Privacy policy
Last updated: 15 November 2026
This policy explains what personal data Parrott Labs collects, why, how long we keep it and what control you have over it. It covers this website (parrottlabs.com) and our application Parrott Mail Signals, including the Google user data it accesses through the Gmail API.
1. Who we are
Parrott Labs is the trading name of Harry Parrott, an individual based in the United Kingdom. Parrott Labs is not an incorporated company. Harry Parrott is the data controller for the personal data described in this policy.
Contact: hello@parrottlabs.com.
2. Parrott Mail Signals and Google user data
What it is and who uses it
Parrott Mail Signals is a private email-notification utility (about the application). It connects to Parrott Labs' own Gmail account, notices new business notification emails, such as order and message notifications from online services we use, checks that each one genuinely came from the sender it claims, and records a short reminder for us. It is not offered to the public, and no one outside Parrott Labs connects their Google account to it.
The permission it uses
Parrott Mail Signals asks Google for one permission only: https://www.googleapis.com/auth/gmail.metadata. Google describes it on the consent screen as "View your email message metadata such as labels and headers, but not the email body."
- It cannot read the body of any email or open any attachment.
- It cannot send, change, label, move or delete email, and the software refuses to run with any broader permission.
- The permission would allow the headers of every message in the account to be read. Parrott Mail Signals deliberately reads less: it asks Gmail only for messages carrying one label, which a Gmail filter applies to the notification emails we have chosen. It does not read the rest of the mailbox.
The data it reads
| Data from Google | Why |
|---|---|
| The names and identifiers of the account's Gmail labels | To find its own label, so that it asks Gmail for labelled messages only. Only that label's identifier is used, and the list is not stored |
| Message and history identifiers, and the time Gmail received each message | To find new messages since the last check and never process one twice |
The From header | To check who sent the notification |
The Authentication-Results header added by Google | To confirm the message genuinely came from that sender (it passed Google's DMARC check), so a forged email is never acted on |
The Subject, Date and Message-ID headers | To tell what kind of notification it is (for example a new order or a new message), read any order or reference number, notice late or duplicate messages, and show the notification to us |
A notification's subject line can include the name or username of a customer or another person who contacted us through an online service. That is the only information about anyone other than Parrott Labs that the application can see.
How we use it
Only to provide the application's one feature: telling Parrott Labs promptly about the notifications we have chosen. The headers are interpreted by fixed rules, not by AI models. The reminder it records contains the kind of notification, any order or reference number and the time received, not the subject line. Reminders are used within Parrott Labs' own systems to help us manage the work, and an email is never treated as a person's instructions or as proof of payment: we always check the original service directly.
We do not use Google user data for advertising, we do not sell it, we do not use it to build profiles of anyone, and we do not use it to develop, improve or train AI or machine-learning models.
Where it is stored and how it is protected
- Google user data is processed and stored only on computers controlled by Parrott Labs. It travels only between Google's Gmail API and those computers, over encrypted HTTPS connections.
- The authorisation token that Google issues is kept in the operating system's encrypted credential store. It is never written to files or logs.
- The records described below are kept in a database that only Parrott Labs can open.
What we keep, and for how long
- Notification records (message identifiers, the time received and the
Dateheader, sender domain, verification result, notification kind, any order or reference number, and how we handled it): deleted automatically 180 days after the message was received. - Subject lines: erased automatically 30 days after the message was received.
- Messages more than 180 days old when first seen are never recorded.
- On disconnection, the token and every stored notification record are deleted immediately. Reminders already recorded keep only the notification kind, order or reference number and time, as part of our business records of that work.
Sharing
We do not share, transfer or disclose Google user data to anyone, except if the law requires it.
Removing access
The connection can be removed at any time at myaccount.google.com/permissions (it appears as "Parrott Mail Signals"). Our own disconnect step also deletes the stored records, as described above.
3. Limited Use of Google user data
Parrott Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Visitors to this website and email
- This website is a set of static pages. It sets no cookies, runs no analytics or tracking, loads nothing from other websites, and has no forms or accounts.
- The site is hosted by Cloudflare. To deliver the pages and protect them from abuse, Cloudflare processes technical data about each request, such as your IP address, browser type and the page requested, and may do so outside the United Kingdom under its own safeguards. See Cloudflare's privacy policy.
- Email sent to
parrottlabs.comaddresses is received through Cloudflare's email routing service and delivered to our mailbox. If you email us, we use your message and address only to reply and to keep a record of the conversation, for as long as it is needed for that purpose and our business records.
5. Our lawful basis
- Parrott Mail Signals: our legitimate interests in responding promptly and reliably to the people we work with, and in protecting ourselves from forged emails. Where a notification relates to work for you, it also helps us perform our contract with you. We keep the data to the minimum needed, for a short period, and never use it for anything else.
- This website: our legitimate interests in keeping the site available and secure.
- Email you send us: our legitimate interests in replying to you, or taking steps you ask for before entering into a contract.
6. Your rights
Under UK data protection law you have the right to ask for a copy of the personal data we hold about you, and to ask us to correct it, delete it or restrict its use. Because we rely on legitimate interests, you also have the right to object to our use of it. Contact us at hello@parrottlabs.com; we will reply within one month. If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.
We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. Our services are not directed at children.
7. Changes and contact
If what Parrott Mail Signals reads or how we use it changes, we will update this policy first, change the date at the top, and ask for Google's consent again if the permission changes. Questions: hello@parrottlabs.com.