Google OAuth Verification

This page contains everything a Google reviewer needs to understand ByteBack Inbox AI's use of Google Workspace APIs — application overview, requested scopes with justifications, demo video, data flow, security controls, Limited Use compliance statement, AI processing details, subprocessors, and account deletion.

Application overview

ByteBack is an enterprise AI-powered Unified Inbox and Customer Communication Platform. It enables organizations to connect multiple email accounts from Gmail, Google Workspace, Microsoft 365, Outlook, and other supported providers into one intelligent inbox. The platform helps users manage customer communications, generate AI-powered summaries, organize conversations, create CRM records, assign follow-up tasks, and improve response times.

Application name: ByteBack Inbox AI
Website: byteback.digital
Support email: info@byteback.co.in
Privacy contact: info@byteback.co.in

Core features

Unified Inbox across multiple mailboxes and domains
AI-powered summaries and categorization of customer conversations
Lightweight CRM with contacts, deals, and pipeline
Follow-up tasks and reminders auto-created from conversations
Notifications across web, mobile, email, Slack, and Teams
Analytics on mailbox health, response time, inbox activity, and productivity
Team collaboration with internal notes, mentions, and assignments

OAuth flow

The user clicks Connect Gmail in ByteBack and is redirected to Google's OAuth consent screen at accounts.google.com/o/oauth2/v2/auth.
Google displays the requested scopes and asks the user for consent. ByteBack requests only the scopes required for the features the user has enabled.
Google redirects the browser to ByteBack's authorized redirect URI with an authorization code.
ByteBack's server exchanges the code for a refresh and access token, which are encrypted (AES-256-GCM) and stored in an isolated secrets vault.
Tokens are used only server-to-server to fetch messages and perform user-initiated actions. The user can revoke access at any time from ByteBack or from myaccount.google.com/permissions.

Requested Google scopes & why each is required

Scope	Type	Why required
https://www.googleapis.com/auth/gmail.readonly	Restricted	Read incoming messages in the connected mailbox to display them in the Unified Inbox, analyze customer conversations with AI, and generate CRM contacts and follow-up tasks.
https://www.googleapis.com/auth/gmail.send	Restricted	Requested only when the user enables reply/compose features. Allows the user to send emails and replies initiated from ByteBack's Unified Inbox.
https://www.googleapis.com/auth/gmail.modify	Restricted	Requested only when the user enables mailbox-action features (mark as read, apply labels). Actions occur only after direct user initiation.
https://www.googleapis.com/auth/userinfo.email	Non-sensitive	Identify which Google account the user connected, to label the mailbox in the app and prevent duplicate connections.
https://www.googleapis.com/auth/userinfo.profile	Non-sensitive	Display the connected account's name in the ByteBack UI.
openid	Non-sensitive	Standard OpenID Connect sign-in for identifying the Google user.

Demo video

The demo video walks a reviewer through: (1) the OAuth consent screen showing the requested scopes, (2) connecting a Gmail account, (3) the Unified Inbox displaying messages, (4) an AI-generated summary of a conversation, (5) a CRM contact and task automatically created from a reply, and (6) the in-app Account & Data page showing disconnect and delete controls.

Request current demo video link

Reviewer test credentials

Test credentials for the Google reviewer are provided directly through the OAuth verification submission. Reviewers may also request new credentials at info@byteback.co.in.

Data flow

User's browser
      │  1. Sign in with Google (OAuth consent)
      ▼
Google OAuth 2.0
      │  2. Authorization code
      ▼
ByteBack server (TLS 1.2+)
      │  3. Exchange code → refresh & access tokens
      │  4. Encrypt tokens (AES-256-GCM) → secrets vault
      │  5. Server-to-server: fetch messages via Gmail API
      ▼
Postgres database (encrypted at rest, RLS)
      │  6. AI request (minimum content needed)
      ▼
Authorized AI processing provider (zero retention)
      │  7. Summary / categorization returned
      ▼
ByteBack UI displays inbox, summaries, CRM, tasks

Security measures

TLS 1.2+ for all data in transit
Encryption at rest for the primary database and object storage
OAuth refresh tokens stored encrypted with AES-256-GCM in a secrets vault
Row-level security enforcing strict tenant/workspace isolation
Least-privilege access, audit logging, and periodic security review
Automated dependency and vulnerability scanning
No production access to Google Workspace data by ByteBack personnel except with explicit user permission, for security, or to comply with law

Google Limited Use compliance

The use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace data is used only to provide user-facing features in ByteBack.
Google Workspace data is not transferred to third parties except as required to provide the Service, comply with law, or with the user's explicit consent.
Google Workspace data is not used for advertising.
Google Workspace data is not read by humans except with the user's explicit permission, for security, to comply with law, or where the data has been aggregated and anonymized.
Google Workspace data is not used to train generalized AI/ML models.

AI processing explanation

Email content processed for AI summaries and categorization is sent, over TLS, to authorized AI processing providers operating under zero-retention agreements. Providers do not store request or response content and do not use it to train generalized models. Only the minimum content required for the feature is sent (for example the current thread's messages), and results are returned to ByteBack and displayed to the user.

Subprocessors

Subprocessor	Purpose
Google LLC	Gmail & Workspace APIs (user-authorized)
Microsoft Corporation	Outlook & Microsoft 365 APIs (user-authorized)
Cloud hosting provider	Application hosting, database, storage
AI processing provider	LLM inference under zero-retention agreement
Transactional email provider	System and notification emails
Stripe	Subscription billing (if you upgrade to a paid plan)

Encryption

In transit: TLS 1.2+ everywhere, HSTS on public endpoints
At rest: AES-256 for database, storage, and backups
Secrets: AES-256-GCM envelope encryption for OAuth tokens

Data retention

Synced emails are retained while the mailbox remains connected and the workspace is active. On mailbox disconnect, synced messages are purged from the primary database within 30 days. On account deletion, all workspace data is deleted immediately from the primary database and purged from encrypted backups within 30 days. See the Privacy Policy for full details.

Data deletion

Users can disconnect Google or Microsoft accounts, delete synced emails, delete workspaces, or delete their entire account from Settings → Account & Data. A detailed step-by-step guide is available on the Account & Data Deletion page. Manual deletion requests can be sent to info@byteback.co.in and are actioned within 30 days.

Contact

Privacy & verification: info@byteback.co.in
Support: info@byteback.co.in
General: info@byteback.co.in
Phone: +91 97175 13277

Google OAuth Verification Information