MailNail Privacy Policy

Version 1.1. Effective 2026-10-18.

This policy explains what data MailNail collects, why, who receives it, how long we keep it, and what you can do about it. It is one policy for all of MailNail: the website at www.mailnail.com with its pilot request form, the app at app.mailnail.com, our mail servers, the API, the MCP server and the command-line tool.

Your right to object. Where we rely on our legitimate interests, you can object at any time, for reasons that relate to your situation. We then stop, unless we show compelling grounds or need the data for a legal claim. Write to privacy@mailnail.com.

1. Who we are

MailNail is run by Matyáš Černý, a Czech sole trader, IČO 10751084, Janáčkovo nábřeží 1075/27, 150 00 Praha 5, Czech Republic. He is the controller of your personal data.

When MailNail s.r.o. is incorporated, it becomes the controller. We will tell you before that happens. We have not appointed a data protection officer, because the law does not require one at our size.

Team workspaces. When an organization sets up a workspace, it is the controller of the mail, audiences and sends the workspace owns, and we are its processor under our data processing agreement. Ask the organization first about your rights over that data. We stay the controller of each member's own account, security and billing data.

2. What we collect and why

"Contract" means we need the data to give you the service you asked for (Article 6(1)(b) GDPR). "Legitimate interest" is Article 6(1)(f), "consent" is Article 6(1)(a), and "legal duty" is Article 6(1)(c). You can ask for our balancing test for any legitimate interest.

To have an account, you must give us a username and a passkey. For a paid plan, you must give Stripe your payment details. Everything else is optional.

3. How we protect your mail

Your mail is encrypted as soon as it arrives.

Some data is stored unencrypted, because the service cannot work without it: who you write to and when, message sizes, attachment names, drafts, contacts and workspace audiences. MailNail is not end-to-end encrypted.

We do not track you in mail. By default, images in the mail you receive load without telling the sender when you open it, and campaigns sent through MailNail carry no tracking pixel and no click tracking.

4. AI features

Search is always on. Chat, writing help and automatic tags come with some plans, and each workspace can switch them off. Chat and writing help run only when you use them, and chat never sends mail on its own.

The chat tells you that you are talking to an AI. Text the AI writes for you is marked as such.

These features run on our AI provider. A workspace can connect its own OpenAI, Anthropic or Google account instead, and that provider then handles the data under its own terms.

We do not train AI models on your mail, and neither does our AI provider.

5. Sharing

We do not share your personal data outside MailNail, except in these cases.

Service providers that act for us. Providers host the service, store backups, run our mail servers and AI features, check signups for bots, count page views, and record how the app and its AI are used. A contract binds each one to use your data only on our instructions. Our subprocessor list names each one. We update it at least 30 days before a new provider starts.

Providers you choose. Your mail provider, your workspace's own AI provider, the agents you connect, and the webhooks a workspace sets up receive data because you chose them. They handle it under their own terms.

AI assistants you connect. You can connect an AI assistant to your mail, for example OpenAI ChatGPT or Anthropic Claude. The assistant then receives the mail it reads for you: the content and headers of messages, attachments, drafts, the addresses of the people you write to and hear from, and the names of your mailboxes and folders. This data goes to the assistant's provider, under your own account with that provider and under its terms. We send nothing to an assistant unless you connect it, and you choose what it may do. You can see what it did and disconnect it at any time in Agents.

The people you write to. Mail you send reaches its recipients.

Stripe. We sell your plan. Link, Stripe's affiliate, takes the payment as merchant of record. Stripe and Link handle your card and billing details under their own policies, https://stripe.com/privacy and https://link.com/privacy. Card details never reach MailNail.

Legal reasons. We disclose data where the law requires it, or to protect our users, the public or MailNail from harm. We tell you first, unless the law forbids it.

6. International transfers

Our database and mail servers are in the EU. Some providers process data outside the EU, and the subprocessor list says which. For those, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can ask us for a copy.

7. How long we keep it

When you delete your account, your mail and account data go at once. Billing records stay for the period above, and mailboxes you connected for a team stay with the team.

8. Your rights

Under the GDPR you can:

• access the data we hold about you
• correct data that is wrong
• delete your data
• restrict how we use it
• take it with you in a common format
• object to use based on our legitimate interests
• withdraw consent at any time, without affecting earlier use

Write to privacy@mailnail.com from your recovery email, or give us your username. We may ask you to prove the account is yours. We answer within one month, or tell you why we need up to two more. For an export, we send your mail in a format other mail apps can import.

You can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz, or to the authority where you live or work.

9. Google and Microsoft data

MailNail's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

For data from Google or Microsoft, this means:

1. We use it only for the mail features you see and control.
2. We transfer it only for those features, for security, to comply with law, or in a merger with your prior consent. It reaches your workspace's own AI provider only if you agree for that mailbox.
3. We never use it for ads, never sell it, and never use it to train AI models.

10. People who are not our users

People who exchange mail with our users. We process your address, name and messages because our user sends or receives them, on the basis of legitimate interest. When our user shares AI chats with us, a chat can hold parts of your messages, with email addresses, phone numbers and account numbers removed, for the period in Section 7. Contacting each of you would take disproportionate effort, so this policy is your notice (Article 14(5)(b) GDPR). Your rights in Section 8 apply.

People who receive campaigns or API mail. The sending workspace decides why it mails you, so ask it about your data. We keep your unsubscribe, bounce or complaint so that it stops mailing you. You can unsubscribe with the link in any campaign message.

People on the waitlist or invited to a workspace. We use your address to send the invite or confirmation. You can ask us to remove it at any time.

11. Other things you should know

Automated decisions. We make no automated decision about you with a legal or similarly significant effect. Tags only sort mail. If an account's mail bounces or draws complaints too often, we hold its outgoing mail for our staff to review, and only a person can block an account. To contest any such step, write to us.

Sensitive data. Mail can hold health, religious, political or other sensitive details. We do not look for them, infer them or build profiles from them.

Cookies. The app stores what it needs to keep you signed in and remember your settings. In the app, analytics store nothing on your device. On the website, analytics store nothing until you agree. Our cookie policy has the full list.

Children. You must be 16 or older to use MailNail. If we learn an account belongs to someone younger, we close it and delete its data.

Breaches. If a breach puts your data at risk, we tell ÚOOÚ within 72 hours where the law requires it, and we tell you without undue delay if the risk to you is high.

Early access. We sometimes switch a feature on for some accounts first, to test it. Such a feature follows this policy in full. If it needs a new provider or a new kind of data, we update this policy first.

12. Your controls

• Privacy settings: how images in your mail load, and whether we record how you use the app and keep your AI chats.
• Team settings: the same two choices for every member of a team workspace, for its owners and admins.
• Security settings: passkeys, recovery email and active sessions.
• Mailboxes: connect or disconnect an inbox.
• Agents: see and revoke agent tokens.
• AI settings: your workspace's own AI provider.
• Data: delete your account.

13. Changes to this policy

Before a material change takes effect, we tell you by email or in the app. Where Google requires it, we ask for your consent again.

14. Contact

Write to privacy@mailnail.com about anything in this policy.