Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address, name, and password (stored securely hashed). If you use OAuth to sign in (Google, Microsoft), we receive your email and profile information from those providers.

Email Data

When you connect an email account, we sync metadata (sender, recipients, subject, date, read status) and store message bodies for your plan's history window so search and the assistant can use them. Free keeps 30 days; Pro keeps 90 days. After that we delete our copy of the body, except for messages you starred, sent or saved as drafts. Metadata is kept while the mailbox stays connected to InflowMail. The mail stays at Gmail, Microsoft, or your IMAP host - they remain the system of record.

Usage Information

We collect usage analytics (pages visited, features used) to improve our service, with our own first-party analytics and with Google Analytics. Google Analytics receives the page path with identifiers masked, the page title, and standard browser and device details. It never receives query strings (so no search terms), email content, subjects, addresses or account data, and it does not run on administrator pages. Google processes this data under its own terms; you can block it with the Google Analytics opt-out add-on or any tracker blocker, and the service works the same. We do not use it for advertising. If you visit from the UK, the EU/EEA or Switzerland, neither kind of analytics runs until you accept (see Cookies).

Device & Security Information

We log IP addresses, browser type, and device information for security purposes (fraud prevention, suspicious login detection). Sign-in records and alerts show the approximate city and country a sign-in came from. That comes from Cloudflare, which already carries our traffic; we do not send your IP address to any geolocation service. Sign-in attempt records and our server logs are deleted after 30 days. The security audit log (sign-ins, security settings, and who accessed your mailbox) is kept for the life of your account and may be kept after you delete it, for security and legal purposes.

2. How We Use Your Information

• Provide our service: Sync and display your emails, enable search, AI classification, and automation features.
• Security: Protect your account from unauthorized access, detect fraud, and maintain service integrity.
• Communication: Send service-related emails (password resets, security alerts, important updates).
• Improve our service: Analyze aggregated, anonymized usage patterns to enhance features and fix issues.

3. Google User Data

This section applies when you connect a Gmail or Google Workspace account. Signing in to InflowMail with Google only shares your name, email address and profile picture (openid, email, profile). Connecting a mailbox asks Google for the permissions below, and we use each one only for the features listed next to it.

What we access and why

• Read and change your Gmail (gmail.modify, one Google permission that covers both). Reading: messages, attachments, labels and mailbox changes, so we can show your mail in the unified inbox, search it, open messages and attachments, classify and summarize messages, and answer your questions in the assistant. Changing: only when you (or a rule or assistant action you set up) act on a message: mark it read, archive it, star it, apply or remove a label, move it to spam or trash, and send, reply to or forward mail you wrote. We never permanently delete Gmail messages; "delete" moves them to Gmail's trash.
• Read your calendar (calendar.readonly): to show your events in InflowMail's calendar, send you reminders, and let the assistant answer questions about your schedule.
• Read your Google Tasks (tasks.readonly): to show your task lists in InflowMail. We never change your Google Tasks.
• Read your contacts (contacts.readonly): names and email addresses only, to recognize senders you know so their mail is not filtered as low priority.

How we use it

• Only to provide and improve the features you use in InflowMail: the unified inbox, search, classification and priority, summaries and reply drafts, the assistant, the calendar and task views, and sending mail when you tell us to.
• We do not use Google user data for advertising, including retargeting, personalized or interest-based ads.
• We do not sell Google user data, and we do not transfer it to anyone except as described below.
• We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models. The AI providers we contract with receive it under API terms that do not allow them to train on it; if your organization uses its own API key, its own agreement with that provider applies.
• We keep aggregate statistics about sender domains across InflowMail (for example, how often mail from a domain is opened or is a newsletter) to improve classification. They contain no message content and are not linked to you or your account.

Who can see it

• People at InflowMail do not read your Google user data. No one at InflowMail opens your mailbox to provide support: our support staff have no tool for it, and support works from what you send us, such as screenshots and diagnostics. The only exceptions are when it is necessary for security, such as investigating abuse or a bug; to comply with the law; or for our internal operations, and then only aggregated and anonymized.
• Helpers you invite (delegation) see the mailboxes you share with them, until you remove them.
• Your organization's administrators can see member counts and storage totals, not your mail. If an administrator connects the organization's own AI provider, your mail is sent to that provider for AI features (see below).

Service providers that receive it

We transfer Google user data only to these providers, only to run the features above, and all of them receive it over encrypted connections:

• Amazon Web Services (United States): hosts our servers, database, message-body storage and backups. Amazon Bedrock, part of AWS, runs Anthropic's Claude models for our AI features by default: classification, summaries, reply drafts, the in-app assistant and our sender-priority tuning. Classification sends the sender, subject and Gmail's short preview snippet; summaries and reply drafts also send the message text; the assistant receives the messages and calendar events it needs to answer you.
• Another AI provider, only if your organization's administrator connects one: classification, summaries and reply drafts can instead use Anthropic's own API, OpenAI, Google Gemini or xAI with the organization's own API key. That provider then receives the same data for those features. Requests are sent from our servers, and that provider's agreement with your organization applies. The in-app assistant stays on Amazon Bedrock.
• Cloudflare: carries traffic between your device and our servers. It does not store message content.
• Google Firebase Cloud Messaging, only if you turn on notifications in the InflowMail mobile app: the sender's name and the subject of new mail, to show the notification on your phone.

The current list, with what each receives, is on our subprocessors page.

Revoking access and deleting your data

• Disconnect the account under Connected Accounts: we delete our access tokens and ask Google to revoke our access. Mail we already synced stays in InflowMail until you delete that mailbox or your account.
• Revoke access yourself at any time at myaccount.google.com/permissions.
• Delete the mailbox from Connected Accounts, or delete your InflowMail account: the synced mail, including stored message bodies, is deleted from our systems, normally within minutes. Encrypted database backups age out after 14 days.
• While connected, we keep message bodies only for your plan's history window, as described in Data Retention.

4. AI Data Processing

InflowMail uses AI to classify emails, generate summaries, suggest replies, and power automation features. Here is how your data is handled in the context of AI processing:

• Minimal content by default: AI classification uses the sender, subject, date and the short preview snippet of each message, not the full body. Full body content is only sent to AI when you use a feature that needs it, such as generating a reply or requesting a summary.
• No training on your data: We never use your emails or metadata to train AI models. Our AI features run on Amazon Bedrock by default, which under AWS's terms does not use your prompts or results to train models. If your organization connects its own AI provider, that provider's terms apply to what it receives.
• Organization choice via Bring Your Own AI: An organization administrator can have classification, summaries and reply drafts use Anthropic's own API, OpenAI, Google Gemini or xAI with the organization's own API key. Requests are still sent from our servers; they are billed to, and governed by, your organization's agreement with that provider.
• Organization-level configuration: Organization administrators can configure AI settings for all members, including disabling AI features entirely.
• Email rules are user-controlled: Classification rules you create run locally on our servers and do not involve AI processing. Your rules always take priority over AI classification.

5. Data Sharing & Third Parties

We share your data only in these limited circumstances:

• Service providers: AWS (hosting, storage, backups and, through Amazon Bedrock, our AI features), any other AI provider your organization connects with its own key, Cloudflare (network), Firebase Cloud Messaging (mobile notifications, if you turn them on), Stripe (billing) and Zoho (our own emails to you). Each receives only what it needs; see subprocessors. Your email providers (Gmail, Microsoft, IMAP hosts) are not our subprocessors; we reach them with the access you grant.
• Legal requirements: When required by law, court order, or to protect safety and rights.
• Business transfers: If InflowMail is acquired, your data would transfer to the new owner under the same privacy protections.

6. Data Security

Our security measures include:

• Encryption at rest: Stored data is encrypted with AES-256. Connected-account credentials are encrypted with a key unique to your account.
• Encryption in transit: TLS 1.2 or 1.3 between your device and our servers, and between our servers and your email providers.
• OAuth tokens: Encrypted per-account, never stored in plain text.
• Access controls: Role-based access, multi-factor authentication, session management.
• Infrastructure: AWS data centers with strict physical and logical access controls. Those certifications are AWS's; we do not claim them as our own.

For more details, see our Security Documentation.

7. Data Retention

• Message bodies: Kept for your plan's history window (Free 30 days; Pro 90 days), then deleted, except starred, sent and draft messages.
• Email metadata: Retained while the mailbox is connected. When you delete a mailbox or your account, its synced mail (metadata and bodies) is deleted, normally within minutes.
• Your account: Deleted 30 days after you ask, so you can change your mind; your connected mailboxes are disconnected at once and their mail is deleted within minutes. At 30 days everything else tied to the account is deleted, including rules, contacts, sorting history, tasks, calendar events, sessions, devices and support tickets; the deletion page lists what is kept.
• Assistant conversations: Kept while your account is active, and deleted with your account.
• Security logs: Sign-in attempt records and server logs are deleted after 30 days. The security audit log is kept for the life of your account and may be kept after deletion for security and legal purposes, tied to an anonymous account id and without your IP addresses, browser details or email address.
• Helper activity log: Kept while your account is active, and deleted with it. If you help with someone else's mailbox, their log of what you did there is their record: it stays after you delete your account, without your name, address or IP. You can see and export it (CSV) for the window your plan shows: the last 7 days on Free, 30 days on Pro, 2 years on Practice.
• Backups: Encrypted database backups retained for 14 days, then permanently deleted.
• Expired tokens: OAuth tokens that are no longer valid are automatically deleted during routine maintenance. Disconnected account credentials are purged immediately.

8. Your Rights (GDPR & CCPA)

You have the following rights regarding your data:

To exercise these rights, go to Account Settings > Data Protection or send a request through the support form.

9. Cookies

We use minimal cookies:

• Essential cookies: Required for authentication and security. Cannot be disabled. This includes inflow_consent, which remembers your analytics choice (see below).
• Preferences: Settings such as theme and panel sizes are kept in your browser's local storage, not in cookies.
• Analytics: Google Analytics sets _ga cookies to count visits and returning visitors, and our own first-party analytics keeps a random visitor id in your browser's local storage (see "Usage Information" above).

Your choice in the UK, EU, EEA and Switzerland

If you visit from the United Kingdom, the European Union, Iceland, Liechtenstein, Norway or Switzerland, or we can't tell where you are visiting from, we ask before any analytics run. Until you choose "Accept analytics", neither Google Analytics nor our own analytics loads, and nothing is stored for analytics. If you decline, they don't load at all. We work out your country from your connection when the page loads and use it only to decide whether to ask. Your choice is kept for 6 months in the inflow_consent cookie on this site; we never set that cookie unless you choose. You can change your mind at any time with "Cookie settings" in the site footer or with this button: Cookie settings. Withdrawing consent deletes the _ga cookies and our visitor id from your browser. Visitors from elsewhere are not asked; analytics run as described above, and you can block them with the opt-out add-on or a tracker blocker.

We do not use advertising cookies.

10. International Transfers

Our servers are located in the United States (AWS us-east-1). If you are located outside the US, your data will be transferred to the US. We ensure appropriate safeguards through AWS's compliance with EU-US Data Privacy Framework and Standard Contractual Clauses.

11. Children's Privacy

InflowMail is not intended for children under 13. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. Continued use after changes constitutes acceptance of the updated policy.

13. Contact Us