Sym — Privacy policy
This policy explains how Sym (https://sym.insym.io, formerly the Insym MCP hub at mcp.work.insym.io), operated by Insym L.L.C. (Sheridan, Wyoming, USA), accesses, uses, stores, shares and deletes data, including Google user data. Contact: contact@insym.io.
1. Who uses the hub
The hub is an internal tool. It is used only by Insym staff and Insym software, through AI assistants they connect with Insym's access key. It acts on Insym's own Google account, which Insym connected once through Google's sign-in. It does not sign in other people's Google accounts.
2. Google user data we access
With the permissions Insym granted, the hub can access, only when a person asks for it in their assistant:
- Gmail: messages, labels, drafts and settings, to search and read mail, draft and send replies, and organise mail;
- Google Drive: files and folders, to find, read, create, copy, move and share files;
- Google Calendar: calendars and events, to view the schedule and create or change events;
- Google Docs, Sheets, Slides and Forms: documents, spreadsheets, presentations, forms and form responses, to read and edit them;
- Google Tasks and Contacts: task lists and contacts, to read and update them;
- Apps Script: script projects and deployments, to read and update Insym's scripts;
- Basic profile: the account's name and email address, to identify the connected account.
3. How we use it
Google user data is used only to perform the action the person requested in their assistant and to return the result to that person. We do not use it for advertising, we do not sell it, we do not use it to build profiles, and we do not use it to develop, improve or train artificial-intelligence or machine-learning models.
4. What we store and for how long
- Google sign-in tokens (access and refresh tokens) are stored encrypted on Insym's server so the connection keeps working, until access is revoked.
- A call log of each request: time, the caller's network address, which tool was used and whether it succeeded. It never contains the content of emails, files, events or other Google data, nor request arguments. Kept for 90 days, then deleted.
- Google data itself is not stored by the hub. It passes through to answer the request and is not kept in its database, logs or backups.
5. Sharing
Google user data is returned only to the AI assistant the requesting Insym staff member is using (for example Claude, ChatGPT or Gemini), because that person asked for it there; that assistant's own privacy terms then apply. We do not share, transfer or disclose Google user data to anyone else, except where required by law or to protect against fraud and security threats. The hub runs on a server Insym rents from its hosting provider, which processes data only on Insym's behalf.
6. Limited Use
Sym's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Security
All traffic is encrypted with HTTPS. Access needs Insym's secret key, held only by Insym; every call is logged and rate-limited. Sign-in tokens are encrypted at rest. The server is administered only by Insym.
8. Revoking access and deletion
Access can be revoked at any time at Google account permissions (remove "Sym", or "Insym MCP hub" if it still shows that name); the stored tokens then stop working and are deleted by Insym on request. To have any data deleted, write to contact@insym.io; we answer within 30 days.
9. Children
The hub is a business tool and is not directed to children under 16.
10. Changes
We will update this page and its effective date when this policy changes.