SURU - BASE SYSTEM
PRIVACY PANEL
PRIVACY
V01
SURU logo SURU
Legal notice

PRIVACY POLICY

This Privacy Policy describes how SURU ("we", "us") collects, uses, and protects information when you use the SURU platform and related KRUX services.

Information we collect

When you create a SURU account, we collect the credentials and profile information you provide. When you connect third-party services such as Gmail or Google Drive, we store OAuth tokens and related account identifiers needed to maintain those connections on your behalf.

How we use information

We use your information to operate SURU: authenticate you, sync and search connected mail and documents, power attention points and briefings, and provide support. We do not sell your personal information.

Google user data

If you connect Gmail or Google Drive, SURU accesses Google data only as described in the Google OAuth scopes section below and only for the features you use. Google user data is used to provide SURU functionality and is not used for advertising. Human access to your Google data is limited to support and security needs.

AI processing

SURU's assistant uses a large language model to read, search, and summarize the mail and documents you connect, and to draft replies for your review. By default, this processing is performed by xAI (Grok) under SURU's enterprise API account. You may instead configure your own inference provider in SURU, in which case content needed for the features you use is sent to the provider you choose, under your agreement with that provider. SURU does not use Google user data to develop, improve, or train generalized AI or machine learning models, and does not permit its default inference provider to do so.

Data retention and deletion

We retain account and connected-source data while your account is active. You may disconnect integrations from Data sources in SURU. To request account deletion or data removal, contact us using the email below.

Security

We use industry-standard measures to protect data in transit and at rest, including secure OAuth flows and access controls. No method of transmission or storage is completely secure.

Changes to this policy

We may update this Privacy Policy from time to time. Continued use of SURU after changes are posted means you accept the revised policy.

Google OAuth scopes

SURU requests the following Google OAuth scopes when you connect Gmail or Google Drive. We access Google data only after you authorize a connection.

Gmail and Google Drive connections
openid, email, profile

Identify your Google account when you connect a mailbox or drive, and display which account is linked in SURU.

Gmail integration
https://www.googleapis.com/auth/gmail.readonly

Read email metadata and content from mailboxes you connect so SURU can search messages, surface them in attention points, and include relevant mail in briefings.

Gmail integration
https://www.googleapis.com/auth/gmail.send

Send email from mailboxes you connect. SURU prepares drafts inside SURU for your review, and sends a message only when you choose to send it.

Google Drive integration
https://www.googleapis.com/auth/drive

Access files in Google Drive accounts you connect so SURU can search documents, link them to your work, and include them in research and briefing workflows. When you ask SURU to file email attachments, it creates folders and saves files in your Drive. SURU does not delete, move, or share your Drive files.

Google API Services User Data Policy

SURU's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Privacy questions or data requests: support@suru.work

Back to home Terms of Service
Last updated: October 5, 2026
03