Privacy policy.
Effective October 13, 2026
This policy describes the personal reimbursement automation operated by Vincent Gong and the public website at vincentgong.com. The automation is used by its owner; it is not a public service or an invitation to connect other people's accounts.
Information accessed
The automation connects to the owner's Google account using OAuth. The current Gmail authorization includes broad mailbox permissions, including reading and modifying mail and managing drafts and labels. The workflow itself searches for MTA TrainTime receipt emails and uses matching messages to prepare reimbursement drafts.
Information processed includes email contents and embedded receipt images, message identifiers, sender and recipient details, ticket descriptions, purchase dates, amounts, purchase identifiers, and details already present in the owner's signed reimbursement form. Google authorization tokens are used to maintain the connection; the automation does not request or store the Google account password.
How information is used
- Identify eligible purchases and extract receipt details.
- Prepare a reimbursement form and a visual copy of the receipt.
- Create a Gmail draft with the documents attached.
- Label processed receipts and retain processing records to prevent duplicate claims.
The workflow creates drafts only. The owner reviews and manually sends reimbursement emails. Receipt processing uses deterministic code; email contents are not sent to an AI model by this workflow.
Storage and protection
Original receipts, generated documents, and processing records are stored on the owner's self-hosted server. Gmail stores the source messages and generated drafts. OAuth credentials are stored using n8n's credential encryption, and reimbursement documents are kept separately from this public website. Access to the automation is protected by account authentication. No system can guarantee absolute security.
Sharing and Google API use
Google processes email and draft data as part of providing Gmail and its API. When the owner manually sends a reimbursement claim, the chosen recipient receives the email and attachments; this workflow prepares claims addressed to commuterforms@healthequity.com. Creating a draft does not send those documents to that recipient.
Google user data is not sold, used for advertising, or used to train generalized AI or machine-learning models. VinBot Reimbursement Assistant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion
Receipts, generated documents, and claim-processing records are retained until the owner manually deletes them. Deleting a Gmail draft or message does not automatically delete server-side copies, and deleting server-side files does not automatically delete Gmail copies. Any backup copies must be removed separately. Technical server logs follow the server's log-rotation settings.
The owner can stop the workflow, remove the Gmail credential from n8n, and revoke authorization through Google Account connections. Revoking access stops future authorized API access but does not automatically erase previously stored files or drafts. Deleting duplicate-prevention records requires care because it can allow a purchase to be processed again.
This website
These public pages have no sign-in, advertising, analytics scripts, tracking cookies, or contact form. The web server may log technical request information, such as IP address, requested URL, time, and browser details, for operation and troubleshooting. Contact links open an email application; any email you send will be received and handled through the owner's email provider.
Contact and changes
For questions or deletion requests, contact Vincent Gong at gongv93@gmail.com. This policy will be updated if the automation's data practices change, with the effective date shown above.