Privacy Policy

1. Introduction

PromptMail ("we", "our", or "the application") is a service that provides (a) a personal AI communication assistant (the "Assistant") that can read, draft, and send Gmail email and Google Chat messages, with an agent that can autonomously follow up on conversations when you explicitly authorize it, and (b) a connector that lets you send and read emails from supported AI clients. Manual mode does not connect to another messaging app: messages you paste or share into it are stored with the conversation so the Assistant can draft a reply, and PromptMail does not send those replies for you. This Privacy Policy describes how we collect, use, store, and protect information when you use PromptMail, including data we receive from Google when you sign in and authorize access to Gmail or Google Chat.

By using PromptMail, you agree to this Privacy Policy. If you do not agree, please do not use the service.

2. Data We Collect

When you sign in with Google and authorize PromptMail, we receive and store the following:

• Account information — Your name, email address, profile picture, and Google account ID, provided by Google Sign-In.
• OAuth tokens and granted scopes — Access and refresh tokens that allow PromptMail to call Google APIs on your behalf, together with a record of which permissions you have granted. Sign-in requests only your basic profile. Gmail permissions (read and send email) and Google Chat permissions (read spaces, memberships, and messages; send messages; and read-only directory and contacts access used to resolve display names of direct-message participants) are requested separately, the first time you enable each feature.
• Session identifier — A unique token we generate to identify your session when you use PromptMail from a supported client via our MCP server.

When you use the Assistant, we additionally store, for each conversation you delegate:

• Conversation setup — The channel (Gmail, Google Chat, or Manual), the recipient, app name, or Google Chat space, the subject, the goal you set, and identifiers of the email thread or chat message you selected.
• Message snapshots — A copy of the email or chat message you selected, of new inbound messages an agent processes during authorized follow-up, and of messages you paste or share into a Manual conversation, so PromptMail can draft replies and show you the conversation timeline.
• Your chat with the Assistant — The instructions and questions you send, the Assistant's responses and summaries, and a reference to the AI provider's response so the conversation can continue.
• Actions and audit trail — Drafts, proposed and completed sends, escalations, and authorization grants and revocations, including their status and any error messages.
• Authorization settings and rules — Guardrails, reply limits, expiry, and approval preferences you configure per conversation, and the account-level rules (AGENT.md) you write.

When you use PromptMail from an MCP client, we use the Gmail API to access only the data necessary to perform the requested action and do not retain email content beyond what is needed to fulfill that request. Assistant conversation data described above is retained while your account exists so that you can review the audit trail; removing a conversation from the Assistant archives it and stops any autonomous handling. You can ask us to delete your account data at any time (see "Your Choices and Rights").

3. How We Use Your Data

We use the data described above only to:

• Identify you and maintain your account and session.
• Provide the core PromptMail features: sending emails and reading (listing, fetching) your emails when you ask a connected AI client to do so.
• Operate the Assistant: search your inbox and Google Chat spaces when you ask, generate drafts and summaries, and send messages you approve. For Gmail or Google Chat conversations you have explicitly authorized, operate an agent to periodically check for new inbound replies and respond within the goal, guardrails, reply limit, and expiry you configured, or escalate to you instead. In Manual mode, generate drafts from messages you paste or share, without sending them. If you turn on autonomous follow-up for a Manual conversation, draft the next reply when you add a new inbound message, still without sending it.
• Refresh your Google access token when it expires so the service continues to work.
• Improve the reliability and security of the application (e.g., logging errors, investigating abuse).

We do not use your data for advertising, retargeting, or interest-based ads. We do not sell, rent, or share your data with data brokers or information resellers.

4. How We Store Your Data

Account information, OAuth tokens, and Assistant conversation data are stored on our servers in association with your account. We use industry-standard practices to protect data in transit (e.g., HTTPS) and at rest. Access tokens are used only to make API requests to Google and are refreshed as needed. For MCP client requests we do not retain email content beyond what is required to complete a single operation (e.g., sending one email); Assistant conversation data is retained while your account exists and is deleted when you ask us to delete your account.

5. Data Sharing and Disclosure

We do not sell or rent your personal information. We may share or disclose data only in these limited circumstances:

• To provide the service — For example, we send requests to Google's Gmail and Google Chat APIs using your authorized access so that messages can be sent or read as you request.
• AI model provider — To generate Assistant drafts and summaries and agent follow-up decisions, PromptMail sends the relevant conversation content (such as the selected email or chat message, a message you pasted or shared into Manual mode, new inbound replies, your instructions, goal, guardrails, and rules) to our AI model provider (currently OpenAI) through its API. This data is used only to produce the response for your conversation and is not used by us for advertising.
• Service providers — We use infrastructure and error-monitoring providers to run and secure the service. They process data only on our behalf and under our instructions.
• For security or legal reasons — To investigate abuse, comply with applicable law, or respond to valid legal process.
• Business transfer — In the event of a merger, acquisition, or sale of assets, we would only transfer user data with your explicit prior consent as required by applicable policy.

We do not transfer or use your data for serving ads, for credit-worthiness or lending purposes, or to third parties like advertising platforms or data brokers.

6. Google API Services and Limited Use

PromptMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use data obtained from Google (including Gmail and Google Chat) only to provide or improve user-facing features that are prominent in PromptMail: the Assistant, and sending and reading email through connected AI clients.
• We do not allow humans to read your email or chat content unless you have given affirmative agreement (e.g., by asking to view or send a specific message), except where necessary for security (e.g., investigating abuse) or to comply with law.
• We do not transfer user data to third parties for advertising, and we do not use or sell your data for ad targeting, retargeting, or similar purposes.
• We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models. Content is sent to our AI model provider only to generate the response for your specific conversation.

7. Security

We take reasonable steps to protect your data. We use HTTPS for all traffic, secure storage for credentials, and limit access to data to what is necessary to operate and secure the service. If you believe your account or data has been compromised, please contact us.

8. Your Choices and Rights

You can revoke PromptMail's access to your Gmail and Google Chat data at any time via your Google Account permissions. Within the Assistant you can revoke a conversation's autonomous authorization at any time, which stops further automatic replies, and you can remove any conversation from your list, which archives it and ends autonomous handling. You may also sign out of PromptMail from our website. If you want your account data deleted from our systems, please contact us using the details below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. If we make material changes to how we use Google user data, we will notify you and ask for your consent where required by Google's policies before using your data in the new way.

10. Contact Us

If you have questions about this Privacy Policy or our handling of your data, you can reach us at: support@promptmail.to.