Privacy.
What we collect, what Sophie reads, and what we never do with it. Written to be read, not to be survived.
Last updated 3 September 2026
Coldsilver is an automation studio in Delft, the Netherlands (KvK 80881874). This page covers two different things: this website, and Sophie, the email assistant a business owner connects to their own mailbox. They are separated below, because the second one matters far more.
This website
We do not track you. There are no analytics cookies, no advertising pixels, and nothing is shared with advertisers.
- Server logs. Standard web logs (IP address, request path, timestamp), kept about 30 days for debugging and abuse prevention.
- Contact and intake forms. Your name, email, company and message. They reach our own inbox and are never sold or shared.
Sophie and your Google account
Sophie only ever works on a mailbox whose owner connected it themselves, through Google's own consent screen, and she can be disconnected at any moment. Below is exactly what that consent allows.
What she reads and writes
| Permission | What Sophie does with it |
|---|---|
Gmail: read (gmail.readonly) and send (gmail.send) | Reads the conversations already in the mailbox to learn the business's own wording, prices and rules, and reads new incoming customer email. Sends the reply as a real reply in the same thread. She cannot delete, trash or alter anything in the mailbox: we deliberately do not ask for the permission that would allow it. |
| Google Calendar events (optional) | Only when the owner chooses to keep their planning inside Sophie. She creates, changes and cancels the appointments she made, and reads busy times so she never books over something that is already there. |
| Email address and basic profile | To show which mailbox was connected, and nothing else. |
She never sends anything to a customer until the owner switches her out of shadow mode. She has no access to payments, invoices, bookkeeping, bank accounts, a point of sale, an order system or a CRM. Those systems are not connected to her.
Limited Use
Coldsilver's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words: we do not sell your Google data, we do not use it for advertising, we do not use it to train generalised artificial-intelligence models, and no human at Coldsilver reads it except when you ask us to help with a specific problem, or where the law requires it.
Who else processes it
To answer an email, the text of that conversation has to reach a language model. These are our sub-processors, and there are no others:
- OpenAI (United States) reads the message and the business's rules in order to draft the reply. OpenAI does not use data sent through its API to train its models.
- Supabase (EU region) stores the mailbox content Sophie learned from, and her drafts and replies.
- Vercel runs the application.
- Resend sends our own notification emails to the business owner, never to their customers.
- Google, as the source of the mailbox itself.
Access tokens are encrypted before they are stored (AES-256-GCM), everything travels over TLS, and the database is reachable only by the application's own service credentials.
How long we keep it, and how to get rid of it
Sophie keeps what she learned for as long as the business uses her. There are three ways to end that, and all three are immediate:
- Disconnect Google in Sophie under Settings. She stops reading at once and the stored token is destroyed.
- Revoke access at Google from myaccount.google.com/permissions. This works even if you never open Sophie again.
- Ask us to delete the whole store. Everything Sophie holds for that business goes: the learned conversations, the customer list, the drafts, the replies, the connection. Email info@coldsilver.nl and it is done.
Client work we operate
When we run an automation or an AI deployment for a client, we process that client's customer data as a Data Processor under the GDPR, and each deployment has its own Data Processing Addendum. Our systems process only what the work needs, and never pass customer data to anyone beyond the sub-processors documented for that deployment.
Your rights
You can ask what personal data we hold about you, ask for a correction, or ask for deletion. Email info@coldsilver.nl and a person handles it. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Contact
Coldsilver — KvK 80881874 · Waterblok 61, 2612 KX Delft, Netherlands · info@coldsilver.nl