Short answer: an AI email assistant has to read your email to be useful, so the questions that matter are which permissions it asks for, where your mail goes, how long it is kept, whether it trains AI models on it, and whether it can send without you. For Jace: it connects to Gmail or Outlook through Google or Microsoft sign-in, stores your mail so it can draft, label and search, sends thread content to AI providers (OpenAI, Anthropic, Google Vertex AI or Azure AI) only to produce what you asked for, does not train AI models on your email content, and creates drafts rather than sending on its own unless you switch on auto-send. You can disconnect or delete your account at any time.
Everything below comes from three places, checked on 7 November 2026: Jace's security page, the Jace privacy policy (last updated 5 May 2026) and Jace's own code. Where a document and the product could differ, we say which one a statement comes from. If something here and the privacy policy ever disagree, the privacy policy is the binding text.
The five questions to ask any AI email assistant
Use these when you compare tools, including Jace:
- What permissions does it request? Look at the consent screen. Can it read, send, delete? Does it also want your calendar and contacts?
- Where does your email go? Which companies host it and which AI models process it?
- How long is it kept? While you use the product, and after you disconnect or delete your account.
- Is your email used to train AI models? By the vendor, and by the AI providers it uses.
- Can it act without you? Does it send, delete or update other tools on its own, and can you switch that off?
What Jace can access
Jace connects through Google's or Microsoft's own sign-in (OAuth). You see the consent screen and approve each permission. These are the permissions in Jace's code:
| Gmail and Google Workspace | Outlook (Microsoft 365 and Outlook.com) | |
|---|---|---|
| Sign-in and profile | openid, userinfo.email, userinfo.profile | openid, profile, email, User.Read, offline_access |
| gmail.modify: read, label, save drafts and send what you send. Google notes it cannot permanently delete mail by bypassing the trash | Mail.ReadWrite to read and sync mail, folders and categories and save drafts. Mail.Send to send | |
| Calendar | calendar, to check availability and create events when you or a Flow asks | Calendars.ReadWrite, for the same |
| Contacts and settings | contacts.other.readonly, read-only, to show names correctly | Contacts.Read and MailboxSettings.Read, both read-only |
Jace's security page says it requests "the minimum Google or Microsoft permissions needed to sync your inbox, calendars, and contacts." The full list, with what each permission is used for, is on the Gmail integration page and the Outlook integration page.
What Jace stores
To draft replies in your voice and answer questions about past threads, Jace keeps a copy of your mail. The privacy policy lists what it collects:
- Account information: your name, email address and authentication tokens.
- Email content and metadata: subject lines, bodies, attachments, senders, recipients, dates and labels. This includes importing older email so Jace can learn your writing style and search your history. In the product, Plus imports 1 year of history and Pro up to 3 years (how sync and import work).
- Derived data: for example vector embeddings of your emails, which power search.
- Usage data: which features you use, whether you accepted or edited a draft, device and browser information, and cookies.
Jace's security page says data is encrypted in transit and at rest. The privacy policy says data may be stored and processed in the United States, for example in AWS data centres, and that transfers out of the EEA or UK use safeguards such as Standard Contractual Clauses.
Who else processes your email
The privacy policy names the companies involved. Jace does not sell your data.
- Hosting and processing: Amazon Web Services, Pinecone (search index) and Modal or similar cloud platforms.
- AI providers: OpenAI, Anthropic, Google Vertex AI or Azure AI. When you use an AI feature, the relevant part of your data, such as the thread you want answered, is sent to one of these providers to generate the response. The policy says Jace ensures, by contract or technically, that these providers use your data only to deliver that output and do not retain it or use it to train their general models.
- Google and Microsoft: only as the integration needs, for example to save a draft or apply a label through their APIs.
- Analytics: PostHog, for pseudonymised product analytics. You can opt out with your browser's Do Not Track setting or by asking support.
- The website: the policy also describes marketing partners that use cookies when you visit jace.ai, with an opt-out link in the policy. That concerns website visits, not your email content.
The policy also says Jace does not disclose your email content to any other third parties except the AI processors above (apart from legal requests and business transfers, which the policy describes separately).
Does Jace train AI models on your email?
No. The security page says: "We never train AI models on your personal email content." The privacy policy adds that the AI providers may not use your data to train their general models, and that Google Workspace APIs and Microsoft Graph APIs are not used to develop, improve or train generalised AI or ML models.
One nuance worth knowing: the policy allows aggregated or anonymised data, which can't identify you, to be used to improve features, and says any model improvement that uses user data is done in that anonymised or aggregate form.
Can Jace send email without you?
Not by default. Jace writes drafts into your normal Drafts folder in Gmail or Outlook, and you decide what to send (how drafting works). In Jace's code, automatic sending is off unless you switch it on:
- Auto-send per label is opt-in in Settings → Labels, and Jace shows a warning before you enable it.
- Flows (automations triggered by matching emails) draft by default. Sending automatically is a separate choice you make when you create the Flow (Flows).
- Label actions such as marking mail done or moving it to trash are per-label settings you can review and change in Settings → Labels (labels).
- Connected tools such as HubSpot or Notion are added by you. For tools that change data you can require confirmation before they run, and the HubSpot setup asks you to confirm write actions (integrations).
If your work carries confidentiality duties, start with drafts only and review everything Jace prepares. That is how we set it up for lawyers and consultants.
How long Jace keeps your data
From the privacy policy:
- While you use Jace: your emails and related data are kept for as long as you use the Service.
- When you delete your account or disconnect your email: Jace starts deleting the emails and personal data tied to your account, typically within 30 days, and in any case within the period the law requires.
- Derived data such as embeddings is deleted or dissociated when the underlying email is deleted.
- Backups can keep copies for a limited time until they are overwritten, with restricted access.
- Anonymised analytics may be kept for 12 months or more and can't be linked back to you.
In Jace's code, Delete Account removes the account, cancels its subscription and wipes the user's search index.
How to disconnect or delete
- Disconnect an inbox in Jace: Settings lets you disconnect Gmail or Outlook at any time (security page). If you connected several accounts, you can disconnect a secondary one without affecting the others.
- Revoke access at Google or Microsoft: remove Jace from your Google Account or Microsoft account permissions. The privacy policy says Jace then stops collecting new email immediately, and you can ask support to delete what was stored before.
- Delete your account: Settings → Account → Delete Account removes your account and data (Delete account).
- Ask for access, correction or deletion: email support@jace.ai. The privacy policy also covers GDPR rights such as portability and objection, and CCPA rights, and names an EU representative.
Compliance: what we can and can't say
Jace's security page says Jace follows CASA Tier 3 and SOC 2 controls for handling sensitive data, and practises privacy by design. That is the wording we use. If your firm needs audit reports, a DPA or a security questionnaire, ask support before you connect a work inbox. Jace doesn't advertise HIPAA support, so don't connect an inbox that holds patient health information on that assumption.
Who should not connect an AI email assistant (including Jace)
- Your employer's policy, or your Google Workspace or Microsoft 365 admin, doesn't allow third-party apps to access mail. Admins can block such apps, so check first.
- You need guarantees that email never leaves your own infrastructure. Jace is a cloud service that uses third-party AI providers.
- Your inbox holds regulated data, such as health records, that needs a contract Jace doesn't offer.
FAQ
Can Jace read all my email? Yes, once you connect an inbox it can read the mail in that account, which it needs to label, draft and search. It imports past email too: 1 year on Plus and up to 3 years on Pro.
Does Jace train AI models on my emails? No. Jace's security page says it never trains AI models on your personal email content, and the privacy policy says its AI providers may not use your data to train their general models.
Which AI models see my email? The privacy policy names OpenAI, Anthropic, Google Vertex AI and Azure AI. When you use an AI feature, the relevant part of the thread is sent to one of them to generate the result.
Can Jace send emails without my approval? Not by default. Jace creates drafts for you to review. Automatic sending only happens if you switch it on for a specific label, after a warning, or choose it for a Flow.
What happens to my data if I cancel or delete my account? Delete Account removes your account and data. The privacy policy says deletion of your emails and personal data typically completes within 30 days, and backups are overwritten after a limited time.
Is Jace SOC 2 compliant? Jace's security page says it follows SOC 2 and CASA Tier 3 controls for handling sensitive data. Contact support if you need audit documentation for a vendor review.
Where is my data stored? The privacy policy says data may be stored and processed in the United States, for example in AWS data centres, or wherever its service providers operate, with safeguards such as Standard Contractual Clauses for transfers from the EEA or UK.
Try Jace with drafts only
You can start Jace's 7-day trial with auto-send off and review every draft before anything leaves your inbox. Start your free Jace trial, or compare Jace's plans first.
Comparing tools? See the best AI email assistants in 2026, or read Jace vs Fyxer, Jace vs Superhuman and Jace vs Shortwave.
Sources (checked 7 November 2026)
- Jace security page: jace.ai/docs/security
- Jace privacy policy, last updated 5 May 2026: jace.ai/privacy
- Permissions: Gmail integration, Outlook integration, and Google's Gmail API scopes
- Product behaviour: Drafting and auto-send, Flows, Integrations, Sync and import, Delete account
