Privacy Policy

MailGeni ("we", "us") is operated by Imran Malik, an individual founder based in Qatar. We provide an AI email assistant delivered as a web application at mailgeni.ai and as a browser extension for Gmail and Outlook. This policy describes the data we collect, why we collect it, and the choices you have.

• Account data. Your email address and name, managed by our authentication provider (Clerk).
• Email provider tokens. When you connect Gmail or Outlook, we store OAuth refresh tokens so the extension and web app can read the thread you have open and send replies on your behalf. Tokens are stored encrypted at rest in our database (Supabase).
• Email content. The thread you are replying to is sent to our servers and to our AI provider (Anthropic) to generate the draft. Optional history and other enabled features may retain selected content, as described below.
• Voice dictation. When you tap the microphone, we send the captured audio to our transcription provider (Google, via the Gemini API) to return text, and the resulting text to Anthropic to tidy up filler words and self-corrections. Audio is not retained after transcription.
• Preferences. Your signoff, UI language, and chip preferences are stored locally via chrome.storage.local and mirrored in our database so they follow you between devices.
• Open-tracking pixels. Emails you send via MailGeni may include a 1×1 pixel so you can see when a recipient opens the message. We store the recipient address, subject, send timestamp, Gmail thread ID or Outlook conversation ID, open count, and first/last open timestamps. You can disable the pixel per-message.
• A mail index.To answer “find the email from…” questions, we keep an index of the sender, recipients, subject line, date and message ID of mail in a connected mailbox for the last 36 months. No message body, snippet or attachment is stored. The index is deleted when you disconnect the mailbox or delete your account.
• Your past replies, de-identified.When you answer a customer’s request, we keep a short record of what was asked (in general terms), the items and prices your reply quoted, and your reply as a template with the customer’s name, dates, addresses and reference numbers removed, so that a similar request can be answered the same way. The customer’s email is not kept. The newest 500 per business, for twelve months; you can forget any or all of them in the Memory tab, and they are deleted with the mailbox connection or the account.
• Finding similar past work.We keep each invoice and quotation you send (its lines, terms and covering note, and a short line on what it was for with the customer’s details removed), and Google (Gemini API) computes a numeric representation of it, and of your de-identified replies, so that a similar past document can be found when a new request arrives. That representation cannot be turned back into the text. Kept for 36 months and deleted with your account.
• Receipts you file.When you file an email under Receipt, we read it once — the message and any attached PDF or photo of a receipt — and keep one line in your receipt log: merchant, date, total, tax, reference and category. The text and the attachment are processed to extract the receipt details under the applicable AI provider terms. Provider retention is separate from the receipt log we keep. The log is yours to download and to delete line by line, and goes with your account.
• Emails you snooze. When you ask for an email to come back later, we keep which email it is, its subject and the time it is due, so we can put it back in your inbox then. The record stays as a note of when it came back. It goes with your account.
• Calendar events you create. When you use the Schedule Meeting feature, we forward the title, attendees, date/time, and optional Google Meet or Microsoft Teams link request to Google Calendar or Microsoft Graph. We do not store a copy on our servers.

Document summaries, questions and analysis use the provider named in the permission notice. The current direct route sends the document or extracted text and relevant context to Anthropic. You can allow one analysis, remember your choice, or keep the document out of AI. You can withdraw remembered permission in Settings; viewing and signing do not require AI analysis.

We do not promise UK/EU-only processing or zero retention for Anthropic’s direct API. Anthropic’s published commercial policy generally deletes API inputs and outputs within 30 days, with exceptions for agreed arrangements, policy enforcement and legal obligations. We have not verified a zero-retention agreement for this account. Saved MailGeni documents and optional history have their own retention rules below.

Anthropic’s commercial data-retention policy

• OAuth tokens and preferences — kept until you disconnect the provider or delete your account.
• Email content used by features — drafting processes the conversation and relevant context. Separate features can retain selected reply text, extracted business facts, document summaries and search records. Past reply and invoice history is on by default unless you turn it off under Settings › AI and your information. Turning it off stops future history learning and suggestions; it does not erase existing records or your saved business profile.
• Voice audio — not stored; streamed to the transcription API and discarded.
• Tracked-email metadata (thread ID, open count, timestamps) — kept until you delete your account or ask us to remove a row.
• Documents you send for e-signature — the PDF you send, the signed copy, the signature images the signers draw, and the signing record (who signed, when, from which address) are kept in private storage for the life of your account. You can delete any finished request from Docs › Library. Signers reach a document only through a one-time link that expires after 30 days, and every party is emailed the signed copy.
• Invoices and quotations you build — the PDF, the figures on it, and the addressee are kept in private storage for the life of your account, so the library, the reminders and “mark as paid” work. You can delete any settled one from the library. Your business details, bank details and logo are saved once to your account preferences.
• Documents you sign yourself — not stored. The signed copy goes into your reply or your downloads. A copy parked to get past an upload limit is deleted the moment the reply exists, and anything abandoned is swept within a day.
• If your subscription lapses — nothing is deleted. Your documents stay, read-only: you can open, download and export them. Creating new ones beyond the free allowance, and the automatic reminders, stop.
• Dormant accounts — an account with no sign-in for three years may be closed. We send three notices over ninety days first, each with a one-click export of everything, and signing in at any point keeps the account open.
• Account deletion — all of the above is erased within 30 days of a deletion request. Export your documents first from Docs › Library, as one zip with the PDFs, the signing records and a list; we cannot recover them afterwards.
• One-way record of a completed free trial — the single exception to the line above. When your free trial starts we store a salted one-way hash of your sign-up email address, so that the same person cannot obtain unlimited free trials by deleting and re-registering. This hash is kept after your account is deleted. It cannot be reversed into your email address, cannot be used to contact you, is not linked to your account or to any other record we hold, and is never shared. It is the only thing that survives deletion of your account.

• Generate AI replies, summaries, and transcriptions you explicitly request.
• Categorize inbox messages into the labels shown in the dashboard.
• Authenticate you and keep you signed in across the web app and extension.
• Sync your preferences and signoff across devices.

We do not sell personal data. We do not use your email content to train AI models. Anthropic and Google process content under their respective API terms. Model training and data retention are different: providers may retain requests for service operation, security or abuse prevention under their applicable terms. We do not claim universal zero retention.

MailGeni's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide or improve user-facing features that are prominent in MailGeni's user experience (reading the currently open thread, generating an AI reply, sending the reply).
• We do not transfer Gmail data to third parties except as necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Gmail data to serve advertisements, including retargeted, personalized, or interest-based advertising.
• We do not allow humans to read Gmail data unless we have the user's affirmative agreement for specific messages, it is necessary for security investigations or to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
• Relevant Gmail message content is sent to our named AI providers to deliver enabled features, including drafting, categorisation and optional personalisation. We do not use it to train AI models. Provider retention depends on the applicable service terms and configuration; it is not necessarily zero.
• Document analysis requires permission for the currently selected provider. A provider change requires renewed permission; requests do not automatically fall back to another provider. Signing itself does not require AI analysis.
• Document analysis currently uses Anthropic’s direct API, not Amazon Bedrock. The AWS no-retention setting and Bedrock UK/EU routing do not apply. Provider retention depends on the applicable Anthropic service terms and configuration.
• Audio captured for voice dictation is sent to our transcription provider (Google, via the Gemini API) solely to return transcribed text, and that transcript is then sent to Anthropic solely to clean it up. Neither is stored by MailGeni or used to train models.

The data you give MailGeni access to is yours. Specifically:

1. We do not sell or rent your data. Not to advertisers, not to data brokers, not to anyone.
2. We do not serve advertising of any kind, including retargeted, personalised, or interest-based ads, against your Gmail / Outlook content or any data derived from it.
3. We do not allow humans to read your email content as part of normal operation. No member of MailGeni or our sub-processors reads, reviews, or annotates your messages, except (a) where you explicitly direct us to do so for support, (b) where it is necessary for security investigations, (c) where required by applicable law, or (d) where the data has been aggregated and de-identified for internal operations.
4. We do not train AI models on your data. Our AI sub-processors (Anthropic and Google) are contractually prohibited from using API content for training under their respective Commercial Terms / API data-usage policies, and we do not opt into any training-related program with either provider.
5. Personalisation is separate from model training. Saved business facts and optional past reply and invoice history help prepare suggestions for your account. History can include selected request and reply text, item details and document summaries. These records are not model training. You can pause history in Settings, manage saved information in Memory, or request account deletion. Drafts stored in Gmail or Outlook remain subject to your mailbox settings.
6. We do not transfer Gmail or Microsoft Graph data to any party other than our named sub-processors, except as necessary to provide the user-facing features described in this Privacy Policy, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.

When you connect an Outlook account, MailGeni acts as a Microsoft identity client and calls Microsoft Graph on your behalf. We request the following delegated scopes and use them only for the features they enable:

• User.Read, openid, profile, email — identify you and display your name and email in the dashboard.
• offline_access — obtain a refresh token so the extension keeps working without repeated sign-in prompts.
• Mail.Read, Mail.ReadWrite — read the thread you have open so the AI can draft a reply to it.
• Mail.Send — send the reply you compose in the MailGeni panel.
• Calendars.ReadWrite — create calendar events, optionally with a Microsoft Teams link, when you use the Schedule Meeting feature.

Relevant Outlook message content is processed for enabled AI features. Optional history can retain selected reply content and invoice summaries; your saved business profile is managed separately. These same controls apply to Gmail and Outlook. Document analysis requires document AI permission and a configured provider disclosed in the consent notice, with no automatic provider fallback. Provider retention depends on service terms and configuration. We do not use Microsoft Graph data to serve advertising and do not transfer it to unrelated third parties.

AI document analysis is optional. Before analysis, MailGeni identifies the AI provider and asks whether it may send the document or extracted text, filename, and any questions or review context to that provider. You can allow one analysis, remember permission for future documents, or decline. Viewing and signing do not require AI analysis.

Withdraw remembered permission at any time in Settings → Document AI privacy. Withdrawal stops future requests; it cannot recall information already sent or cancel processing already underway. A change to the provider or disclosure requires fresh permission. We record your choice, its time, the provider and the notice version; consent records do not contain document contents.

Only share documents you are authorised to disclose. Confidentiality, legal privilege and professional or contractual duties may restrict sharing, even if you agree to AI analysis. AI output is not legal advice.

• Clerk — authentication and session management.
• Supabase — database, encrypted token storage.
• Anthropic (Claude) — generates AI replies, summaries, categories, document analyses, and the cleanup pass on voice-dictation transcripts. Depending on the feature you enable, requests can include message subjects and bodies, relevant conversation context, saved business information, selected history, and your instructions. Search and categorisation can process messages beyond the open thread. Document AI sends document content or extracted text with your permission. Anthropic does not use API content to train its models. See Anthropic Privacy Policy, Commercial Terms, and Anthropic Trust Center.
• Google — transcribes audio when you tap the dictation microphone in MailGeni (Gemini 2.5 Flash, via the Gemini API). We send Google the audio recording and a short vocabulary hint: a list of proper nouns drawn from your contacts and from the email you are replying to, so names spell correctly. It is a list of terms, never the message itself. Google does not use Gemini API content to train its models. This is a separate service from the Gmail access described above, under separate terms. See Gemini API terms.
• Google / Microsoft — OAuth, Gmail API, Microsoft Graph for sending mail you compose.
• Vercel — hosting.
• Sentry (EU project) — technical error monitoring. Reports retain error types and code locations; raw error messages, email content, attachments, request payloads, credentials and user details are excluded. Session replay and performance tracing are disabled.
• Upstash — Redis-backed rate limiting on AI and mailbox-write endpoints.

Database and private document storage: Stockholm, Sweden, EU (eu-north-1). This does not mean all processing stays in the EU: authentication, hosting, rate limiting and AI use the separate providers listed above. Anthropic and Google AI are processed in their providers' default US regions. Where data crosses borders, all sub-processors are bound by Standard Contractual Clauses (or equivalent transfer mechanisms) under their respective Data Processing Agreements.

• storage — persist your signoff, language, and chip preferences locally.
• tabs — open the settings and billing pages in a new tab when you click them from the panel.
• Host access to mail.google.com, outlook.live.com, outlook.office.com, outlook.office365.com, outlook.cloud.microsoft — inject the reply panel into those pages.
• Host access to the MailGeni web app domain — pass your authenticated session from the web app to the extension.

• Disconnect Gmail, Google Calendar or Outlook at any time from the Settingspage. Disconnecting clears the stored refresh token and, for Google providers, calls Google's revoke endpoint so MailGeni's access is also removed at myaccount.google.com.
• Delete your account in-app from Settings → Delete account. This immediately erases your profile, OAuth tokens, tracked-email rows, memory and preferences, revokes Google access, and deletes your authentication record at Clerk. No email request is required.
• You can also request deletion by emailing privacy@mailgeni.ai and we will complete it within 30 days.
• EU/UK residents have the right to access, correct, and erase their data under GDPR. Use the same contact address.
• India residents have the rights set out under the Digital Personal Data Protection Act 2023 (DPDPA), including access, correction, erasure, and grievance redress. Use the same contact address; we treat all such requests as we would a GDPR request.
• Turn off open tracking per-message when composing.

MailGeni is operated by an individual founder based in Qatar. Personal data handling is governed by Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, "PDPPL"), with additional protections applied for users domiciled in the EU/UK (GDPR) and India (DPDPA 2023). Cross-border transfers to sub-processors are made under Standard Contractual Clauses or equivalent transfer mechanisms set out in their respective Data Processing Agreements. The supervisory authorities relevant to MailGeni are:

• Qatar — National Cyber Security Agency (NCSA), via ncsa.gov.qa.
• EU/UK users — your local supervisory authority (e.g. the ICO for the UK, ico.org.uk).
• India users — Data Protection Board of India (DPBI) once constituted under the DPDPA 2023.

Traffic is served over HTTPS. OAuth tokens are stored in a Supabase database with row-level security and access restricted to the service role key, which is never exposed to clients. Session cookies are issued and validated by Clerk.

MailGeni is not ISO 27001 certified and has not completed a SOC 2 audit. Neither is currently being pursued. Certifications held by our suppliers do not certify MailGeni. No service can guarantee that a security incident will never occur. See our Trust & Security page for our current controls and status.

MailGeni sets only cookies that are strictly necessary to run the service. There is no advertising, analytics or cross-site tracking cookie anywhere in the product. On selected public marketing pages, an optional PostHog analytics script is loaded only after you choose to allow analytics. We store that preference in your browser.

The cookies in use are: a session cookie issued and validated by Clerk, which keeps you signed in; mg_next, set for ten minutes when a mailbox connection starts from the welcome flow so you are returned there afterwards; mg_add_hint, set for fifteen minutes while you add a mailbox, so the app can tell you afterwards whether the account you connected is the one you asked for; and mg_oauth_state, set for ten minutes during a mailbox or calendar connection so the callback can confirm the round trip belongs to the signed-in account.

These cookies support essential service functions. Optional marketing-page analytics has separate Allow and Decline controls; you can change your choice using Analytics preferences on those pages.

We measure how our own website is used — which pages are viewed and which buttons are pressed — first-party, with no cookie. A random identifier in your browser's sessionStorage links the pages of one visit and is discarded when the tab closes. If you allow optional analytics, PostHog (US region) receives public marketing-page views, click and scroll heatmaps, and masked session recordings. Its browser identifier is kept in memory, not an analytics cookie. Text is masked; form controls, editable content, the interactive inbox demo and private app pages are blocked from recordings. We do not send account identities, email contents, documents, network request bodies or console logs to PostHog. Declining leaves the website fully usable. Browsers that send Global Privacy Control are not measured; optional analytics also respects Do Not Track. Nothing you type is recorded by PostHog. We also send technical error categories and fixed page names to PostHog to detect website crashes, with a hashed temporary visit identifier. These reports exclude error text, stack traces, email contents, account identities and URL parameters, and respect Global Privacy Control.

MailGeni is not directed at children under 13 and we do not knowingly collect their data.

We will update this page if our data practices change, and update the "Last updated" date at the top. Material changes will be communicated by email.

Questions, deletion requests, or concerns: privacy@mailgeni.ai