Your connected inbox data

Last updated: 17 October 2026

How Voltara uses a Gmail or Microsoft mailbox you connect, how to disconnect it, exactly what disconnecting deletes, and how to remove Voltara’s access or your whole account. Our Privacy Policy has the full detail.

What Voltara reads

Voltara reads only your Inbox (the Gmail INBOX label or the Microsoft Inbox folder) and is read-only: it never sends, deletes or changes your mail. It keeps a copy of messages that look like replies from DNOs, certification bodies, SEG providers, wholesalers or your customers, so it can match them to the right job. For each one it stores, encrypted, the sender, subject, body and headers, the original email file and any attachments, and the compliance details it extracts (such as an MPAN or application reference). It also stores your mailbox address and an encrypted refresh token so background sync keeps working.

How to disconnect a mailbox

1. Sign in to Voltara and open Settings › Inbox.
2. On the connected Gmail or Microsoft card, choose Disconnect.
3. Read the summary of what will be deleted, then choose Disconnect and delete. Voltara shows what it deleted, or an error if anything could not be finished.

What disconnecting deletes

• Voltara stops reading the mailbox straight away.
• Gmail: Voltara asks Google to revoke Voltara’s access, which removes it from your Google account’s third-party access list. If Google cannot be reached, Voltara still deletes your data and retries the revoke every day.
• Microsoft: Microsoft does not let an app revoke its own access, so Voltara deletes its stored sign-in token and its notification subscription. Remove the permission yourself as described below.
• Every email Voltara copied from that mailbox is permanently deleted, except emails you have already added to a job (see below): sender, subject, body and headers, the stored email files and attachments, the compliance details extracted from them, and job matches still waiting for your review.
• The saved mailbox address, account identifier and refresh token are deleted. If Google could not be reached, Voltara keeps only what it needs to retry the revoke: your mailbox address, your Google account identifier and the encrypted token (no email content), for no more than 30 days. They are deleted as soon as Google confirms, or when the 30 days are up.
• When you disconnect your last connected mailbox, the senders you chose to trust (an unencrypted list of their exact addresses) are removed too. (You can also remove any of them at any time in Settings › Inbox › Senders you trust.)
• If any part of the deletion fails, Voltara retries every day until it is done, even if you reconnect the same mailbox in the meantime. Mail that arrives after you reconnect is not affected.

What is kept:

• Emails and details you have already added to a job (for example a DNO approval saved as evidence, or a status change on the job timeline) stay on that job. They are part of your compliance record for that installation, not a copy of your mailbox, and are kept for as long as that record is.
• A short audit note that the mailbox was disconnected: when, which provider, whether access was revoked, and how many items were deleted. It contains no email content and no email addresses. Records of when Voltara accessed message content are kept the same way, without the content.

Remove Voltara’s access at your provider

You can do this at any time, before or after disconnecting:

• Google: go to myaccount.google.com/permissions, choose Voltara, and remove its access.
• Microsoft work or school account: go to myapps.microsoft.com, open Voltara and revoke its permissions (your IT administrator may manage this for you).
• Microsoft personal account: go to account.live.com/consent/Manage and remove Voltara.

Removing access at your provider stops Voltara reading your mailbox, but does not by itself delete the copies Voltara already holds. To delete those, disconnect in Settings › Inbox or email us.

How long we keep it

• Copied message content (body, subject, sender, headers, email files and attachments) is deleted automatically 12 months after it arrives, unless you added that email to a job. A daily job does this; only non-content details such as the sender’s domain and the date remain.
• Compliance details extracted onto a job are kept while that job exists and deleted with it.
• Inbox audit records are kept for up to 7 years.

Delete your Voltara account

Email privacy@voltarahq.com from the address you sign in with and ask us to delete your account. We will delete your account and the data held with it, including any connected mailboxes and everything copied from them, confirm by email, and tell you if anything has to be kept by law. We respond within one month, as UK GDPR requires. You can use the same address for any other privacy request.