Water LLM
Security & your data
Water LLM reads your Gmail, Calendar, and Contacts. That is a lot of trust to ask for, so here is precisely what is kept in your Google account, what the AI features send to Google Cloud, what reaches our servers, and how long we keep it.
Kept in your Google account, never on our servers
- Your contacts and every CRM row
- Your emails
- Your calendar events and meeting notes
- Your notes, tags, and custom fields
- Invoices, clients, and deal records
- Your LinkedIn export and message history
Reaches our servers
- Your email address, as the subscription key
- Your billing status and plan details
- Stripe customer and product identifiers
- The date you accepted the licence terms
- The ID of your Water LLM spreadsheet
Every field we store
Our database holds one record per subscriber, keyed by email address. This is all of it.
| What | Why it exists |
|---|---|
| Email address | The key that ties your subscription to your Google account, so the add-on knows you have access. |
| Subscription status | Active or inactive. This is the only field the add-on actually reads. |
| Billing state | Active, past due, cancelling, cancelled, or expired — so support can tell you what happened to your account. |
| Plan details | Monthly or annual, the amount, and the currency. |
| Stripe identifiers | Customer, price, and product IDs, so your payments reconcile with your access. |
| Billing period dates | When your current period started and when it renews or ends. |
| Cancellation timestamps | When a cancellation was requested and when access actually ends. |
| Payment failure timestamps | So we can give you a grace window to update your card rather than cutting you off immediately. |
| Licence acceptance | The date and version of the terms you accepted. |
| Spreadsheet ID | The identifier of your Water LLM sheet. An identifier only — it grants us no access to the contents. |
| Signup date | Anchors the onboarding email sequence. |
Alongside that we keep a queue of the onboarding emails we have sent or are scheduled to send you, which contains your email address and nothing else.
How it is protected
No client can read it
The database denies every read and write from browsers and client applications without exception. Only our own server processes can reach it, and they authenticate as trusted service identities.
Hosted on Google Cloud
The subscription database runs on Google Cloud, encrypted at rest and in transit, in the same infrastructure that holds your Workspace data.
AI stays inside Google
All AI processing goes through Google’s Vertex AI — the same infrastructure behind Google Workspace AI. No OpenAI, no Anthropic, and no other third-party AI provider ever sees your data.
Logs carry no customer content
Our diagnostic logs record which job ran, whether it passed, how many records it touched and how long it took — not what was in them. Names, email addresses and calendar titles are masked before anything is written. There is a full example below.
What our logs actually look like
Every claim on this page is easier to check against an example than a description. Below is what one hour of Water LLM’s background automation produces — the thing we actually read when something has gone wrong for someone. It is built from the exact log lines in our source code, showing a deliberately bad hour so that the error cases are visible too. It is not a capture from any real person’s account, because publishing one of those would be the very thing this page says we do not do.
That is the whole vocabulary: a timestamp, which job ran, whether it
passed, how many records it touched, how long it took, and the error if there
was one. Where a record has to be identified — row 47,
contact index 412 — it is a position in your spreadsheet, which
means nothing to us because we cannot open your spreadsheet. Where a value would
otherwise appear, you get its length and nothing else:
<redacted:14> was somebody’s name.
These logs live in Google Cloud, are tagged with an anonymous identifier Google generates rather than your email address, and are kept for 30 days. One honest caveat: when a Google service returns an error, its message occasionally quotes the value that caused it back to us. We do not control the wording of those messages. It is rare, it is bounded to error text, and we would rather write it here than claim a guarantee we cannot enforce.
Retention and deletion
| Event | What happens |
|---|---|
| You cancel | Access continues until the end of the period you have paid for. The record is then marked for deletion and removed automatically about 28 days later — a window that exists so a cancellation made in error, or a change of mind, does not cost you your setup. Entries in the onboarding email queue expire within 30 days. |
| You ask us to delete your data | You can do this yourself at any time, from Configure Hub → Danger Zone → Delete My Data inside the add-on — it removes the record immediately and cascades to the onboarding email queue. If you cannot reach the add-on, email us and it is done within 30 days. Either way, it does not cancel billing; cancel that separately. |
| You uninstall the add-on | Water LLM immediately loses all access to your Gmail, Calendar, and Contacts. Your spreadsheet stays yours, fully intact and usable. |