Your privacy is fundamental to how MailOver works. When you trust us with your emails, we understand this is a big responsibility. That's why we built our Zero Access Architecture specifically so that even we can't read your emails - giving you complete control over your data.

Information We Collect

We collect information to provide you with your AI email assistant - from basic things like your email address to more complex data like extracting action items from your emails. The information we collect depends on how you use MailOver and how you manage your privacy controls.

Account Information

When you create an account, we collect basic information to identify you and keep your account secure:

• Email address - your primary identifier for signing in
• Name - to personalize your experience
• Authentication credentials - depending on how you sign up:
  • Google OAuth ID (when you sign in with Google)
  • Apple ID (when you sign in with Apple)
  • Password hash (when you create a password - we never store your actual password)

Email Data

To provide AI assistance, we need access to your email content. All email data is encrypted by default with your unique key:

• Email content - subject lines, message body, and attachments so our AI can extract action items and create briefings
• Email metadata - sender, recipients, dates, and labels to organize and filter your emails
• Provider message and thread IDs - to sync properly with your connected email account (Gmail, Outlook, or IMAP)
• AI processing results - the action items, highlights, and FYIs that our AI extracts from your emails

User Preferences

We store your preferences to personalize your MailOver experience:

• AI model preferences - which AI model you'd like us to use for processing
• AI personality settings - your chosen assistant personality (such as Sam, Donna, or Alex)
• Privacy settings - your private email addresses and keywords that should never be processed by AI
• Data retention preferences - how long you want us to keep your emails (7 to 90 days)
• Notification and theme preferences - your app settings and appearance choices

Device Information

We collect limited device information to send you notifications and ensure security:

• Push notification tokens - so we can send you alerts about important action items
• Device platform - whether you're using iOS or Android to optimize your experience
• No sensitive device identifiers - we don't collect device serial numbers or other identifying hardware information

Zero Access Architecture & Encryption

We designed MailOver so that your privacy is protected by default, not by choice. Your emails are encrypted with your unique key before they ever reach our servers.

How Our Encryption Works

Your data is protected with enterprise-grade encryption:

• AES-256-GCM encryption - the same standard used by banks and governments to protect all your sensitive data
• Your unique encryption key - so only you can decrypt your data
• PBKDF2 key derivation - we use 100,000 iterations to make your key virtually impossible to crack
• Everything is encrypted - your OAuth tokens, email content, and AI processing results

Privacy Controls You Can Set

You have granular control over what gets processed by AI:

• Private email addresses - mark specific senders (like your doctor or lawyer) so their emails are never processed by AI
• Private keywords - set words like "confidential" or "personal" to automatically skip emails containing them
• Real-time privacy controls - change your settings anytime and they apply immediately
• Privacy statistics - see exactly which emails were blocked and why, so you know your controls are working

How We Use Your Information

We use your information to power your AI email assistant and keep you in control of your inbox. Here's how we use different types of information:

• Provide AI email assistance - We process your emails to extract action items, highlights, and generate daily briefings so you never miss what's important
• Personalize your experience - We learn your preferences over time, like which emails you consider important, to adapt our AI responses and improve accuracy
• Send notifications - We alert you about urgent action items and approaching deadlines based on what our AI finds in your emails
• Maintain security - We protect your account with encryption and monitor for suspicious activity to keep your data safe
• Improve our service - We analyze usage patterns (in a way that doesn't identify you personally) to make MailOver better for everyone

AI Processing

We use leading AI models to understand your emails and extract what's important. Here's how we handle your data when processing it with AI:

AI Models We Use

We use leading AI models to process your emails and provide intelligent assistance:

• OpenAI models - for email analysis, briefing generation, and conversation

How We Protect Your Data During AI Processing

Your privacy comes first, even when using AI:

• Transient processing only - your emails are processed in real-time and never stored at AI providers like OpenAI
• Privacy filtering happens first - emails with your private keywords or from private senders never reach AI models
• Current provider policies - OpenAI does not train on data submitted through its API by default
• You're in control - manage privacy settings, set private keywords/addresses, or turn off AI processing entirely

AI Model Development & Training Policy

We are committed to protecting your data from being used for AI model development:

• MailOver Policy - We do not use any user data, including your email data, for developing, improving, or training AI/ML models
• Current Provider Policies - As of our last policy review, OpenAI does not train on API customer data by default
• Contractual Safeguards - We use enterprise-tier services and maintain contracts that include data protection clauses
• Policy Monitoring - We actively monitor our AI providers' data usage policies and will notify users if policies change
• Transparency Commitment - If any provider's policy changes in a way that affects your data, we will provide clear notice and may change providers to maintain protection

Legal Basis for AI Processing (GDPR)

For users in the European Union, we process your emails with AI based on:

• Legitimate Interest (Article 6(1)(f) GDPR) - We have a legitimate interest in providing intelligent email assistance, which we've balanced against your privacy rights
• Your Consent (Article 6(1)(a) GDPR) - For sensitive email processing or when you specifically request AI analysis
• Performance of Contract (Article 6(1)(b) GDPR) - When AI processing is necessary to deliver the email assistant service you've subscribed to

Automated Decision-Making

Our AI systems make automated decisions about:

• Email categorization (action items, FYIs, highlights)
• Priority scoring for briefings
• Suggested email responses and actions

AI Accuracy & Limitations

• AI Can Make Mistakes - AI models may misinterpret emails, miss important information, or make incorrect categorizations
• Hallucinations - AI may occasionally generate responses or extract information that wasn't actually in your emails
• Context Limitations - AI may not fully understand complex situations, sarcasm, or nuanced communication
• Not 100% Reliable - Always review AI suggestions, categorizations, and generated content before relying on them
• No Guarantee of Accuracy - We cannot guarantee that AI processing will be error-free or meet your specific needs

Data Retention

• User-configurable retention - Choose 7, 14, 30, 60, or 90 days
• Default: 90 days - the longest retention we offer; shorten it anytime in your settings
• Smart deletion - Preserves extracted action items/highlights when deleting emails
• Automatic cleanup - Daily cron job enforces your retention preferences

Contract Withdrawal Requests (Widerruf)

If you submit a contract-withdrawal request through our online withdrawal function (the "Vertrag widerrufen" button), we collect and process the following data solely to receive, confirm, and act on your withdrawal:

• Your name
• The email address associated with your account (to identify the contract)
• An order or customer number, if you provide one
• The email address you ask us to send the confirmation to
• Any message you include
• The date and time of submission, plus the IP address and browser user-agent of the request (for record-keeping and abuse prevention)

We use this data to send you an immediate confirmation of receipt and to process your withdrawal. The legal basis is compliance with our legal obligations and the performance/unwinding of the contract. We retain withdrawal records for as long as necessary to document compliance and to meet statutory retention periods, after which they are deleted.

Email Provider Integration & Email Actions

To provide your AI secretary service, we need specific permissions to read and act on your connected mailbox. We support email providers such as Gmail, Outlook, or any IMAP account. Here's exactly what we can do and when we do it:

Permissions We Request

When you connect an email account, you grant MailOver permission to:

• Read your emails - to extract action items, create briefings, and understand your email patterns
• Create email drafts - AI-generated responses and emails that you can review, edit, and manually send through your email provider
• Modify email properties - to mark emails as read, archive them, add labels, or organize your inbox
• Compose and manage drafts - to prepare AI-suggested email responses for your review
• Access email metadata - to sync changes and maintain consistency with your email account

Actions Your AI Secretary Can Take

Your AI secretary can perform these actions in your connected email account:

• Mark emails as read - when you've reviewed them in MailOver or marked action items as complete
• Archive emails - to keep your inbox clean after processing newsletters or notifications
• Apply labels - to organize emails by type (action items, FYIs, highlights)
• Create drafts - to prepare AI-suggested responses that you can review, edit, and manually send
• Snooze or unsnooze emails - to surface important emails at the right time
• Perform bulk cleanup operations - archive or mark multiple emails as read simultaneously

How Integration Works

We use each provider's official, secure interfaces:

• Official provider APIs - Gmail and Outlook connect via secure OAuth 2.0; IMAP accounts connect with the credentials you provide, which we encrypt before storing
• Real-time and scheduled sync - changes are synchronized via provider webhooks (such as Gmail's Pub/Sub and Outlook's push notifications) and regular polling
• No data shared back - we don't share your email content or AI highlights with your email provider beyond the actions you ask us to take
• Revocable access - you can disconnect any email account from MailOver at any time

Google API Services Compliance

MailOver's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This ensures:

• Limited Use Compliance - We only use Google user data to provide or improve user-facing features
• No Secondary Use - Google user data is not used for serving advertisements or other purposes
• Secure Handling - All Google user data is handled according to Google's security requirements
• Transparency - We provide clear disclosure of how Google user data is used in our service

Other Third-Party Services

Push Notifications

We use official notification services to alert you about important emails:

• Apple Push Notifications (APNs) and Expo's push service - to deliver alerts about action items to your mobile device
• Web push (VAPID) - to deliver browser notifications if you choose to enable them
• Notification content only - we don't use these services for tracking or analytics

Your Rights (GDPR Compliance)

Under GDPR and other privacy laws, you have the right to:

• Access your data - View all personal information we have about you
• Export your data - Download complete data export in JSON format
• Delete your data - Permanently remove all personal information
• Correct your data - Update or correct any inaccurate information
• Control processing - Manage privacy settings and AI processing
• Object to processing - Specifically object to AI processing based on legitimate interest
• Data portability - Receive your data in a structured, machine-readable format

US State Privacy Rights

For residents of US states with comprehensive privacy laws (California, Virginia, Colorado, Connecticut, Utah), you have additional rights:

California Privacy Rights (CCPA/CPRA)

• Right to Know - Request information about personal information we collect, use, and share
• Right to Delete - Request deletion of your personal information
• Right to Correct - Request correction of inaccurate personal information
• Right to Opt-Out - Opt out of the "sale" or "sharing" of personal information (Note: We do not sell or share personal information as defined by CCPA)
• Right to Limit Sensitive Information Use - Limit use of sensitive personal information to providing services
• Non-Discrimination - We will not discriminate against you for exercising your privacy rights

Other State Privacy Rights

• Virginia (VCDPA) - Similar rights to California including access, deletion, correction, and opt-out rights
• Colorado (CPA) - Rights to access, delete, correct, and opt-out of targeted advertising and profiling
• Connecticut (CTDPA) - Comprehensive privacy rights including data portability and opt-out rights
• Utah (UCPA) - Rights to access, delete, and opt-out of targeted advertising

Important Clarifications

• No Sale or Sharing - We do not "sell" or "share" personal information as defined by state privacy laws
• No Targeted Advertising - We do not use your data for targeted advertising or cross-context behavioral advertising
• Sensitive Information - Email content may be considered sensitive personal information under some state laws - you can limit its use through privacy controls
• How to Exercise Rights - Contact us at [email protected] or use the privacy controls in your account settings

Data Security

• Encryption at rest - Database-level encryption
• Encryption in transit - HTTPS/WSS for all communications
• Secure authentication - JWT tokens with secure flows
• Account lockout protection - Progressive lockout after failed login attempts
• Regular security audits - Ongoing security assessments
• Access controls - Role-based permissions

Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Immediate Response - Contain and assess the breach within 24 hours
• Regulatory Notification - Notify relevant authorities within 72 hours as required by GDPR and applicable laws
• User Notification - Notify affected users without undue delay if the breach is likely to result in high risk to your rights and freedoms
• Transparent Communication - Provide clear information about what happened, what data was involved, and what steps we are taking
• Remediation - Take immediate steps to fix the vulnerability and prevent future breaches
• Support - Provide dedicated support to help affected users protect themselves

Cookies, Analytics & Advertising

Our marketing website uses a small number of third-party tools to understand traffic and measure our advertising. These run only on our public website — never inside the app's processing of your email — and, for visitors in the EU and UK, they are disabled by default and load only after you accept them through our cookie banner:

• Google Analytics 4 - to understand how visitors use our website (traffic, pages, referrers)
• Google Ads - to measure the performance of our advertising campaigns
• X (Twitter) advertising pixel - loaded only after you accept cookies, to measure ad campaigns

You can change or withdraw your cookie choice at any time. We do not use these tools to read or track the contents of your inbox, we do not sell your personal data, and we do not use Facebook Pixel.

Data Sharing

We do not sell, rent, or share your personal data with third parties except:

• Service providers - AI models for processing (transient only)
• Legal requirements - When required by law or to protect rights
• Your consent - When you explicitly authorize sharing

International Data Transfers

Your data may be processed in countries outside your residence, including the United States where our AI provider (OpenAI) is located. We ensure adequate protection through:

Transfer Safeguards

• Standard Contractual Clauses (SCCs) - We use EU-approved Standard Contractual Clauses with all international service providers
• Data Processing Agreements - All AI providers must sign comprehensive Data Processing Agreements that meet GDPR requirements
• Additional Technical Safeguards - End-to-end encryption, data minimization, and transient processing ensure your data is protected even during international transfers
• Regular Compliance Reviews - We continuously monitor and audit our international partners to ensure ongoing compliance

AI Provider Locations & Compliance

• OpenAI (United States) - Processes data under Standard Contractual Clauses with additional security measures
• No Permanent Storage - Your email data is processed transiently and never permanently stored by AI providers
• GDPR Compliance - All providers must demonstrate GDPR compliance for EU user data processing

Children's Privacy

MailOver is not designed for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification
• Providing in-app notifications

Consent Management for EU Users

For users in the European Union, we provide granular consent management:

Types of Consent We Request

• AI Processing Consent - Specific consent for processing your emails with AI models
• Sensitive Data Processing - Additional consent for processing emails that may contain sensitive information
• International Transfer Consent - Consent for transferring your data to AI providers in the United States
• Marketing Communications - Optional consent for product updates and feature announcements

How to Manage Your Consent

• Granular Controls - Manage each type of consent independently through your account settings
• Easy Withdrawal - Withdraw any consent at any time with immediate effect
• Clear Information - We provide clear information about what each consent covers before requesting it
• No Penalty - Withdrawing consent does not affect the core functionality of your account (except for AI features)

Consent Records

• Audit Trail - We maintain records of when and how you provided consent
• Consent History - View your consent history and changes in your account settings
• Legal Basis Tracking - We clearly track which legal basis applies to each type of data processing
• Regular Reviews - We periodically review and may request renewed consent for continued processing

Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

• Email: [email protected]

Welcome to MailOver! These terms govern your use of our AI email assistant service. By using MailOver, you agree to these terms and our Privacy Policy.

Acceptance of Terms

By accessing or using MailOver ("Service"), you agree to be bound by these Terms of Use ("Terms"). If you disagree with any part of these terms, you may not access the Service.

Description of Service

MailOver is an AI-powered email assistant that:

• Reads and processes your emails using artificial intelligence
• Extracts action items, highlights, and important information
• Generates daily briefings and summaries
• Provides intelligent email filtering and organization
• Offers conversational AI assistance for email management

Account Registration

Eligibility

You must be at least 13 years old to use MailOver. By creating an account, you represent that you meet this age requirement.

Account Information

You agree to:

• Provide accurate and complete information
• Keep your account information up to date
• Maintain the security of your account credentials
• Accept responsibility for all activities under your account
• Understand that your account may be temporarily locked after multiple failed login attempts for security purposes

Email Access and Processing

Email Provider Integration and Permissions

By connecting an email account (such as Gmail, Outlook, or any IMAP account), you grant MailOver permission to:

• Read your emails and email metadata - to provide AI assistant services
• Create email drafts - AI-generated responses and emails that you review, edit, and manually send through your email provider
• Modify email properties - including marking emails as read, archiving, applying labels, and organizing your inbox
• Compose and manage drafts - to prepare AI-suggested responses for your review and manual sending
• Perform email organization actions - such as snoozing emails, applying labels, or changing read status

AI Secretary Actions

You understand and agree that your AI secretary may:

• Automatically organize your emails - by applying labels, archiving processed emails, or marking them as read
• Create email drafts - AI-suggested responses based on your conversations with the assistant that you must manually review and send
• Modify email status - to reflect actions you've taken in the app (like completing action items)
• Perform bulk operations - simultaneously process multiple emails for cleanup and organization

AI Processing

You understand and agree that:

• Your emails will be processed by AI models - currently using OpenAI services
• Processing is subject to your privacy controls - private emails and keywords are never processed
• AI processing may not be 100% accurate - you should review AI suggestions before taking action
• You retain full control - over AI access to your emails and can disable processing anytime
• All actions are reversible - we provide undo functionality and action history

User Responsibilities

Acceptable Use

You agree not to:

• Use the Service for illegal or unauthorized purposes
• Violate any applicable laws or regulations
• Attempt to interfere with or disrupt the Service
• Access other users' accounts or data
• Reverse engineer or attempt to extract source code
• Use the Service to transmit harmful content

Content Responsibility

You are responsible for:

• All content in your emails and messages
• Ensuring you have rights to any content you share
• Complying with applicable laws regarding your email content
• Managing your privacy settings appropriately

Privacy and Data Protection

Zero Access Architecture

MailOver implements Zero Access Architecture, meaning:

• Your emails are encrypted with your unique key
• Even our team cannot read your emails
• You control what data is processed by AI
• You can block specific emails from AI processing

Privacy Controls

You have the right to:

• Set private email addresses and keywords
• Configure data retention preferences
• Export all your data
• Delete your account and data at any time

AI and Machine Learning

AI Accuracy & Limitations

You understand and acknowledge that:

• AI-generated content may contain errors or inaccuracies - including misinterpretations, missed information, or incorrect categorizations
• AI hallucinations may occur - AI may generate responses or extract information that wasn't actually in your emails
• Context limitations exist - AI may not fully understand complex situations, sarcasm, cultural nuances, or implied meanings
• AI responses should always be reviewed before taking any action, especially for important communications
• MailOver is not responsible for decisions made based on AI output - you assume full responsibility for verifying and acting on AI suggestions
• AI capabilities may improve or change over time - but accuracy is never guaranteed
• No warranty of fitness - AI suggestions may not be suitable for your specific needs or circumstances

Learning and Personalization

The Service may learn from your usage patterns to:

• Improve personalization and accuracy
• Adapt to your preferences and communication style
• Provide better email filtering and organization

Subscription and Billing

Service Tiers

MailOver may offer different service tiers with varying features and limitations.

Payment Terms

If you purchase a paid subscription:

• Charges are billed in advance
• Subscriptions automatically renew unless cancelled
• You may cancel at any time
• Refunds may be available as outlined in our refund policy

Right of Withdrawal (Widerrufsrecht)

If you are a consumer in the European Union, you have a statutory right to withdraw from a distance contract within 14 days, without giving any reason.

For digital services that begin during the withdrawal period at your express request, you may owe a proportionate amount for the service provided up to the point of withdrawal. The right of withdrawal may lapse where the law provides, for example where you expressly consented to immediate performance and acknowledged that you thereby lose your right of withdrawal.

Intellectual Property

MailOver's Rights

MailOver retains all rights to:

• The Service and its underlying technology
• Trademarks, logos, and branding
• Software, algorithms, and AI models
• Service improvements and innovations

Your Rights

You retain all rights to:

• Your email content and personal data
• Any original content you create
• Your account and usage preferences

Service Availability

Uptime

While we strive for high availability, we cannot guarantee:

• 100% uptime or uninterrupted service
• Immunity from technical issues or maintenance
• Availability during force majeure events

Maintenance

We may perform maintenance that temporarily affects service availability. We will provide reasonable notice when possible.

Disclaimers and Limitations

Service Disclaimers

The Service is provided "as is" without warranties of any kind. We disclaim all warranties, express or implied, including:

• Merchantability and fitness for a particular purpose
• Accuracy or completeness of AI-generated content
• Compatibility with all devices or email systems

Limitation of Liability

To the maximum extent permitted by law, MailOver shall not be liable for:

• Indirect, incidental, or consequential damages
• Lost profits, data, or opportunities
• Damages arising from AI errors or inaccuracies
• Third-party actions or service interruptions

Termination

Termination by You

You may terminate your account at any time by:

• Using the account deletion feature in the app
• Contacting our support team
• Following the cancellation process for paid subscriptions

Termination by MailOver

We may terminate or suspend your account if you:

• Violate these Terms of Use
• Engage in prohibited activities
• Fail to pay subscription fees
• Cause harm to the Service or other users

Changes to Terms

We may update these Terms from time to time. We will notify you of material changes by:

• Posting updated Terms on our website
• Sending email notifications
• Providing in-app notifications

Continued use of the Service after changes constitutes acceptance of the updated Terms.

Governing Law

These Terms are governed by and construed in accordance with the laws of the Federal Republic of Germany, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG). If you are a consumer with your habitual residence in another country, you also keep the protection of any mandatory provisions of the law of that country that cannot be derogated from by agreement.

Dispute Resolution

If a dispute arises, we'd like to resolve it directly and quickly. Please contact us first at [email protected] so we can try to find a solution together.

• Good faith resolution - we will make every reasonable effort to resolve disputes directly with you before any formal proceedings
• Place of jurisdiction - to the extent permitted by law, the courts at our place of business have jurisdiction; as a consumer, you may also bring claims in the courts of your place of residence
• Consumer arbitration board - we are neither obliged nor willing to participate in dispute-resolution proceedings before a consumer arbitration board (Verbraucherschlichtungsstelle)

Severability

If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

Contact Information

For questions about these Terms, please contact us:

• Email: [email protected]

© 2026 MailOver. All rights reserved.