/gmail.modify (“Read, compose, send and permanently delete all your email from Gmail” in Google's wording). We need the read part to find purchase orders, the label part to mark which messages we have processed, and the send part to reply to customers from the same mailbox. We do not use the delete capability that this scope technically includes: the app contains no code path that deletes or trashes a Gmail message.

What we access. From each connected mailbox the app reads:

• the mailbox's email address and Gmail history cursor, so that polling can resume where it stopped;
• incoming and sent messages: sender and recipient addresses and names, subject, date, message-id and threading headers, a small set of headers used to recognise auto-replies and mailing lists, the text body, and the HTML body when it carries information the text body does not;
• attachments, in full, up to 50 MB each (PDF purchase orders, artwork files, images and other office documents);
• Gmail label ids on each message, so that spam, trash, drafts and chats are skipped.

What we do with it. Every new message is stored as a copy in our own database and file store, grouped into a thread, and classified as a purchase order, a reply about an existing order, or something else. Messages classified as purchase orders have their attachments read by an AI model (see section 7) to extract the order details. The app applies labels in the mailbox (all named AO/…) so that staff can see from Gmail itself what has been processed. When a staff member acknowledges an order, sends a proof or a follow-up, or when a configured reminder falls due, the app sends that email from the connected mailbox and keeps a copy of what it sent. Sending to customers can be switched off entirely by an administrator.

What we do not do. We do not read Gmail accounts belonging to individual employees or to anyone other than the company. We do not move, archive, trash or delete messages. We do not use email content for advertising, for building profiles, for training AI models, or for any purpose unrelated to fulfilling the orders Adinath Offset receives. We do not sell it or transfer it to data brokers. Humans at Adinath Offset read stored messages only to do their jobs on the orders concerned; nobody outside the company reads them except as described in section 8.

Adinath PO Desk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Gmail data is used only to provide and improve the purchase-order features described on this page that the connecting administrator has asked for; it is not used to serve advertisements; it is not sold; and it is transferred to third parties only as needed to provide those features (section 8), to comply with applicable law, or as part of a merger or acquisition with notice.

• Staff accounts. Name, work email address, role, hashed password, and optionally a mobile number for WhatsApp, SMS and voice reminders. Sign-in sessions are recorded with their creation time so that they can be revoked.
• Customer and order records. Details extracted from purchase orders and entered by staff: the buyer's legal name, billing and delivery addresses, GSTIN and other tax identifiers, contact names, email addresses and phone numbers, PO numbers and dates, line items, quantities, rates, totals, artwork references and delivery dates.
• Work records. Which staff member did what and when: stage changes, assignments, comments, proofs, discrepancy notes, reminders and an audit log of administrative actions. These reference staff by name.
• Technical logs. Server logs with timestamps, request paths, error messages and the id of the signed-in user, kept for troubleshooting. We do not run third-party analytics or advertising trackers.

• to detect purchase orders in incoming mail and turn them into jobs our teams can work on;
• to keep a complete, auditable record of each order, from the first email to invoicing;
• to communicate with the customer about their order: acknowledgements, proofs, questions, follow-ups;
• to schedule, assign and remind staff about work, including reminders by email, WhatsApp, SMS and voice call;
• to produce internal reports on throughput, lateness and workload;
• to secure the system: authentication, role-based access control, audit trails, and diagnosing faults.

Our legal basis is the performance of the contracts we have with our customers and our employees, and our legitimate interest in running the press efficiently and keeping the accounting records Indian law requires.

The app uses Claude, an AI model provided by Anthropic, for two narrow tasks: deciding whether an incoming email is a purchase order, and reading the purchase-order document into structured fields. For these calls we send the email's subject, sender, a truncated copy of the message text with quoted history removed, the list of attachment names and types, short context from earlier messages in the same thread, and, for extraction, the purchase-order PDF or images themselves.

Anthropic processes this data only to return the result to us. Under the commercial terms we use, Anthropic does not use our inputs or outputs to train its models. Every extraction carries a confidence score; anything below our threshold is held for a person to check before it becomes a job, and staff can correct any field afterwards. Spending on AI is capped per day; when the cap is reached, work waits for a person rather than being processed elsewhere.

We use the following service providers (“sub-processors”). Each sees only what is needed for its task.

• Google LLC (Gmail API and OAuth): the source of mailbox data, and the service through which we send replies.
• Anthropic (Claude API): email text and purchase-order documents for classification and extraction, as described in section 7.
• MSG91 (WhatsApp and SMS): staff mobile numbers and short reminder texts that name the job, client and stage.
• Exotel (voice calls): staff mobile numbers and a short spoken reminder.
• Resend (transactional email): staff email addresses and internal notification emails such as daily digests.
• Our hosting provider: the servers, PostgreSQL database and S3-compatible object storage on which the application, its database and stored attachments run. Hosting providers act on our instructions and do not access the data for their own purposes.

Beyond these, we disclose data only when a law, court order or government authority requires it, to protect the rights and safety of our staff and customers, or, with notice, if Adinath Offset is sold or merged. We never sell personal data or Gmail data.

• All traffic between browsers, the app, Google and our other providers is encrypted with TLS.
• Google OAuth access and refresh tokens are encrypted at rest with a key that exists only on our server and are never shown in the interface or written to logs.
• Passwords are stored as salted hashes. Sessions are cookie-based and can be revoked by an administrator at any time.
• Access is role-based: designers, planners and accounts staff each see only the pages and actions their role needs, enforced on the server as well as in the interface.
• Administrative actions, mailbox connections and disconnections are written to a tamper-evident audit log.
• Attachments are stored in private object storage; links to them are short-lived and signed.

• Gmail credentials are kept only while the mailbox is connected. Disconnecting a mailbox deletes its access and refresh tokens immediately.
• Order records, the emails behind them and their attachments are business and accounting records. We keep them for as long as Indian tax and company law requires us to retain records of the underlying transaction (currently up to eight years after the end of the financial year), then delete them.
• Emails that turned out not to be purchase orders are kept only as long as needed to show why they were skipped, and are removed on request or during routine clean-up.
• Staff accounts are deactivated when employment ends; the name stays on historical work records so that the audit trail remains complete.
• Server logs are rotated and discarded within 90 days.

Revoking Gmail access. An administrator can disconnect any mailbox from the app's settings page, which deletes the stored tokens at once. Access can also be withdrawn from Google's side at any time from myaccount.google.com/permissions; the app then stops being able to read or send mail from that account.

Deleting stored Gmail data. Email adinathoffset@gmail.com from the mailbox concerned and ask for the messages and attachments we hold from it to be deleted. We will delete everything that is not part of a completed order we are legally required to keep, and tell you what was retained and why.

Customers and correspondents. If you have emailed one of our order mailboxes and want to know what we hold about you, or want it corrected or deleted, write to the same address. The same retention limits for accounting records apply.

Staff. You can see and edit your own name and contact details in the app, and choose which reminder channels you receive. Ask an administrator or write to the address above for anything else.

The app sets a session cookie when you sign in so that you stay signed in, and stores your theme and layout preference in your browser. There are no advertising, analytics or third-party cookies. The public pages on this site set no cookies at all.

Adinath PO Desk is a workplace tool for adults employed by Adinath Offset. It is not directed at children and we do not knowingly collect data from anyone under 18.

When we change what the app does with data, we update this page and its effective date before the change goes live, and we tell our staff in the app. Material changes to how we handle Gmail data will also be reflected in the Google consent screen. The current version is always at this address.

Back to the homepage