Privacy and security. And your privacy assurances/policies are woefully insufficient.
> Your Gmail data is only used by machines. Our team won't read or access any of your email data unless you explicitly ask for it (for support for ex.)
"Won't" means nothing. The word you're looking for is "can't"
> By default, we don't share any data with third parties. The only exception to this rule is Mixpanel, our analytics apps, which receives information about how you use our app only.
Yeeaaaaah your privacy policy directly states that if you're acquired or go out of business, user data will be transferred or sold.
> As required by Google, the authentification tokens we use to retrieve your Gmail data are safely encrypted in our database.
"We do what is required" isn't convincing me you take privacy seriously, and...encrypted how? A password in the database server's config file?
> Access to production environments is limited to authorized team members only.
And....who are authorized team members? "Authorized team members" could mean "the entire engineering and QA teams, plus the marketing intern collecting demographic data reports."
Your statement doesn't distinguish between user data and the production environment as a whole, it doesn't commit to strictly keeping access to production AND user data to the bare minimum required.
> We use the industry-standard 256-bit encryption with SSL.
...like everyone else? This does not inspire faith that your company has exemplary network security if you think this is worth mentioning.
> Key passwords are updated on a quarterly basis to reduce risks.
You think quarterly password rotation is a noteworthy, or even effective, security practice? You're using passwords as your sole authentication for employees? O_o
You make no mention of your policies with regards to law enforcement. Do you commit to only releasing data when served with a warrant or subpoena, or can Officer Bob call you up and explain how he's investigating a Really Bad Person and you'll hand over their data? Seems the answer is yes, you will:
> "Nat discloses potentially personally-identifying and personally-identifying information only in response to a subpoena, court order or other governmental request, or when Nat believes in good faith that disclosure is reasonably necessary to protect the property or rights of Nat, third parties or the public at large."
What country is your organization incorporated in? What country is user data kept in and thus what laws is it subject to? Is the data stored in the cloud? A server in your uncle's basement?
You make no mention of systems to assure only a minimum number of designated employees have the access they need when they need it. IE a support team member cannot access a customer's data unless there is an open case verified as initiated by the customer.
You make no mention of how data or whether data is encrypted; it seems only gmail auth tokens are?
You should be using hardware token 2FA for critical employee access and 2FA everywhere else...not rotating passwords quarterly. You should be using vaults for every password used in production. All access should be logged and audited by an outside party.