Data & Privacy

The Short Version

Your data is stored in your Google account. Contacts, CRM rows, invoices, and calendar events are read from and written to your own Google Sheets, Google Contacts, Gmail, Calendar, Drive, and Tasks. Water LLM doesn't copy your data to its own servers.
AI features send a structured snapshot to Google's Gemini API. The snapshot is minimal (see the table in the AI Features section below), and Google is contractually prohibited from using it to train or improve any AI model.
Subscription verification sends only your email address to a Firebase Firestore database operated by Water LLM. The record it looks up holds your billing details — and nothing about your contacts, clients, invoices or calendar. Every field is listed here.
No third-party AI providers. All AI processing goes through Google's Vertex AI (the same infrastructure powering Google Workspace AI). There is no OpenAI, Anthropic, or other external API involved.
You can revoke access or delete everything at any time. Instructions are in the last two sections of this page.

Where Your Data Lives

Data Type	Where It Lives	Who Controls It
CRM contacts, notes, status, communication history	Your Water LLM Google Spreadsheet (Google Drive)	You — it's a file in your Drive
Invoices, client sessions, deal pipeline	Your Water LLM Google Spreadsheet (Google Drive)	You
Contact details (name, email, phone)	Google Contacts (your account) — synced bidirectionally with the spreadsheet	You
Invoice and style guide documents	Your Google Drive (in the `Water LLM/` folder)	You
LinkedIn connection and message data	Imported into your spreadsheet only — never sent to Water LLM servers	You
Add-on settings and preferences	Google Apps Script User Properties (stored in Google's infrastructure, scoped to your account and this script)	Google / cleared by you via Danger Zone → Reset All User Properties
Subscription status	A Firebase Firestore database operated by Water LLM (Google Cloud). One record per user: your email address, subscription and billing state, Stripe identifiers, billing period dates, the version of the terms you accepted, your signup date, and your spreadsheet’s file identifier (an identifier only — it grants no access to the file). Full field list.	Water LLM — deletable by you at any time

Copying the spreadsheet

If you copy your Water LLM spreadsheet, the sheet data (contacts, invoices) copies with it, but the add-on's User Properties do not. The copy won't be linked to Water LLM and the Contact IDs will still reference your original Google Contacts — syncing from a copy could cause unexpected overwrites. Use copies for archival only, not as a working CRM.

Google Permissions Water LLM Uses

When you install Water LLM, Google asks you to grant a set of permissions. There are 20 of them, and rather than keep a second copy of that list here — which is how documentation drifts away from the product — they live on one page of their own:

Every permission, in full →

That page carries the complete list with the exact scope strings Google shows you, what each is used for, which features need it, and — the part worth reading — why a narrower permission would not do the job. It is also what Google's reviewers and our security assessors work from, so it cannot quietly say something different from what we tell them.

The short version, by the service you already know:

Service	Why Water LLM needs it
Google Sheets	Your Water LLM spreadsheet is the product — the CRM, invoices, clients, pipeline and dashboard all live in it. Nothing in any other spreadsheet.
Google Contacts	Two-way sync, so your CRM and your contacts stay in step instead of becoming two lists you maintain separately.
Gmail	Reading who you exchanged mail with and when; writing drafts; sending your own briefings to yourself; and one label for newsletters. Four narrow permissions rather than one broad one — see below.
Google Calendar	Reading events for meeting hours, last and next meeting and your briefings. Writing them only when you ask the Chat Assistant to add one, and for bookings on your booking page — which is also what makes Google Calendar send the booker their invitation.
Google Drive	One folder, `Water LLM/`, holding invoice PDFs, templates, notes docs and your LinkedIn import. Nothing outside it. Why it still asks for full Drive access.
Google Docs	Creating your per-contact notes documents and reading your Style Guide.
Google Tasks	Creating the Follow Up task after a matched meeting, and tasks you ask the Chat Assistant to add.
Google Chat	Letting the Chat Assistant reply when you message it. It cannot start a conversation.
Your email address	Identifying you, so your subscription can be checked and your settings kept separate from anyone else's.
Running in the background	Drawing the add-on's screens, installing the overnight schedule, and making the outbound calls listed under what leaves your account.

What Gmail access is actually used for

For tracking communication — which is most of what Water LLM does with Gmail — only subject lines, timestamps and sender/recipient addresses are read. Bodies are not read, stored or transmitted for that purpose.

Some features do read email text, and each is named openly because you should be able to decide about them. Two run on a schedule: the Daily Assistant (short excerpts of recent emails with the people you're meeting today) and the Weekly Client Recap (your correspondence with active clients, summarised into their notes Doc). The Newsletter Digest reads only mail your filters file under the Subscriptions label, and ships off. Meeting Prep and the Gmail panel's Catch me up read recent emails with one person, only when you ask. Excerpts are capped at 1,500 characters per message and are processed by Gemini under the same Google Cloud terms as everything else. The scheduled ones can be switched off in Configure Hub › Automation Scheduling. Full breakdown by feature.

What AI Features Send to Gemini

Water LLM uses Google's Vertex AI platform to access the Gemini language model. When you run an AI feature, Water LLM assembles a structured prompt from your data and sends it to Gemini. The response comes back and is delivered to you as an email or Gmail draft. Nothing is stored in between.

Your data never trains an AI model

Water LLM calls Vertex AI under Google Cloud's enterprise terms, which prohibit Google from using your prompts or the AI's responses to train, fine-tune, or improve any AI model. That is a contractual commitment covering every Vertex AI customer — not an optional setting that could be switched off. Each call is independent: Gemini has no memory of previous requests, and Water LLM keeps no copy of anything you send or receive. All processing stays within Google Cloud infrastructure, and no third-party AI provider is ever involved. Google may briefly retain request data for abuse monitoring under its standard Vertex AI terms; that data is not used for training, and we cannot access it.

What each AI feature sends

Feature	Data Sent to Gemini
Daily Assistant (morning briefing)	Today's calendar event titles, times and attendee names. For attendees matched in your CRM: company, title, notes and last contact date. Email excerpts: up to 5 recent emails per attendee from the last year — sender, date, subject and up to 1,000 characters of text each — so the briefing can say where things stand.
Weekly Business Briefing	The past 7 days of calendar events and the next 14 — titles, times, attendees, RSVP status — plus the CRM context for the people in them. No email bodies.
Monthly Business Analysis	The computed figures already on your dashboard: revenue, profit, collection, ageing, product mix, pipeline, client health. Clients flagged as at risk are named. No email content, and no raw invoice rows.
Meeting Prep	The contact's CRM fields (name, company, title, notes), the most recent entries from their notes Doc (up to 3,000 characters; 1,500 per person for a group meeting), and your own description of what you do and who you serve. Email excerpts: up to 8 recent emails with them from the last 120 days, up to 1,500 characters each. Runs only when you ask for a prep brief — from the sheet, the Mobile Hub or the Gmail panel.
Catch me up (Gmail panel)	Email excerpts from your recent conversations with one contact — up to 14 messages from the last year, up to 1,500 characters each, quoted replies removed. Runs only when you click it. The summary is kept in your own Google account and reused until a new email from that person arrives.
Weekly Client Recap New	Email bodies. Up to 15 messages per address from the last 7 days, each truncated to 1,500 characters, with quoted history stripped first. Quiet replies and calendar noise are filtered out before anything is sent. The summary that comes back is written into a Google Doc in your Drive. See the note below.
Email Outreach and Workflow Engine	Your template (subject and body), and the CRM fields of the contacts your filters matched: name, company, title, last contact date, notes.
Meeting Follow-Ups	The title, time and attendees of the meeting that just ended, plus the matched contact's CRM fields. No email bodies.
Task Manager	Contact names and the status context behind each suggested task. No email content, no financial detail.
Newsletter Digest	Email bodies — but only from messages your filters file under the Gmail “Subscriptions” label. Ships switched off; you can turn it on during setup or in Automation Scheduling.
Voice Style Scan	The website URLs you supply, and excerpts of emails you have already sent, so the Style Guide can learn how you write. You choose when to run it.
Birthday Notes	The contact's name and your message template. No notes, no financial data. Ships switched off.
Chat Assistant	Your message, and whichever CRM, client, deal or invoice records are needed to answer it. Every read and write is logged to the 🤖 Chat Audit tab in your own spreadsheet, trimmed after 180 days. A copy of each entry is also mirrored to Firestore and kept 90 days — see the note below, because that copy outlives uninstalling the add-on.

Which features send email text

On a schedule: the Daily Assistant (short excerpts for the people you meet that day), the Weekly Client Recap, and — if you turn it on — the Newsletter Digest. On request only: Meeting Prep and Catch me up. The recap ships on, because it is the feature most people install for — but it means summaries of client correspondence are stored in Google Docs in your Drive, and excerpts pass through Gemini to produce them.

If that isn’t appropriate for your practice — therapy, medical, legal, anything with a confidentiality obligation you can’t delegate — switch it off in Configure Hub › Automation Scheduling before your first Saturday. We would rather you knew now than found out from a Doc.

How Water LLM connects to Vertex AI

Water LLM uses a dedicated service account (a special Google Cloud identity) to authenticate with Vertex AI. This means:

You don't need your own Google Cloud account or Vertex AI setup
The service account credentials are stored in Google's Script Properties (not in your spreadsheet)
Authentication uses signed JWT tokens — no passwords are transmitted
Calls go directly to aiplatform.googleapis.com
Vertex AI usage is covered by your subscription — you're not billed separately

Subscription Verification

Water LLM verifies your subscription status against a Firebase Firestore database operated by Water LLM (hosted on Google Cloud). Here's exactly what happens:

1

Water LLM sends your Google email address to the Firestore subscriptions collection
2

Firestore returns your active/inactive status
3

Water LLM stores a cryptographically signed token in your Google Apps Script User Properties. This token encodes the month and year of the check, signed with a secret key — it can't be forged.
4

For the next ~30 days, verification happens locally using that signed token — no Firestore call needed

What is sent to Firestore: only your Google account email address. No contact, invoice, calendar or spreadsheet content is ever sent during a subscription check.

What is stored in Firestore: one subscription record per user, holding your email address, subscription and billing state, Stripe customer/price/product identifiers, plan interval, amount and currency, billing period dates, cancellation and payment-failure timestamps, the date and version of the terms you accepted, your signup date and onboarding-email position, and your spreadsheet’s file identifier. That identifier is a reference, not access — it does not let anyone open the file. Every field, with the reason it exists.

The Chat Assistant keeps its record in your spreadsheet, not ours

The Chat Assistant lets you DM a bot to read and write your CRM. Every action it takes — what you asked, which tool it used, and the value before and after any change — is written to a 🤖 Chat Audit tab in your own spreadsheet, so you can always see exactly what it did. That tab is yours, it is trimmed after 180 days, and it is the only place those records exist.

Until 21 September 2026 a copy was also written to our Firestore database, so that the record would survive if the spreadsheet were deleted. It carried your email address, your message to the assistant, and the CRM values before and after each change. We removed it. It was the only path by which CRM content reached our infrastructure, it contradicted what our licence terms promise, and on review nothing in the product ever read it back. Keeping a copy of your client data to answer a question we were never actually asking was not a trade worth making.

The subscription record described above is now the only thing Firestore holds for anyone, whether or not they use the Chat Assistant.

How long it is kept: for as long as your account is active. When a subscription ends, the record is marked for deletion and removed automatically about 28 days later — a window that exists so a cancellation made in error, or a change of mind, doesn’t cost you your setup. Entries in the onboarding email queue expire within 30 days. You can delete everything yourself at any time without waiting.

No client can read the database

The add-on never reads Firestore directly with your credentials. Rules deny all client access; reads and writes go through a server identity. One subscriber cannot look up another.

What Water LLM Cannot Do

Some boundaries are worth being explicit about:

Water LLM cannot…	Why
Access your spreadsheet without your Google account being active	All access goes through your OAuth session — if you revoke permissions, all API access stops immediately
Send emails on your behalf without creating a draft first	Everything written to a third party — outreach, invoice emails, reminders, follow-ups, workflow steps — lands in your Gmail drafts, and you press send. What is sent without you: your own briefings, reports and booking notifications, all addressed to you; two optional booking-page emails to whoever books a slot (a confirmation, and a reminder 24 hours before — both off unless you switch them on); and billing notifications, which come from the payment system rather than the add-on. The calendar invitation a booker receives is sent by Google Calendar, not by Water LLM — they were added as a guest on the event. More on this.
Access other people's spreadsheets or contacts	OAuth scopes are per-user — Water LLM can only access the data of the account that granted the permissions
Store your spreadsheet data on Water LLM's servers	No Water LLM server receives CRM, invoice, or contact data. Processing runs inside Google Apps Script (Google's infrastructure, your account).
Train AI models on your data	Google Cloud's enterprise terms for Vertex AI prohibit Google from using your prompts for training. Water LLM has no mechanism to receive or store model training data.
Read email bodies, except for the named features above	Communication tracking reads subject lines, timestamps and addresses only. The Daily Assistant, Weekly Client Recap and Newsletter Digest read email text on a schedule; Meeting Prep and Catch me up only when you ask. Each is described in full above, and the scheduled ones can be switched off.

Revoking Add-On Access

You can revoke Water LLM's OAuth permissions at any time. This immediately stops the add-on from accessing your Gmail, Contacts, Calendar, Drive, and Sheets via the API. Your spreadsheet data and Drive files are unaffected — only the API access is removed.

1

Open your Google Account permissions
Go to myaccount.google.com/permissions
2

Find Water LLM
Scroll the list or search for "Water LLM"
3

Remove access
Click Remove Access and confirm

Revoking access does not delete your spreadsheet or Drive files. It only prevents Water LLM from calling Google APIs. If you reinstall the add-on later, you'll be prompted to re-grant permissions.

Full Data Deletion

There are two separate things to deal with, and they are easy to confuse. Your data is almost entirely inside your own Google account, where deleting it is an ordinary Drive operation. Our record of you is one document in Firestore, which you can delete yourself in two clicks.

Deleting your data does not cancel your billing

They are separate systems, deliberately — a deletion request should never be able to silently change what you are paying for, in either direction. Cancel your subscription through Stripe as well, or you will keep being charged for an add-on you have removed.

Delete the record we hold — yourself, now

Water LLM › Configure Hub › Danger Zone › Delete My Data

This removes your Firestore subscription record and clears every setting stored against your Google account, immediately. It works whether or not your subscription is still active. Your spreadsheet, your Google Contacts and your Drive files are not touched — they are yours, and they keep working as an ordinary spreadsheet.

If you can’t open the add-on, email support@waterllm.com and we will delete it for you within 30 days. And if you simply cancel and do nothing else, the record deletes itself automatically about 28 days later.

Remove everything from your own Google account

1

Revoke the add-on’s access
Follow the steps in Revoking add-on access above. Water LLM immediately loses all access to your Gmail, Calendar, Contacts and Drive.
2

Delete the spreadsheet
Move it to Drive Trash and empty the Trash. Export it first if you want to keep the data — it is an ordinary Google Sheet, so File → Download gives you a real file.
3

Delete the Water LLM/ Drive folder
It holds your invoice PDFs, templates, LinkedIn import data, and the per-contact Notes Docs — including any weekly recaps. Check it before you empty the Trash; these are often the files people most want to keep.
4

Tidy up the rest, if you want to
Contacts synced to Google Contacts stay there, because they are your contacts. The same goes for Gmail drafts, Google Tasks, calendar events and the Subscriptions Gmail label. Remove any of them the normal way.

Once you have done both halves, nothing of yours remains on Water LLM’s servers, and nothing remains in your Google account either.

This Website (waterllm.com)

Everything above is about the Water LLM add-on. This section covers the website you are reading, which is separate: nothing on waterllm.com can see your Google account, spreadsheet, Gmail or Calendar.

Hosting and analytics. This site is hosted by Netlify. Like most web servers, Netlify’s servers record each page request — the page asked for, the referring site, your browser type and your IP address — and keep these logs for less than 30 days. We use Netlify Analytics, which turns those server logs into aggregate figures such as page views, top pages, referring sites and approximate visitor counts. We see only those totals, not individual visitors or IP addresses.

No cookies or tracking scripts. This site sets no cookies and runs no analytics or advertising code in your browser, and we do not use the analytics to identify you or follow you across other websites. That is why there is no cookie banner. The page fonts are loaded from Google Fonts, so your browser also requests them from Google’s servers, which see your IP address as part of that request; Google Fonts sets no cookies.

Forms. If you join the waitlist or use the contact form, what you type is sent to us through Netlify.

Contacting Water LLM About Privacy

For privacy questions, deletion requests, or a data subject rights enquiry:

Email support@waterllm.com — it reaches the same person either way. Water LLM is made by Saville Coaching LLC.

You do not have to wait for us to act on a deletion request: you can delete the record we hold yourself, from inside the add-on, at any time. Requests that do need us are answered within 30 days.

See also: the privacy section of the licence agreement, which is the binding version, and Security, which lists every field we store and why it exists.

🔒 Data & Privacy