Legal

Connected apps

The Google, Microsoft, Salesforce, HubSpot, Slack and Claude permissions Dmand AI asks for, why it needs each one, and how to turn access off.

Effective

Last updated

Revision history

In short

Effective

You can connect a Google Workspace or Microsoft 365 mailbox so Dmand AI sends your sequence emails from it and shows replies in one inbox, and connect Salesforce, HubSpot or Slack so records and notifications stay in step. We ask only for the access each job needs, never see your passwords, do not read or delete your mail, and stop as soon as you disconnect.

Key takeaways

  • Each mailbox is connected by its own owner
  • We never receive your passwords
  • No calendar, contacts or file access
  • Disconnect at any time; access stops at once

1. How connections work

Every connection uses the provider’s own sign-in and consent screen (OAuth 2.0). You approve the access listed on this page; the provider then gives Dmand AI a token, which we store encrypted. We never receive, store or send the password of a connected account. A token works only for the account that approved it, and only within what that account is allowed to see.

2. Google Workspace mailboxes

Connect a Gmail or Google Workspace mailbox so sequence emails are sent from it and replies come back into Dmand AI.

Google scope requested
ScopeWhat Google calls itWhy Dmand AI needs it
https://mail.google.com/Read, compose, send and permanently delete all your email from GmailSends email from the mailbox, and reads it to match replies to the right record and to spot bounces and threads
  1. Limits. No other Google scope, and no access to Drive, Calendar, Contacts or any other Google service. Dmand AI has no function that deletes email, although Google’s description of the scope includes deletion. Each mailbox is connected by its own owner; we do not use domain-wide delegation, so we cannot reach a mailbox that was not connected.
  2. For Workspace administrators. Google Workspace can block apps that ask for Gmail access until an administrator allows them. In the Google Admin console, go to Security, then API controls, then App access control, add Dmand AI (search by name or by the OAuth client ID shown in the Dmand AI connection dialog) and allow it. Users can then connect their mailboxes.
  3. Turning it off. Remove the mailbox in Dmand AI, remove Dmand AI at myaccount.google.com under Security and third-party apps with account access, or have your administrator remove it. Sending and mailbox access stop at once.

Google API disclosure. Dmand AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Microsoft 365 and Outlook mailboxes

The same job for Microsoft 365, Outlook and Exchange Online mailboxes. Dmand AI is published with Microsoft as a verified publisher and uses delegated permissions only, so it acts only for the person who signed in.

Microsoft Graph permissions requested
PermissionWhat Microsoft calls itWhy Dmand AI needs it
Mail.SendSend mail as a userSends email from the connected mailbox
Mail.ReadRead user mailMatches replies to the right record and spots bounces and threads
Mail.ReadWriteRead and write access to user mailSaves sent emails to Sent Items, creates drafts and keeps read status in step with the inbox in Dmand AI
MailboxSettings.ReadRead user mailbox settingsReads the time zone and automatic replies, so emails go out at the right local time and out-of-office replies are handled
MailboxSettings.ReadWriteRead and write user mailbox settingsRequested by Microsoft as the pair to MailboxSettings.Read. Dmand AI does not change your settings
offline_accessMaintain access to data you have given it access toKeeps scheduled emails sending and replies tracked when you are signed out
openid, profile, email, User.ReadSign users in and read their basic profileSigns you in and identifies the connected mailbox
  1. Limits. No other permissions, no application permissions, and no access to OneDrive, SharePoint, Teams, calendars or contacts. Dmand AI has no function that deletes email.
  2. For Microsoft 365 administrators. Under Microsoft’s default consent settings, users cannot grant the mail and mailbox settings permissions themselves. An administrator approves Dmand AI for the organization, directly or through Microsoft’s admin consent workflow, before users can finish connecting.
  3. Turning it off. Remove the mailbox in Dmand AI, revoke the permissions at myapplications.microsoft.com, or have your administrator remove them in the Microsoft Entra admin center under Enterprise apps.

4. Salesforce

Keep accounts, contacts and leads in step between Salesforce and Dmand AI, using the field mappings and sync direction you choose.

Salesforce scopes requested
ScopeWhat Salesforce calls itWhy Dmand AI needs it
id, profile, email, address, phoneAccess the identity URL serviceIdentifies the user who connected and the Salesforce org
apiManage user data via APIsReads and writes the Account, Contact and Lead records and fields you map, and reads field lists for the mapping screens
refresh_token, offline_accessPerform requests at any timeLets the scheduled sync run without someone signed in
  1. Limits. Only the Account, Contact and Lead objects, and only the fields you map. No administrative access, no setup or metadata changes, and no record deletion. The connection works with the permissions of the Salesforce user who approved it, so Dmand AI cannot see or change anything that user cannot.
  2. How the sync behaves. The sync runs on a schedule, aiming for about every 15 minutes for each object; timing varies with Salesforce limits. It copies values as they are at each sync, as the Terms of Service describe.
  3. Turning it off. Disconnect in Dmand AI, or revoke access in Salesforce Setup under Connected Apps OAuth Usage. Sync stops at once.

5. HubSpot

The HubSpot connection does the same job as the Salesforce one for HubSpot contacts and companies: it reads and writes only the records and fields you map, in the sync direction you choose, with the permissions of the HubSpot user who approved it. HubSpot shows the exact permissions on its consent screen before you approve. To turn it off, disconnect in Dmand AI or uninstall Dmand AI under Connected apps in your HubSpot settings.

6. Slack

Slack scopes requested
ScopeWhat it allowsWhy Dmand AI needs it
chat:writeSend messages as the appPosts reply notifications to the channel you choose
channels:readView basic information about public channelsLists channels so you can choose where notifications go

A notification shows the sender’s name, the subject, a short snippet and a link to the conversation in Dmand AI. Dmand AI does not read messages in your channels. To turn it off, uninstall the Dmand AI app in Slack’s app management.

7. Claude and other AI assistants

This connection runs the other way: you add the Dmand AI connector to your AI assistant and sign in with your Dmand AI account. The assistant can then search and read Dmand AI data with your account’s access and Credits, and asks before it spends a Credit. What you retrieve is delivered into your account with the assistant’s provider, under that provider’s terms and the data license in our Terms of Service. To turn it off, remove the connector in your assistant’s settings.

8. Managed mailboxes

Managed mailboxes are set up by Dmand AI on Google Workspace or Microsoft 365, on sending domains we hold for you, and connected to your Users’ sender profiles in the same way as the mailboxes above. They do not need any approval from your own Google or Microsoft administrators. They belong to you, and we transfer them on request, as the Terms of Service describe.

9. What we store and what we never do

  1. What we store. Encrypted access tokens; the emails Dmand AI sent; replies and their thread identifiers, shown in the inbox; bounce and delivery events; and the CRM records and fields you sync. All of it is stored on Google Cloud in the United States.
  2. What it is used for. Only to provide the features you connected the app for.
  3. What we never do. Sell data from connected accounts, use it for advertising, or use it to train AI models. Our staff do not read message content except with the User’s agreement for a specific message, where needed to investigate a security problem or abuse, or where the law requires it.
  4. When you leave. Synced records and mailbox data are Customer Data, deleted as the Data Processing Addendum describes.

10. Questions

Security and IT teams can write to hello@dmand.ai for more detail about any connection before they approve it.

Company
Launcheazy Inc
Mail
Privacy requests, Launcheazy Inc, 360 S Baywood Ave, San Jose, CA 95128

Revision history

Revisions by date
DateWhat changed
November 2, 2026First published version.

Cookie settings

Turn each category on or off. Your choice is kept for 12 months and you can change it here at any time.

Necessary

Always on. Sign-in, security, downloads you asked for, your cookie choice, and the page that led to a signup.

View cookies (6)
  • dm_consentDmand AI. Your cookie choices and whether your browser sent a Global Privacy Control signal. 12 months.
  • dm_ft, dm_ltDmand AI. The first and the latest page you arrived on, with the date, so a signup is credited to the page that worked. 90 days, 30 days.
  • dm_fs, dm_lsDmand AI. The first and the latest source of a visit (a search engine, a campaign or the site that linked here). 90 days, 30 days.
  • dm_dl, dm_dl_okDmand AI. After you give an email address for a download, lets you download files without being asked again. 30 days.
  • Session and CSRF cookiesDmand AI (app.dmand.ai). Sign-in and form protection in the application. Session.
  • __cf_bm, cf_clearanceCloudflare. Tells people from automated traffic and keeps the site available. 30 minutes; cf_clearance while a security check is valid.

Analytics

On unless you turn it off. How pages are used, in aggregate, and recordings of how pages are used.

View cookies (6)
  • Google Tag ManagerGoogle. Loads the analytics and marketing tags that are on. Sets no cookie of its own and does not load when both categories are off. n/a.
  • _ga, _ga_<container-id>Google Analytics 4. Visits and page views in aggregate on dmand.ai. 2 years.
  • _clck, _clskMicrosoft Clarity. Recordings and heatmaps of how pages are used, with form fields masked. 1 year, 1 day.
  • CLID, MUID, ANONCHK, MR, SMMicrosoft (clarity.ms). Set by Microsoft when Clarity loads, to recognize a browser across sites that use Clarity. Up to 1 year.
  • None (cookieless)Ahrefs Analytics. Page views in aggregate. n/a.
  • ph_<project>_posthogPostHog. Product usage, errors and performance in app.dmand.ai, used to fix bugs and improve features. 365 days.

Marketing

On unless you turn it off, and always off when your browser sends a Global Privacy Control signal. A visitor identification service tells our sales team which companies and people visit.

View cookies (6)
  • _reb2buid, _reb2butkRB2B. Recognizes a returning browser for visitor identification. 360 days, 1 year.
  • _reb2bgeoRB2B. The location used to decide whether a visit can be identified. 20 days.
  • _reb2brefRB2B. The page or site that referred the visit. 15 days.
  • _reb2bfxf, _reb2btd, _reb2bliRB2B. Links the visit to an identified business profile. 1 month.
  • _reb2bresolveRB2B. Holds a match while it is being resolved. 2 days.
  • _reb2sessionID, _reb2bloadedRB2B. The current visit, and a guard against loading the script twice. 30 minutes, 1 second.

Functional

On unless you turn it off. Remembers choices such as a collapsed section.

View cookies (none today)