Privacy Policy

At Integrasec we treat the information entrusted to us with the utmost seriousness. Our service analyses emails that users voluntarily submit to us because they suspect an attempted fraud or phishing attack. This means that, by the very nature of the service, we process the content of electronic communications. We are fully aware of how sensitive that data is, and this policy explains plainly and in detail what we do with it, why, for how long and with whom we share it.

1. Data controller

2. Scope of this policy

This policy applies to:

• The Integrasec add-on for Gmail and Google Workspace, including the suspicious email reporting button.
• The Integrasec add-in for Microsoft Outlook and Microsoft 365.
• The Integrasec web dashboard available at eu.integrasec.net and its subdomains.
• The automated analysis result messages we send by email.

It does not apply to third-party websites, applications or services that may be reached from our reports or communications, which are governed by their own policies.

3. Our dual role: controller and processor

This distinction matters because it determines who each individual should approach in order to exercise their rights.

3.1. When we act as a processor

When a company or organisation engages Integrasec for its employees, that organisation is the data controller and we act as a processor on its behalf, pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR"). In that scenario:

• The customer organisation decides which users use the service, for what purpose, and how long data is retained.
• The customer organisation is responsible for informing its employees that it uses Integrasec and for having a valid legal basis to do so.
• We process the data solely on its documented instructions, as set out in the data processing agreement signed with it.
• If you are an employee of a customer organisation and wish to exercise your rights, please contact your own organisation's privacy contact first. We will assist you through them.

3.2. When we act as a controller

We act as a controller, and therefore determine the purposes and means of processing ourselves, in the following cases:

• Contact details of prospective customers, commercial communications and management of the contractual relationship.
• Administration data for dashboard accounts (registration, authentication, support).
• Browsing and security data for our own website.
• Use of the service by individuals in a personal capacity, outside a business contract (for example, individual access or trial programmes).
• Technical and security logs needed to protect our own infrastructure.

4. How the service works

So that you understand exactly what happens to your data, this is the system's actual flow. Reports are always made from the add-on in Gmail or Outlook: there is no email address to which messages can be forwarded for analysis.

1. A user receives an email they find suspicious and clicks the Integrasec button in Gmail or Outlook.
2. The add-on reads that message and only that message, in its full format (with headers and attachments), and sends it to us together with the user's email address, the suspicion category they selected and, optionally, a free-text comment. In Gmail, the add-on runs on Google's infrastructure (Google Apps Script) under the user's own account, and can only communicate with our server.
3. We check that the account belongs to an organisation with an active licence. In Gmail, we also cryptographically verify with Google that the user is who they claim to be, to prevent anyone from impersonating another user. In Outlook we check that the address belongs to a customer organisation.
4. To be analysed, the message goes through a work queue, where it waits its turn stored transiently on our infrastructure in Belgium. It is deleted as soon as the analysis finishes and, in any event, after 24 hours.
5. We analyse the message: technical headers, sender authentication (SPF, DKIM, DMARC), domain age and reputation, links, QR codes embedded in images, and attachments. To find out where a link leads, our server may visit it and follow its redirects, just as the user would, but without filling in or submitting any form and without retaining the content of the pages.
6. We send the relevant information to an artificial intelligence model hosted in the European Union, which issues a reasoned verdict.
7. We email the result to the user and store the analysis record in their organisation's dashboard.

5. Personal data we process

5.1. Data from the reported email

This is the core of the service and, in the interest of transparency, we set it out in full. When an email is reported we process:

5.2. Account and dashboard data

• First and last name, corporate email address, organisation and assigned role.
• Authentication credentials. If you sign in through single sign-on with Google or Microsoft, we never see or store your password: we receive only a verified identity token. If you sign in with your own password, it is managed by a specialised identity provider that stores it encrypted and irreversibly.
• Access logs, sign-in dates and failed attempts, for security purposes.
• Assessments and corrections made by the organisation's analysts on verdicts, together with the identity of the person making them.

5.3. Organisation configuration data

Industry sector, size, usual suppliers, corporate tools, own domains and legitimate internal senders. This information is used to contextualise the analysis and reduce false positives.

5.4. Directory synchronisation data

Where a customer organisation expressly authorises it, we synchronise the user list from its corporate directory (Google Workspace or Microsoft 365) in order to manage licences and joiners and leavers. In that case we process name, email address and account status (active, suspended or deleted), on a read-only basis. We do not access mailbox content through this channel.

5.5. Technical, browsing and cookie data

When you use the web dashboard we process IP address, browser and device type, pages visited and timestamps, for security and operational purposes. We use strictly necessary cookies to keep your session open and to protect forms against attack. We do not use advertising or profiling cookies.

6. Google and Microsoft permissions: what we request and why

The add-on requests the minimum set of permissions required to work. Not one more.

Those four permissions are all the add-on requests, and the only ones shown on the consent screen when it is installed.

One design decision is worth highlighting: we do not request the gmail.readonly permission, which Google classifies as restricted and which would have allowed us to read the entire mailbox. Instead we use a permission scoped to the open conversation, so the limitation does not rest on our good faith alone: Google's own system technically prevents us from accessing any other email. Google grants temporary access only to the conversation the user has open, while the add-on is running, and that access expires. From that conversation, only the email the user chooses to report reaches our servers. At no point do we traverse, index or analyse the rest of the mailbox, because we could not do so even if we wanted to.

6.1. The Microsoft Outlook add-in

Microsoft does not use the same permission system as Google. The Outlook add-in declares a single permission level, ReadItem, which is the minimum that allows the message the user has open to be read. Specifically:

• It allows the properties of the selected message to be read: sender, subject, body, internet headers and attachments.
• It does not allow the message to be modified, moved or deleted, nor mail to be sent on the user's behalf.
• It grants no access to the rest of the mailbox: Outlook confines the permission to the item the user currently has open.

As with Gmail, higher levels exist — ReadWriteItem, which would allow the message to be altered, and ReadWriteMailbox, which would grant access to the entire mailbox — and we do not request them.

6.2. Directory synchronisation (optional, separate functionality)

The directory synchronisation described in section 5.4 is an optional feature, contracted separately and not currently active. It forms no part of the add-on or of the permissions above: when an organisation chooses to enable it, its administrator will have to grant a separate, explicit authorisation covering read-only corporate directory permissions (in Google Workspace, admin.directory.user.readonly and admin.directory.group.readonly). Those permissions allow the user and group list to be read in order to manage licences and grant no access to any email. No end user grants this permission, and without express action by the administrator the feature remains disabled.

7. Limited Use of data obtained from Google

In concrete terms, and without prejudice to the above, we undertake the following in respect of data obtained through Google permissions:

• We use it exclusively to provide and improve the user-facing email security analysis features.
• We do not transfer it to advertising platforms, data brokers or information resellers.
• We do not use it for advertising of any kind, nor for creditworthiness assessment or lending purposes.
• We do not use or disclose it to create, train or improve generalised artificial intelligence or machine learning models. The AI providers we use are contractually prohibited from using our data to train their models.
• No human reads this data, save in the exhaustively listed circumstances described in section 13.
• We share it only with providers acting as sub-processors under contract, strictly to the extent necessary to deliver the service, or where required by law.

8. Purposes and legal bases

9. Use of artificial intelligence

The Integrasec verdict is issued by an artificial intelligence model. For transparency:

• What is sent to the model: subject, message body, sender, technical headers, links, text extracted from attachments, embedded images where necessary to detect visual fraud or QR codes, and the organisation's context profile.
• What is not sent to the model: the suspicion reason and the comment written by the user. These are deliberately excluded so that the user's prior opinion cannot influence the technical analysis.
• Where it is processed: on Google Cloud Vertex AI infrastructure within the European Union. The analysis runs through the EU multi-region endpoint, for which Google guarantees that data is stored and processed exclusively in European Union Member States (excluding the United Kingdom and Switzerland). The search for similar cases runs in region europe-west1 (Belgium).
• Training: the data sent is not used to train or improve the provider's models. Vertex AI does not use its enterprise customers' data for that purpose.
• Retention at the provider: the AI provider does not persistently retain the data for its own purposes; processing is transient and aimed at returning the result.
• Continuity: if the main model is unavailable at a given moment, the query may be repeated with another model from the same provider, always within the European Union.

9.1. On automated decision-making

The Integrasec verdict is a technical security recommendation about a message, not a decision about a person. It produces no legal effects and does not significantly affect users within the meaning of Article 22 GDPR: it does not determine access to employment, credit or any service, nor is it used to assess, discipline or monitor any worker's performance. The customer organisation retains at all times the ability to review, correct and override any verdict through the dashboard.

10. Recipients and providers

We do not sell personal data. We share it only with the providers necessary to deliver the service, all of them bound by data processing agreements compliant with Article 28 GDPR:

When our server visits a link in the message to find out where it leads (section 4), the website visited receives that visit as it would from any browser: the address requested and our server's IP address, never the user's. If the link contains an identifier placed by the sender, the website may infer that someone opened it. We send no other data to those websites.

In addition, we may disclose data to courts, tribunals, law enforcement and public authorities where there is a legal obligation or a valid request, and to our professional advisers, who are bound by a duty of confidentiality.

11. International transfers

Virtually all processing takes place on servers located in the European Union, including the artificial intelligence analysis. The following specific exceptions apply. None of them hands the body or attachments of the analysed communications to a provider for processing:

• Google Firebase Authentication: the service used by administration dashboard users to sign in is provided from the United States. It processes their email address and sign-in credentials (the password, stored in encrypted, irreversible form, or the identity from the Google or Microsoft sign-in). It does not affect employees who only report emails, nor the content of any message.
• Google Web Risk: the URLs found in the message are checked.
• WHOIS records: the domain names of the sender and of the links are looked up to establish their age and ownership. The query goes to the relevant registrar, which may be located outside the European Union. No other user or message data is transmitted.
• Linked websites: the verification visits described in section 10 go to the server hosting each website, which may be located in any country.
• Gmail add-on: it runs on Google Apps Script, the Google infrastructure on which Gmail add-ons operate. The reported message passes through it in transit to our server, under the user's own Google Workspace account, and Google does not guarantee a specific region for that service.

Attachments are never sent to any external analysis service, nor checked against any third-party database: their inspection is entirely local, and only the cryptographic hash (SHA-256) is retained, within our own European infrastructure.

These queries are covered by the safeguards laid down in Chapter V GDPR, by means of Standard Contractual Clauses approved by the European Commission and, where applicable, certification under the EU-U.S. Data Privacy Framework. You may request a copy of these safeguards at the address given in section 18.

Our hosting and email providers process data in European Union data centres. However, as they are companies whose parent entities are established outside the European Economic Area, occasional remote access from outside the EU for technical support purposes cannot be ruled out. Such access is covered by the same Chapter V GDPR mechanisms and by each provider's supplementary encryption and access control measures.

12. Retention periods

Once the contract with a customer organisation ends, its data is deleted or returned within 30 days, save where retention is legally required. During the first 15 days of that period the organisation may request an export of its information.

13. Access by our personnel to the data

As a general rule, our personnel do not access the content of analysed emails. Access is restricted to a small number of authorised individuals and may occur only in the following circumstances:

• With the customer organisation's express authorisation. The company administrator grants access from their settings panel and chooses for how long (from 3 hours to indefinitely). The permission expires by itself when the period ends and may be revoked at any time with immediate effect. Without a valid authorisation in force, the system technically blocks access. In two cases access is shown as permanently granted, and the organisation's dashboard says so: when the organisation has engaged us to manage its security, because access is part of that service, and for organisations registered before 21 August 2026, which keep the access they had until they change or revoke it.
• For security reasons, to investigate an active threat, platform abuse or a security incident.
• To comply with a legal obligation or respond to a valid request from a competent authority.
• On aggregated and anonymised data, for internal operations such as quality control or fault diagnosis.

Every access is recorded in an audit log capturing who accessed the data, which organisation, when and from which IP address — including denied attempts. If for any reason the access cannot be logged, it is not granted. All authorised personnel are further bound by contractual confidentiality obligations that survive the end of their relationship with the business.

14. Security measures

We apply appropriate technical and organisational measures in accordance with Article 32 GDPR, including:

• Encryption in transit via TLS and encryption at rest for stored information.
• Authentication through a specialised identity provider, with support for corporate single sign-on.
• Cryptographic verification of the user's identity on every report made from Gmail, preventing licence impersonation; in Outlook, a check that the user belongs to a customer organisation.
• Strict segregation of data by organisation: no organisation can access another's records.
• Role-based access control and the principle of least privilege.
• Safeguards against malicious content when processing attachments, with size limits and protection against malicious archives.
• Access and activity logging, and regular backups.

In the event of a personal data breach entailing a risk to individuals' rights and freedoms, we will notify the competent supervisory authority and, where applicable, the affected individuals, within the time limits laid down in Articles 33 and 34 GDPR.

Where the breach affects data we process on behalf of a customer organisation, we will notify that organisation without undue delay and in any event within 72 hours of becoming aware of it, providing the information it needs to meet its own notification obligations. If we do not hold every detail at that point, we will send the information available and supplement it progressively rather than waiting for the investigation to close.

15. Your rights

You may exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data where it is no longer necessary.
• Restriction: request that processing be suspended in certain circumstances.
• Objection: object to processing based on our legitimate interest.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to administracion@integrasec.net stating the right you wish to exercise. We may ask you to prove your identity. We will respond within one month, extendable by a further two months where the request is particularly complex.

15.1. How to revoke access and uninstall the add-on

You may withdraw the permissions you granted when installing the add-on at any time, without contacting us and without giving reasons:

• Google: at myaccount.google.com/permissions, selecting Integrasec and removing access. To uninstall it completely, use the Google Workspace Marketplace or, if your organisation deployed it, ask your administrator.
• Microsoft: from Get Add-ins in Outlook, under the installed add-ins tab, or through your organisation's Microsoft 365 administrator.

Once access is revoked, the permission ceases to be valid immediately and the add-on can no longer read any message. Analyses already carried out are not deleted automatically: they remain in your organisation's dashboard until the retention period in section 12 expires, because they belong to the customer organisation rather than to the individual user. If you want them deleted sooner, ask your organisation or write to us at the address in section 18.

16. Minors

Integrasec is a service aimed at organisations and professional users. It is not designed or intended for children under 14 and we do not knowingly collect their data. If we find that we have processed a minor's data without a valid legal basis, we will delete it without delay.

17. Changes to this policy

We may update this policy to reflect changes in the service or in applicable law. The version in force will always be published at this address, stating its last updated date. If we make substantial changes that significantly affect the processing of your data, we will give reasonable advance notice by email or through a prominent notice in the dashboard.

18. Contact and complaints

For any matter relating to this policy or the processing of your data:

If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es) or with the supervisory authority of your place of residence.