Last updated: 11 October 2026
This policy covers the LS8 Outreach Engine and its Google OAuth integration only. It explains how the engine accesses, uses, stores, shares, keeps and deletes Google user data, and how we handle personal data about the people and businesses we email through it.
It does not cover the rest of the ls8digital.co.uk website or our other services.
The LS8 Outreach Engine is operated by LS8 Digital, an independently owned sole trader business based in Leeds, United Kingdom, providing web design, digital marketing and AI automation services. Our website is ls8digital.co.uk.
LS8 Digital is the controller of the personal data described in this policy. You can contact us at hello@ls8digital.co.uk.
The LS8 Outreach Engine is an internal software tool that LS8 Digital uses to manage its own business email outreach. It is not offered to the public, and members of the public cannot sign in to it or connect their own Google accounts.
The engine is designed to connect to two Google Workspace mailboxes used by LS8 Digital, using Google OAuth 2.0, and to work with those mailboxes through Gmail's IMAP and SMTP services. This policy describes how the engine handles data whenever it is connected to those mailboxes.
The engine requests one Google permission (OAuth scope):
https://mail.google.com/
Google describes this permission as allowing an app to read, compose, send and permanently delete all email in the connected Gmail account. Google requires this permission for IMAP and SMTP access using OAuth, which is how the engine connects.
This is a broad permission. The engine uses it only for the purposes in section 5. Within the connected mailboxes, the engine works with:
The engine reads email headers (such as sender, recipients, subject and date) and message text. To do this, whole messages are loaded into the engine's working memory while they are being checked. Attachments are not separately processed or saved. Only limited information about replies is stored, as described in section 7.
We use Google user data only to provide the engine's features for LS8 Digital:
We do not:
The engine can use OpenAI's API to sort replies we receive, for example as interested, not interested or an unsubscribe request. When it does, only a limited amount of the reply text is sent to OpenAI, with contact details partially redacted, and only for this purpose. Our requests to OpenAI are made with OpenAI's store setting turned off. Classification helps us prioritise replies; it is not used to make decisions that have legal or similarly significant effects on anyone.
People at LS8 Digital read Google user data only where needed to operate the features above (for example, to respond to a business that has replied), where the account holder has agreed, where needed for security purposes such as investigating a fault or abuse, or where required by law.
We do not sell personal data or Google user data. We share it only with these service providers, and only as needed to run the engine:
We may also disclose data where required by law, or where necessary to protect against fraud, abuse or security threats. If LS8 Digital were involved in a merger, acquisition or sale of assets, we would ask for explicit consent before transferring Google user data.
The engine runs on a virtual private server located in Canada. It keeps limited records in SQLite databases on that server: minimum records of previous sends (including the business email address contacted), limited reply information, and suppression records.
The databases and their backups are protected by restricted access controls. No method of storage or transmission is completely secure, but we take reasonable and appropriate steps to protect data from unauthorised access, use, loss, alteration or disclosure.
The engine's server is located in Canada, so the data it stores is held outside the United Kingdom. OpenAI and Zoho may also process data outside the United Kingdom, under their own terms of service.
We keep data only for as long as it is needed for the purposes in this policy:
There is currently no automatic deletion schedule. LS8 Digital reviews stored data and deletes it manually when it is no longer needed.
The account holder of a connected mailbox can remove the engine's access at any time from their Google Account at myaccount.google.com/permissions. A Google Workspace administrator can also remove it from the Google Admin console. Once access is removed, the engine can no longer read or send email from that mailbox.
To ask us to delete data held by the engine, email hello@ls8digital.co.uk. We will delete your data, except for any records we legitimately need to keep, such as a minimal suppression record to make sure we honour your request not to be contacted, or records we must keep to meet other legal obligations. If we keep anything, we will tell you what and why.
We use the engine to contact relevant businesses about LS8 Digital's services. If we email you or your business, we process your name, business email address, business details and any correspondence between us, to contact you, respond to your reply and respect any request to opt out.
We find business contact details through Companies House information and publicly available business websites.
We rely on our legitimate interests in contacting relevant businesses about services that may be useful to them. We keep suppression records so that we can respect opt-out requests.
You can opt out at any time by replying to our email or by emailing hello@ls8digital.co.uk. If you opt out, we add your address to our suppression list and will not send you further marketing emails.
Under UK data protection law you have the right to:
To use any of these rights, email hello@ls8digital.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
LS8 Digital's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy.
We will update this policy if the way the engine accesses, uses, stores or shares data changes, and we will change the “Last updated” date above. We will not use Google user data in a new way or for a new purpose until this policy has been updated and, where required, the account holders of the connected mailboxes have agreed.
For any question about this policy or your data, email hello@ls8digital.co.uk.
