Earlier quoted context omitted.
That is good feedback and we should make that more clear. To answer your question, the domain admin (when he installs the gadget for the domain) gives us access to each email header as you open the email. To install Etacts, the user clicks through an openid+oauth login screen that details which services we use (gmail and google contacts).
Are you somehow only limited to the headers or simply only using the headers? 3rd party access (beyond the email provider) to someone's entire mailbox seems like a hard sell. The product sounds compelling, but I'd be much more inclined if it were something like a local browser plugin.
I imagine a browser plugin would have access to the entire content of any email you opened.