Private from the recipient.
Honest about the rest.

What the recipient sees

The email comes from Nastygram, not your address. The message may still contain clues that reveal who wrote it. AI privacy checks can make mistakes; avoid sensitive information and ask for a preview if you want to check the wording before sending.

How information is handled

Feedback is processed to compose, check and deliver the message. Messaging and AI providers process content and metadata under their own policies. Feedback shared in ChatGPT is also part of that conversation and subject to your ChatGPT settings.

Nastygram’s application database stores keyed hashes, timestamps and delivery or opt-out status for abuse prevention and duplicate protection, rather than plaintext reviews or sender contact addresses. Activating portal history adds the encrypted records described below. Recipient email addresses are additionally retained encrypted for the owner’s private delivery dashboard; sender names and addresses are not added to analytics. If a send is queued for retry, its feedback and recipient address are stored in encrypted form. Automatic attempts stop within 24 hours; encrypted content is removed after processing finishes or on the next background cleanup after expiry. If the background service is offline, cleanup waits until it resumes. Service providers and platform logs may retain information separately. The current pilot does not have a published retention schedule for these records.

Failed review diagnostics

When an automatic privacy review fails, Nastygram retains the original draft, attempted rewrites, failed checks, model explanations, model and prompt versions, and timing in an encrypted diagnostic record for seven days. Only the site owner can inspect it or replay the privacy review without sending. Account identity and delivery addresses are not added to these records; information typed into a draft may still identify people. Replay results expire with the original record and do not extend retention. Expired records are immediately inaccessible and automatically deleted on the next background cleanup or diagnostic access. If the background service is offline, physical deletion waits until it resumes. Successful reviews are not retained in this diagnostic store. Routine logs contain request references, fixed reason codes and timing, not drafts or model explanations.

Private dashboards and replies

Signing in uses the same ChatGPT account as sending. Activating sender history explicitly allows Nastygram to store final anonymized messages and destination details encrypted for up to 365 days. We do not keep your original rough notes for dashboard history. If you send before activating history, up to 20 recent final sent copies are kept in this browser tab’s session storage for up to 24 hours so activation can save them to your account. These copies clear on sign-out or account change and are not sent again. Closing the tab removes this recovery path. Earlier submissions may show status only when their text is unavailable. An authorized historical repair can restore final sent copies from Zoho Sent when uniquely matched to existing delivery records. These copies are encrypted, remain restricted to the original sender, and expire 365 days after the original submission; restoration does not enroll an account in future history or grant restaurant access. Email-origin submissions are not automatically linked to a ChatGPT account.

A verified restaurant receives new feedback directly in its private account, without an additional delivery email. Businesses can opt into email alerts that contain a dashboard link, without feedback text or sender details. Restaurant staff see the feedback and private replies, not your ChatGPT name, email address, or account identifier. Context in a message can still identify you. A restaurant with active paid reply access can respond in that thread; you can read responses without paying.

Thread content expires after 365 days. The background queue worker performs bounded cleanup of expired content. Reading a dashboard does not change stored records. Dashboard queries stop exposing expired content even if physical cleanup is delayed; the current background worker depends on the configured Mac service being online. Minimal duplicate-prevention records can remain after content expires. Deleting your account or content cannot recall an email or copies already seen by recipients. In Account & privacy controls, you can export retained conversations and stop saving future optional email history. Direct feedback to a claimed restaurant still requires a shared conversation. A conversation’s Erase retained content control removes its retained text and replies, including the restaurant’s shared copy after your explicit confirmation, and stops further replies. Delivery, duplicate-protection and audit metadata remain. Erasure does not cancel a queued send or delete provider copies. Full account and provider-data requests can be sent through our support page.

Connected ChatGPT tools can retrieve the same history and replies you are authorized to see and return aggregate data for charts. Reading or listing messages in ChatGPT does not automatically mark replies as read. Content shared in the conversation is governed by your ChatGPT settings. Private sender, restaurant, and administration portals do not load Clarity session recording.

Restaurant reply drafts and the exact details of pending reply attempts are saved in this browser tab’s session storage, scoped to the signed-in account, location and conversation. They survive a reload so an uncertain send can reuse its original request. They clear after a successful send, sign-out, account change or the end of the browser tab session. Restoring a draft never sends it automatically.

Inbox claims store the business name, location or shared inbox description, encrypted contact address, verification status and audit evidence. Access is activated automatically after the signed-in claimant enters a single-use email code. Codes expire after 15 minutes, allow five attempts, and are stored only as keyed hashes. Verification proves control of that exact email address, not legal ownership of the business or other addresses. New claims do not expose historical email feedback or transfer an existing inbox. Payment alone does not verify inbox access. Administrative account, claim and reply metrics use counts and exclude message content and sender contact details.

Business research and partner requests

If you share feedback on our business concept, we store your business name, contact name, email address, answers about value and price, optional feedback on the name and branding, and submission time to evaluate the proposed offer and follow up about your answers. This does not enroll you in a subscription or marketing list. Earlier partnership requests may also include an optional website. These records are separate from anonymous customer messages. Business form fields are marked for masking in Clarity recordings. The current pilot does not have a published retention schedule for these records.

Website analytics

We use Microsoft Clarity to understand website usage through interaction data and session recordings. The message composer, including feedback and recipient details, is marked for masking in Clarity recordings. Microsoft processes analytics data under its privacy statement.

Restaurant subscriptions

Where subscriptions are enabled, Stripe hosts checkout and subscription management and processes billing information under its own policies. Nastygram stores provider customer, subscription and checkout identifiers, payment status, period dates and signed event identifiers to manage reply access. Card details are not entered into or stored by Nastygram. The recurring price and terms appear at checkout before payment. Payment does not verify restaurant ownership.

Feedback analytics

For internal usage reporting, Nastygram counts provider submission statuses and daily totals from existing delivery records. The owner-only dashboard shows recipient email addresses, stable anonymous sender labels, timestamps, counts and outcomes. Signed-in website and plugin activity use a Site-scoped account identifier, transformed into a keyed anonymous ID, to measure first accepted sends, returning senders and frequent use. This is not a global ChatGPT identity and does not provide conversation history. Inbound email identities remain separate. AI automatically estimates recipient categories (person or business, and business type) from privacy-reviewed feedback and any supplied broad category context. Only category labels and their source are saved for analytics; message text, explanations and sensitive personal traits are not retained for this purpose. The classifier receives no recipient email or account identity. Uncertain cases and historical records without sufficient context stay unknown. The owner can override labels. The owner can separately load final feedback from the service mailbox’s Sent folder and request common-theme analysis through the existing AI provider. Only uniquely matched provider-accepted product messages are included; unrelated mail, failed attempts and uncertain submissions are excluded. Theme analysis receives the final feedback and opaque references, without recipient addresses or sender account identifiers. The analytics application does not add persistent message-body or theme storage. The mailbox and AI provider retain data under their own policies; feedback itself may contain identifying context. These private views do not load Clarity session recording, and the records are not sent to Clarity. Historical recipient addresses can be restored when verified against existing sent-mail evidence and delivery records. Provider acceptance does not confirm inbox delivery.

Anonymous conversations

When a business has a verified claim and the author has activated their Nastygram account, the business can start a private reply exchange. Both sides can then respond inside Nastygram. Replies are encrypted in storage and travel over HTTPS; they are not end-to-end encrypted. The other party does not receive account names, sender identifiers, or email addresses. Reply text is sent as reviewed by its author, without automatic AI anonymization, so avoid including identifying details. Businesses can offer a remedy or a redemption code in the conversation. Authors can stop replies or erase retained conversation content. Reply access is included for verified businesses during the pilot and is intended to become a paid business feature.

Sending and delivery

In ChatGPT, asking to send authorizes Nastygram to prepare and submit the email; ask for a preview first if you want to review it. Temporary failures may be queued for automatic retries for up to 24 hours. Queued does not mean delivered. Provider acceptance means the provider accepted the request, not that it reached an inbox. Text messages are not supported yet.

Ground rules and opt-out

Feedback should be about a real experience. Threats, hate, targeted harassment, impersonation and spam are not allowed. Each sender can submit up to three messages per rolling hour and ten per rolling 24 hours to the same recipient.

Every Nastygram email includes an opt-out link. Recipients can use it to stop future Nastygram messages to that address.