Pammy
Privacy

Privacy policy

Last updated November 3, 2026

Pammy (pammy.ai) is a personal assistant you use on WhatsApp: an agenda with reminders and routines, an AI assistant that works with your documents and files, images, videos, websites, phone calls you ask for, your accounts on other websites when you ask and, if you choose, Gmail. This policy explains what Pammy handles, why, who processes it and how long it is kept.

What Pammy keeps

  • Your WhatsApp number and the name on your WhatsApp profile, which becomes the name of your Pammy account.
  • Your appointments, reminders, notes, routines and email alert rules, until you remove them.
  • Your conversation with Pammy (the last 64 exchanges, each with its date) so it can follow up. It is cleared after 30 days without messages.
  • A short memory of you (or of your group): the important points Pammy learns about you and your work, such as how you like things done, your business and what you’re working on, so it can get to know you and adapt. It never includes passwords, payment or ID details, or the content of your emails. Ask Pammy “what do you remember about me?” to see it and “forget …” to remove something. It is kept until you ask Pammy to forget it or your account is deleted.
  • The requests you send while Pammy works on them. Their text is removed after a day and the rest after 7 days.
  • Files you send and files Pammy makes for you, for 7 days (see below).

Messages reach Pammy through WhatsApp (Meta). Pammy runs on Supabase, which stores its database and files, and on servers Pammy operates.

Gmail

Gmail is optional. When you connect it, you give Pammy two permissions on Google’s screen: to read your email and to send email on your behalf. Pammy cannot delete, archive, label or change your mail.

How Pammy uses your Gmail data

  • When you ask in WhatsApp: to search, list, open and summarize your emails, to save attachments you ask for, and to write replies and new emails.
  • Email alerts: about every two minutes, Pammy checks new messages in your inbox to tell you on WhatsApp when one you asked about arrives (“tell me when the bank emails me”). For this check it reads only the sender, subject, date and Gmail’s short preview, not the full email.
  • Important emails (only if you turn it on): with the same check, up to 3 times a day, at least 2 hours apart and in the daytime, Pammy may point out an unread email that looks clearly important. It is off unless you tick it on the Connect Gmail page or ask Pammy to turn it on. Tell Pammy “stop telling me about important emails” to turn it off.
  • Understanding your email (only if you turn it on): so Pammy knows what matters to you and can help at the right moment, it reads your new inbox emails, and once, when you connect, your recent and important emails of the last 60 days. It never reads promotions, social or forum emails. From them it writes short notes, for example “Your Ejari certificate expires on 31 October (Dubai Land Department, 25 October)”, with a link to the email. Pammy uses these notes when you talk to it, and now and then, at most once a day, it may ask you about one that’s coming due. It is off unless you tick it on the Connect Gmail page or ask Pammy to turn it on. Tell Pammy “stop learning from my email” to turn it off and delete the notes.
  • Routines you set up: for example a daily summary of your unread email, sent to you on WhatsApp or to your own address.
  • Using an email for another task you ask for: for example “call the number in Ana’s email and book a table” or “make a flyer from this email”. Only the details that task needs go to the service doing it (see below).
  • Signing in to websites for you: when you ask Pammy to do something on a website and that site emails you a sign-in code or link, Pammy reads that email to finish signing in. It reads only emails from that site that arrive while it works on your request, and uses only the code or link.

Sending email

Pammy sends an email to anyone only after showing you the exact recipients, subject, text and attachments in WhatsApp and you approve that email. A scheduled email (for example, the same request to your accountant every Wednesday) and an outreach routine are approved once, with their recipients or who to contact, and their schedule. Each time, Pammy then sends that same approved email and tells you on WhatsApp.

Pammy also emails your own address, from your Gmail to you, without asking each time: the summaries and scheduled emails to yourself that you set up, and reminders and booking alerts that WhatsApp can’t deliver (WhatsApp only lets Pammy write to you within 24 hours of your last message).

What Pammy keeps from Gmail, and for how long

  • Your Gmail address and Google’s access tokens, encrypted (AES-256), until you disconnect.
  • The emails you are working with in the conversation, and an unsent draft: removed within about an hour once you stop.
  • While Pammy works on a request, the emails it read for that request. They are deleted when it finishes, at most a day later.
  • For email alerts: the sender, subject and preview of the emails Pammy told you about, for 30 days.
  • Notes about what matters in your email (a sentence each, with the sender, subject, date and the email’s ID), for 90 days, at most 300, and a list of which emails were already read for notes, for 90 days.
  • Attachments you ask Pammy to save: 7 days, like other files.
  • What Pammy told you about your emails stays in your conversation, which is cleared after 30 days without messages. Pammy’s memory of you never includes the content of your emails.
  • A record that an email was sent (without its content), for 30 days.
  • A one-way fingerprint of your Gmail address, to count connected accounts as Google requires.

Pammy does not keep a copy of your mailbox.

Who processes your Gmail data

  • OpenAI: Pammy’s AI models read the emails involved in your request, the sender, subject and preview of new emails for alerts, and the emails Pammy reads to write its notes about what matters to you, to answer you, write drafts, decide whether to alert you and write those notes. Pammy uses OpenAI’s API with storage turned off, and OpenAI does not train its models on this data.
  • Pammy’s web agent: when you ask Pammy to do something on a website, the sign-in code or link from that site’s email goes to OpenAI’s Codex running on servers Pammy operates, with model training turned off (see “Your accounts on websites”).
  • Pammy’s file specialist: when you ask Pammy to make or change a file using an email or an attachment, the facts and files needed go to OpenAI’s Codex running on servers Pammy operates, with model training turned off. The job’s files are deleted when it ends.
  • Anthropic (Claude): when you ask Pammy to make a video or other media using details from an email, those details go to Anthropic’s API, used from servers Pammy operates. Anthropic does not train its models on API data.
  • ElevenLabs: if you ask for voice replies, the text of the reply is turned into speech. If you ask Pammy to make a phone call using details from an email, the call’s instructions go to ElevenLabs, which holds the conversation, and Twilio carries the call.
  • Other tools you ask for: if you ask Pammy to make a website, image, video or song from something in an email, only the description needed goes to the service that makes it (Lovable for websites; OpenAI, Google Flow or fal.ai for images and video clips).
  • WhatsApp (Meta): delivers Pammy’s replies and alerts to you.
  • Supabase: hosts Pammy’s database and files.

Limited Use

Pammy’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Pammy uses Gmail data only to provide the features described above. It is never used for advertising, never sold, and never used to develop, improve or train generalized AI or machine-learning models. People at Pammy do not read your email, except with your permission (for example to help you with a problem), for security, or when the law requires it.

Questions, documents and files

When you ask a question, or ask Pammy to write, create or change a document or work with a file, your request, your recent conversation and the content involved are sent to OpenAI with storage turned off. Work on files runs in OpenAI’s temporary sandbox or with Pammy’s file specialist (above); the files are copied there for that task only. For current information Pammy may search the web.

Files you send in WhatsApp, and email attachments you ask Pammy to save, are kept with their text for 7 days (at most your 20 most recent). Files Pammy makes for you are available through a private link for 7 days and are then deleted.

When you ask Pammy for a website, your instructions and the files you choose go to Lovable, which builds and hosts the site.

When you ask for images, videos, songs or voice, your instructions and the photos, audio or files you choose go to the services that make them, only for that task: OpenAI, Anthropic (Claude, for edited videos), Google Flow and fal.ai (images, video clips and songs) and ElevenLabs (voices, music and sounds).

Your accounts on websites

When you ask, Pammy can work for you on other websites: check an order, a booking or a bill, download an invoice, fill in a form, or prepare a purchase, a booking or a cancellation. It uses a browser of your own on Pammy’s servers, which keeps your sign-ins between requests, like your own browser does.

Pammy signs in with your email address, using the code or link the site emails you (see Gmail above). It never asks for your passwords, card numbers or bank details, and never types them.

Anything final, such as paying, ordering, booking, sending a message, cancelling or changing your account, happens only after Pammy shows you the details in WhatsApp and you approve it. Pammy never moves money between people or accounts.

While it works, OpenAI’s Codex (running on servers Pammy operates, with model training turned off) sees the pages of that site and does only what you asked. Pages and emails are treated as information, never as instructions.

What Pammy keeps: your browser’s data (the sign-ins and cookies of the sites it used for you), only on Pammy’s server and only for you, and a list of those sites with the dates it used them. Screenshots and downloads it sends you are kept like other files, for 7 days.

Your browser is deleted after 60 days without use, when you tell Pammy “sign out of everything”, or when you delete your account.

Phone calls

When you ask Pammy to call someone, the number, what the call is for and the details you give go to ElevenLabs, whose voice agent speaks for Pammy, and Twilio carries the call from Pammy’s own phone line. Pammy introduces itself as your assistant and never claims to be a person. The call is recorded and transcribed so Pammy can tell you what was said and how long it lasted; that report stays in your recent conversation. Pammy keeps the recording for 7 days, like other files, and sends it to you if you ask. Pammy makes at most 5 calls a day for you and never calls emergency or premium numbers.

Security

Everything travels encrypted (HTTPS). Google tokens are encrypted with a key kept outside the database, and only Pammy’s own services can read them. Access to Pammy’s systems is limited to what each part needs.

Your choices

  • Send DISCONNECT GMAIL in WhatsApp to remove Pammy’s Gmail access. Pammy revokes it with Google and deletes your tokens, the emails it was keeping for alerts, its notes about your email, the email attachments it saved and your recent conversation. Your alert rules and routines stay so they work again if you reconnect: ask Pammy to stop them, or ask it to delete them.
  • You can also remove Pammy at myaccount.google.com/permissions. Pammy deletes the same data as soon as it notices the access is gone.
  • Tell Pammy “sign out of everything” to delete your browser on Pammy’s server and the list of websites it used for you.
  • Tell Pammy “forget everything about me” to delete its memory of you.
  • Send STOP to stop WhatsApp messages.

To ask what Pammy keeps about you, or to delete your account and its data, message Pammy on WhatsApp. We answer within 30 days.