Mailistix Privacy Policy

Version: 1.17 · Valid from: 3 November 2026

This Privacy Policy explains how Mailistix UG (haftungsbeschränkt) ("Mailistix", "we", "us", "our") handles personal data when you use the Mailistix desktop application for macOS and Windows (the "App") and the server-side services we operate for it (the "Cloud Services"; together with the App, the "Service"), when you contact us, and when you visit mailistix.com.

This policy is information for you. It is not part of your contract with us. The rules for using the Service are in our Terms of Service (the "Terms") and our Software License Agreement. Capitalized terms that are not defined here have the meaning given in the Terms. More detail on the AI Features is in our AI Features Notice, and the companies that process data for us are listed on our Subprocessors page.

This policy is published at https://mailistix.com/privacy-policy.

At a glance

• For businesses. Mailistix is offered only to businesses and the self-employed. For the email content and notification data that reach our servers, we act for the business for which you use Mailistix, as its processor (section 2.3).
• Your email stays on your computer. The App syncs your mailbox directly between your computer and your mailbox provider (for example Google or Microsoft) and stores it in an encrypted database on your computer. Your emails, attachments, contacts and calendar are not stored on our servers.
• Email content reaches our servers only when you use an AI Feature. The text a request needs passes through our servers in the EU (Frankfurt, Germany, by default) to Microsoft Azure OpenAI or Google Vertex AI and is not stored by us. For real-time notifications we keep only your mailbox address and a technical change number, never content. To detect repeated free trials, we also keep a pseudonymous code for each mailbox you connect; the address cannot be read from it (section 4.3).
• AI stays in the EU unless you tell us you are outside Europe. If you answer that you are based in Europe (the EU, the EEA, the United Kingdom or Switzerland), or do not answer, all AI processing takes place in the EU. If you answer that you are based outside Europe, some requests to Google's Gemini models may be processed outside the EU.
• No selling, no advertising, no training. We do not sell or rent personal data, do not show ads, and do not use your data for advertising or to assess creditworthiness. Neither we nor our AI providers use your emails to train AI models.
• Analytics only if you opt in. Usage statistics and crash reports are off unless you switch them on. They use a random ID, not your name or email address.
• Polar handles payments. Polar Software, Inc. sells paid Plans as merchant of record and processes your payment details under its own privacy policy. We never see your full card details.
• You are in control. In the App you can export the data we keep on our servers, delete your Account, remove a mailbox (which also revokes Mailistix's access to your Google account), switch AI Features off, change your region and delete optional usage data.
• Google user data is used only as allowed by the Google API Services User Data Policy, including its Limited Use requirements (section 5).
• Mailistix is for adults (18+).

1. Who we are and how to reach us

1.1 Controller. The controller responsible for the processing described in section 2.2 is the following company, which also acts as processor for the processing described in section 2.3:

Mailistix UG (haftungsbeschränkt)
Kolonnenstr. 8
10827 Berlin
Germany
Represented by the managing director: Marvin Muvunyi
Register: Amtsgericht Charlottenburg (Berlin), HRB 291268 B

1.2 Privacy contact. For any question about your personal data or to exercise your rights, write to legal@mailistix.com or to the postal address above.

1.3 Representatives. We are established in the European Union, so we do not need an EU representative. For the United Kingdom see section 16.3. We have not appointed a representative in Switzerland.

2. What this policy covers and our role

2.1 Scope. This policy covers the App, the Cloud Services, our support channels and our website. It does not cover the services of Google, Microsoft, Polar or other third parties that you use together with Mailistix; their own privacy policies apply.

2.2 When we are the controller. We decide how and why personal data is processed, and are therefore the controller, for:

• your Mailistix Account and sign-in, and the record of your acceptance of the Terms and the Data Processing Agreement;
• your Plan, Credits and billing records;
• usage records of AI requests (without content), App activity, security and abuse prevention, including the mailbox fingerprints (section 4.3);
• consent records and your region setting;
• optional analytics and crash reports, server error monitoring and App updates;
• our communication with you, including support (except the Customer Personal Data described in section 2.3); and
• our website, including the contact form and the waitlist.

2.3 When we act for your business (processor). Mailistix is offered only to businesses and the self-employed (Terms, Section 3.5). Everyone who uses Mailistix does so for a Business Customer: their employer or another organization, a client, or their own business if they are self-employed. For the following processing, we act on behalf of that Business Customer, as its processor, under our Data Processing Agreement (the "DPA"):

• the content of AI requests and the AI Output (section 4.6);
• passing the sign-in codes and tokens for a mailbox through our server when a mailbox is connected (section 4.3);
• the records for real-time notifications of new mail (section 4.5);
• one-click unsubscribe requests (section 4.8); and
• email content and other people's personal data that you include in a diagnostic package or a support message (section 4.14).

This covers your own data in this processing as well as the data of other people, such as the people you correspond with ("Customer Personal Data"). For this data, the Business Customer is the controller: it decides on the legal basis, and its own privacy notice applies. We describe this processing in this policy so that you know what happens to your data. If you are self-employed and use Mailistix for your own business, you are the Business Customer. Requests about this data are best sent to the Business Customer; if you send them to us, we pass them on (section 12.7).

2.4 Data that stays on your device. Most of what the App does with your email happens only on your computer, under the control of you and your Business Customer. We have no access to that data and are neither controller nor processor for it. We describe it in this policy so that you know what the App does.

2.5 People you correspond with. If you are not a Mailistix user but someone who writes to or receives emails from a Mailistix user, section 7 explains what happens to your data.

3. Where your data is kept: an overview

4. What we process, for what purposes and on what legal basis

For each activity, this section describes the data, the purpose and the legal basis under the EU General Data Protection Regulation ("GDPR"). The legal bases are: consent (Article 6(1)(a) GDPR), performance of a contract with you or steps before entering into it (Article 6(1)(b)), compliance with a legal obligation (Article 6(1)(c)) and our or a third party's legitimate interests (Article 6(1)(f)). Where we rely on legitimate interests, we name them. Retention periods are summarized in section 10.

If you use Mailistix for an organization. Where this section names "contract" as the legal basis, it applies directly if you are our contract partner yourself, for example as a self-employed person. If you use Mailistix for a company or another organization that is our contract partner, we rely instead on legitimate interests (Article 6(1)(f)): our interest and the Business Customer's interest in providing the Service that the Business Customer ordered to the people it authorizes to use it.

Processing for your Business Customer. For the processing marked "Role: processor" below, we act for your Business Customer (section 2.3); the legal basis is the Business Customer's.

4.1 Your Mailistix Account

Data: your email address; one-time sign-in codes that we email to you (six digits, valid for 15 minutes); the confirmation of your email address; your interface language; the times you signed up and signed in; and session tokens (a sign-in token valid for one hour and a refresh token that changes with each use; a session ends after 90 days without use). Our hosting provider's authentication service also logs technical request data, including your IP address. On your computer, the App stores your session encrypted with your operating system's secure storage.

Purposes: to create your Account, sign you in, keep you signed in, confirm changes to your email address, show the App in your language, and protect your Account against unauthorized access.

Legal basis: contract (Article 6(1)(b)). Security logs: legitimate interests (Article 6(1)(f)) in protecting accounts and the Service against misuse.

You sign in to Mailistix with your email address and a code we email to you; Mailistix Accounts have no password. Mailistix does not offer sign-in with a Google or Microsoft account; connecting a mailbox (section 4.3) is a separate step.

4.2 Setup choices and consent records

Region. During setup the App asks "Where are you based?" with two answers: "In Europe" (the EU, the EEA, the United Kingdom or Switzerland) or "Outside Europe". You can change your answer at any time in Settings › Privacy & AI. We store your answer, the time and the App version. We use it for two things only: to decide where your AI requests are processed (section 4.6.4), and to calculate how many Credits an AI request uses, because the AI models used for the two regions have different prices. Changing your region never adds Credits. Until you answer, or if your answer cannot be read, your AI requests are processed in the EU. We do not determine your location from your IP address.

Consent records. We store when you enabled the AI Features (with the version of the consent text and the App version) until you switch them off or delete your Account; each time you switch them on or off is also recorded as a security event (section 4.15). We also store your choices on optional analytics and crash reports, the history of those choices, and the random analytics ID described in section 4.12.

Acceptance of the Terms. When you create your Account or accept new Terms in the App, you confirm that you are 18 or older and use Mailistix for your business, your self-employed profession or, with its permission, the organization you work for, and you accept the Terms, including the DPA, and the Software License Agreement. We record the version of the Terms and of the DPA you accepted, the time (from our server), whether you accepted at sign-up or later in the App, the App version, the language of the App, which wording of the confirmation you saw with a SHA-256 checksum of that exact wording, and the SHA-256 checksum of each document of the version. If you object to an announced change of the Terms (Terms, Section 19.3), we record the objection with the same details. When you sign up, the accepted versions are also stored with your Account. When you confirm your email address, our server records your acceptance from these details, with the time you requested the sign-up and the time you confirmed. Opt-outs of the arbitration agreement you send us by email are recorded with the time we received them and the message ID. To protect these records against loss and later alteration, each day we keep a list of checksums of these records (no readable data) at Microsoft Azure Blob Storage in Germany, which cannot be changed or deleted for 4 years and 1 month, and a backup copy of the records there (with your user ID and a hash of your email address instead of the address), which is deleted automatically after 30 days (section 8). When your Account is deleted, we keep a copy of these records with your user ID and a one-way hash (SHA-256) of your email address instead of the address, until 1 January of the fourth year after the deletion (section 10).

Legal basis: region and acceptance records: contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) in being able to prove which terms apply and that the Service is used for business purposes; for the copy kept after deletion: legitimate interests (Article 6(1)(f)) in proving the contract and the business confirmation against legal claims (Article 17(3)(e)). Records of your analytics and crash-report choices: legal obligation to be able to demonstrate consent (Article 6(1)(c) with Article 7(1) GDPR). Records of the AI setting, and all choices insofar as they serve this purpose: legitimate interests (Article 6(1)(f)) in documenting your choices, demonstrating that we meet the requirements of Google and our providers, and applying your choices on every device you use.

4.3 Connecting a mailbox

How it works: you connect a Gmail or Google Workspace mailbox, or a Microsoft mailbox (Outlook.com or Microsoft 365), through the sign-in page of Google or Microsoft in your system browser. Mailistix never sees your Google or Microsoft password. The App receives the permission through a secure, one-time handshake on your own computer (OAuth 2.0 with PKCE). You can connect up to 10 mailboxes on the Trial and Pro Plans and one on the Basic Plan.

Mailboxes at other providers (IMAP): you can also connect a mailbox at another provider with its email address and password. To find the servers, the App first looks in a list of providers built into the App (based on Mozilla Thunderbird's database, with additions of ours), then asks the Domain Name System for the domain's mail records, asks the domain's own server for a settings file (autoconfig, over HTTPS) and, if nothing is found, tries likely server names with a secure connection. These requests go from your computer to the domain's servers and to your DNS provider; they contain the domain, and the request for the settings file also contains your email address, as the settings standard provides. Server names that the App found outside your domain are shown to you before the first sign-in. Your password is sent only to the incoming and outgoing servers you accept, over an encrypted connection, and is stored on your computer, encrypted with your operating system's secure storage. It is never sent to us.

Tokens: Google and Microsoft issue access and refresh tokens that let the App work with your mailbox. The App stores them on your computer, encrypted with your operating system's secure storage. To obtain and renew these tokens, the App uses a server function of ours, because the confidential key that identifies Mailistix to Google must stay on a server. The authorization code and the tokens pass through that function to Google or Microsoft and back; they are not stored on our servers, and our logs do not contain them.

Permissions: the permissions Mailistix requests, and why, are listed in section 5.2 (Google) and section 6.1 (Microsoft).

Mailbox fingerprint: when you connect a mailbox, our server function also takes the mailbox's email address (from Google, your primary Google account email address; from Microsoft, the address in the sign-in response; for a mailbox connected with its password, the address you entered, which the App sends to our server function once after you connect a new mailbox) and turns it into a pseudonymous code, the "mailbox fingerprint". It first writes the address in one standard form (lower case, without a "+" suffix and, for Gmail, without dots and with googlemail.com written as gmail.com), so that variants of one address give the same code, and then computes a keyed one-way hash of it (HMAC-SHA-256 with a secret key that exists only on our server). We store only this code, the provider (Google, Microsoft or IMAP), your user ID and when you first and last connected the mailbox, never the address itself. Without the key, the code cannot be turned back into the address. If other Mailistix Accounts, including deleted ones, connected the same mailbox before, we record a security event that contains only how many such Accounts there are (section 4.15). We use the fingerprints only to detect misuse, in particular repeated free trials with the same mailbox under new Accounts; nobody is blocked automatically. A fingerprint stays when you remove the mailbox; it is deleted 12 months after your Account is deleted (section 10). Legal basis: legitimate interests (Article 6(1)(f)) in preventing fraud and the misuse of free trials.

Role: the connection takes place on your computer under your control. Our server function that passes the authorization code and the tokens through acts as processor for your Business Customer (section 2.3). We keep the mailbox fingerprint for our own purpose of preventing misuse, as controller (section 2.2). That a Google or Microsoft mailbox was connected, or that its connection failed, is recorded as a security event (section 4.15). For a mailbox at another provider, the search for the servers and the connection take place on your computer; only its address reaches our server function, for the mailbox fingerprint.

4.4 Your email on your computer

Syncing, reading and sending. The App exchanges your email directly between your computer and the servers of your mailbox provider (Google, Microsoft or the IMAP and SMTP servers of another provider). Your mail is not routed through our servers. When you send an email, the App sends it through your own mailbox. The App never sends an email or answers an invitation on its own; it does so only when you click send or answer.

Local storage. The App stores your mail in a database on your computer, encrypted with ChaCha20-Poly1305 and a random 256-bit key that your operating system protects. Release versions of the App refuse to store data unencrypted. Attachments you open are cached encrypted (AES-256-GCM) for at most 7 days and up to 512 MiB; temporary unencrypted copies made so that another program can open a file are deleted after 10 minutes. Images in emails are cached for up to 180 days and up to 1 GB. Files you save into a project are stored in the App's documents folder; deleting the document also deletes the file.

Address book. The App builds your list of contacts from the addresses in your mail, on your computer. Mailistix does not use Google's or Microsoft's contacts services.

Search. Searches run in the App's local index and, where needed, at your mailbox provider.

Local logs. The App keeps technical logs on your computer: a performance log (30 days, at most 5 MB), short trace files in your temporary folder that overwrite themselves (about 1 MB), and an encrypted support log (7 days, at most 500 entries and 2 MB). Log entries are cleaned of personal content. The App does not create native crash dumps. These logs stay on your computer unless you choose to send them to us (section 4.14).

How long it stays. Your local data stays on your computer after you sign out. It is deleted when you remove a mailbox (that mailbox's mail), when you use Settings › General › Danger Zone › Clear All Emails, or when you delete your Account on that computer. Uninstalling the App does not delete it; to remove it, delete the App's data folder after uninstalling (on macOS ~/Library/Application Support/Mailistix, on Windows %APPDATA%\Mailistix). Once a day the App also writes an encrypted backup of the data that exists only on your computer (projects, tasks, signatures, writing preferences, Ask AI chats and your mailbox connections, but not your mail), so that it can repair a damaged database. It keeps seven daily and four weekly backups, at most about five weeks; removing a mailbox or clearing your emails replaces them, and deleting your Account deletes them.

Our role: this processing takes place on your computer under your control. We have no access to it.

4.5 Real-time notifications of new mail

To show new mail quickly without constantly asking your mailbox provider, the Cloud Services relay change notifications. These notifications never contain the content of an email.

Gmail: our server function registers a notification ("watch") for your mailbox with Google, using the App's current access token for that one request. When something changes, Google publishes a message through Google Cloud Pub/Sub that contains only your Gmail address and a change number. Pub/Sub keeps that message for at most one hour. Our server function checks Google's signature and stores your Gmail address, the change number and your user ID for 7 days. The registration that links your Gmail address to your Account is kept until 30 days after it was last renewed. The App then fetches the actual changes directly from Google.

Microsoft: our server function creates a Microsoft Graph notification subscription for new and changed messages in your mailbox. Microsoft's notifications contain no content. We store the subscription ID, the message ID, the mailbox and your user ID for 7 days, and the subscription details with a hashed verification secret until you remove the mailbox or delete your Account, and at most 30 days after the subscription expired. An older notification table that is no longer filled is deleted after 30 days.

Mailboxes connected through IMAP: the App keeps an additional connection from your computer to the provider's server, which reports new mail in the inbox (IMAP IDLE), and also checks the mailbox every few minutes. Our servers are not involved and keep no notification records for these mailboxes.

When you remove a mailbox, the App stops the watch or subscription and deletes these records. If our servers cannot be reached at that moment, a daily job deletes the notification records once they are 7 days old.

Role: processor for your Business Customer (section 2.3).

4.6 AI Features

4.6.1 When data is sent

The AI Features are off until you switch them on in the dialog "Let AI help with email", which appears when you first use one, or in Settings › Privacy & AI. After that, email content is sent for AI processing only when you use an AI Feature, for example when you ask for a draft, open a summary, ask Ask AI a question or open a meeting briefing, and in the learning step described in section 4.6.6 after you send a reply that the AI drafted. You can switch the AI Features off at any time in Settings › Privacy & AI › "AI features". From then on, nothing is sent for AI processing until you switch them on again.

4.6.2 What is sent

Draft and rewrite requests also contain your name, your email address and your time zone, so that the draft can address people correctly and understand words like "tomorrow". Ask AI and meeting briefing requests contain today's date and your time zone for the same reason. In addition:

Attachments themselves are not sent, only their names and, for Ask AI, text passages extracted on your computer.

4.6.3 How a request travels

The App sends the request over an encrypted connection to our server functions, hosted by Supabase in the EU (the server functions for AI requests run only in EU locations, Frankfurt, Germany, by default). There, our function builds the instructions for the model (the instructions are kept on the server, and emails are marked as untrusted data so that text in an email cannot give the model instructions) and sends the request to one of our AI providers. The answer is streamed back to the App.

4.6.4 Providers and regions

We use Microsoft Azure OpenAI (GPT models, operated by Microsoft in its EU Data Zone; our resource is located in Sweden Central) and Google Cloud Vertex AI (Gemini models). Which one answers a request depends on the feature and on availability: if one model is slow or unavailable, the request automatically moves to another one. Where these models run depends on your answer to "Where are you based?":

• "In Europe", or no answer: all AI processing takes place in the EU, at Microsoft Azure OpenAI in its EU Data Zone and at Google Vertex AI in its EU multi-region (EU data residency).
• "Outside Europe": most requests to Gemini models run on Google's global endpoint, which may process the data in any country where Google offers the model. Some steps (selecting relevant emails for Ask AI) still run in Google's EU multi-region, and all requests to Microsoft run in Microsoft's EU Data Zone.

Model comparisons. To keep quality and reliability high, we may route the requests of some users to a different model or model setting from the same providers for a limited time, for example to compare a new model version. Your region choice always applies. We compare only technical measures such as response times, errors, token counts and Credits, never content. We inform you before your Account takes part, and you can opt out by writing to legal@mailistix.com.

4.6.5 What is stored, and where

• On our servers: no content. We do not store the content of your AI requests or of the AI Output. The technical logs of our server functions contain no content; our hosting provider keeps them for up to 90 days.
• Usage metadata: for each request we record which function and AI feature type was used (for example "summary", "thread summary", "draft reply", "rewrite"), the model, success or error, response time, token counts, the Credits charged and the internal value of a Credit, together with your user ID. We do not record content, subjects or recipients. We keep these records for 180 days (section 4.11).
• Held-back answers: if our safety check holds back an answer because it might reveal our internal instructions, we record a security event (your user ID, the feature, whether the answer was withheld or stopped) without the answer text (section 4.15).
• Outage routing: if a model fails for your request, we note your user ID and the failed model for a few minutes, so that your next requests skip it.
• At our AI providers: the providers process the data only to answer the request, under data processing terms that prohibit them from using it to train their models. Microsoft is called with storage of the request switched off. The providers may keep data for a limited time for operation and abuse monitoring: Google Vertex AI may hold inputs and outputs in memory for up to 24 hours (caching) and may log prompts that its automated systems flag as possible abuse for up to 90 days, in the region where the request was processed, where authorized Google employees may assess them; Microsoft Azure OpenAI may store prompts and outputs for up to 30 days to monitor for abuse, where authorized Microsoft personnel in the European Economic Area may review them.
• On your computer: drafts, summaries, briefings, Ask AI chats and AI preferences are kept in the App's encrypted database. Ask AI chats are kept until you delete them (each chat has a delete button). Edit pairs for learning are kept for the latest ten emails per contact and for at most 180 days. Statistics about sent AI drafts (word counts and how much you changed, no text) are kept for one year.

4.6.6 Personalization, not training

We do not train, fine-tune or otherwise change any AI model with your data, and our providers may not either. Mailistix personalizes drafts in two ways, only for you:

• Writing examples. For each draft, the App picks up to five emails you sent earlier, preferably to the same contact and in a similar situation, and includes them in the request so that the draft sounds like you. They are chosen on your computer from emails you wrote yourself.
• Learning from your edits. When you send a reply that the AI drafted and you changed it, the App stores the AI version, your sent version and the answered email on your computer. It then sends these once to an AI model, which describes in a sentence what your change shows about how you write (for example length or tone; never your greeting, sign-off, name or form of address). The sentence is stored on your computer and included in your later draft requests. Until it has been worked out, the pair is also included in your next drafts to that contact.

This personalization is used only for your own requests. It is never shared with other users and never used to build or improve a model for anyone else.

4.6.7 Role and legal basis

• Role: processor. We carry out the AI Features for your Business Customer, as its processor under the DPA (section 2.3). This covers everything in an AI request and the AI Output: your own name, email address, emails and instructions, and the data of the people in your emails (for example the sender of an email you want summarized). The Business Customer is the controller and decides on the legal basis. For the data of the people you correspond with, this is usually its legitimate interest in handling its correspondence efficiently with the tools it chooses (Article 6(1)(f)). Our safeguards support this: processing only when you start a feature, no storage of content, EU processing by default, no training, and no human review by us (our AI providers' abuse monitoring is described in section 4.6.5).
• Usage records of AI requests (section 4.6.5) contain no content. We keep them as controller; their legal basis is in section 4.11.
• Special categories of data (for example health information that someone mentions in an email) may occur in your emails. We do not intend to process such data, do not analyze emails for it and do not store it. Whether its users may use the AI Features with such content, and the legal basis for it (Article 9(2) GDPR), is for the Business Customer to decide (DPA, Section 14.2; Acceptable Use Policy).
• The AI dialog: before you first use the AI Features, the App asks you to switch them on. This lets you decide whether email content may leave your computer for AI processing, and it is the explicit permission that Google requires before Google user data is shared with an AI provider. We record it as described in section 4.2.

More about the AI Features, their limits and how AI Output is marked is in our AI Features Notice.

4.7 Calendar and meetings

Data: with your permission (section 5.2 and 6.1), the App reads the events of your calendars for the next 30 days to show your meetings dashboard and reminders. On your instruction, it answers invitations, adds an event you create and deletes events you choose. It recognizes calls in your emails (for example messages with a video-call link) on your computer, without AI. Meetings, reminders and briefings are stored on your computer. You can choose in Settings › Meetings which calendars the App reads.

Use in AI Features: free and busy times are added to draft requests only when an email asks for a meeting time (without titles or participants). Meeting details are sent when you open a meeting briefing (section 4.6.2).

Role: on your computer, this processing takes place under your control (section 2.4); in AI requests, we act as processor for your Business Customer (section 4.6.7).

4.8 Newsletter unsubscribe

When you unsubscribe from a newsletter in the App:

• One-click unsubscribe: the App sends the unsubscribe address from the email's header to our server function, which sends the unsubscribe request to the sender. The sender sees our server's IP address, not yours. We do not log the address.
• Unsubscribe by email: the App sends the unsubscribe email from your own mailbox.
• Unsubscribe page: the App opens the sender's page in your browser; the sender sees your IP address.

For a mailbox connected through IMAP, the App checks the sender's digital signature (DKIM) itself before it unsubscribes, because it cannot rely on the provider's check. For this, when you click Unsubscribe, the App reads the whole email from your mailbox and asks the Domain Name System for the sender's public key. This request can reach the sender's DNS server, which then sees the address of your DNS provider. The App does this only when you click, not when you open the email.

The list of newsletters you unsubscribed from is kept on your computer.

Role: for one-click unsubscribe through our server, processor for your Business Customer (section 2.3); everything else happens on your computer under your control.

4.9 Images and links in emails

Images that an email loads from the internet are blocked by default, because they can tell the sender when you open the email and roughly where you are. If you allow them for one email or always (Settings › Privacy & AI › Email images), the App loads them directly from the sender's server over HTTPS, and the sender receives your IP address. Links open in your system browser; the App warns you about addresses that imitate well-known domains. Attachment previews run in a sandbox without network access. The App does not use a link-preview service and does not load fonts or scripts from external networks.

4.10 Plans, Credits and payments

Plans and Credits. When you create an Account, a 14-day Pro Trial starts automatically, without a payment method. We keep a record of your Plan, trial dates and any trial extension, subscription status, grace period, end of the billing period, your Polar customer and subscription IDs, and your Credit balance, Credit grants (amount, reason, the administrator who granted it and expiry; bonus grants expire after 45 days by default), Credit reservations for running requests, daily spending allowances and in-App notices about Credits.

Polar as merchant of record. Paid Plans are sold by Polar Software, Inc. ("Polar") as merchant of record and reseller. Polar collects and processes your payment details, billing address and tax information, issues invoices and handles refunds and chargebacks, as an independent controller under Polar's privacy policy. We never see your full card details.

What we share with Polar:

• Checkout: when you open the checkout for the first time, our server creates a customer record at Polar under your Mailistix user ID with your Account's email address. Each time you open the checkout, we send Polar your user ID, the product, your interface language, the currency, your IP address, which Polar uses to determine your country for the currency and tax and for fraud protection, and the information that the purchase is a business purchase, for which Polar asks for the billing name and full billing address, and the versions of the Terms and the DPA you last accepted.
• Plan sync: once you have opened a checkout, our server synchronizes your Plan with Polar when you start the App and at other times, and keeps the email address of your Polar customer record in line with your Account's email address. If you never open a checkout, we send Polar nothing about you.

What Polar sends us: event notifications about your subscription, including your customer ID, email address and name, your billing name and address and tax ID if you entered them, the product, amounts, currency and tax, the subscription status and period, and the reason you gave if you cancelled. We keep the raw notifications for 30 days after processing, also if you delete your Account in the meantime, and a record of subscription events (event type and Polar's data) for 365 days; when you delete your Account, these subscription event records are deleted.

Business purchase check. When an order is paid, our server reads from Polar whether the checkout was marked as a business purchase and whether a billing name and billing address were entered. If one is missing, we keep the order ID and what was missing until your Account is deleted and notify our team with the order ID, so that we can contact you.

Managing your subscription happens in Polar's customer portal, which you can open from the App. If a payment fails, you keep Pro for a grace period of 3 days; then your Account moves to the Basic Plan. While a subscription could still charge you, the App asks you to cancel it before you delete your Account. When you delete your Account and have never bought anything, we ask Polar to delete your customer record and anonymize its personal data. If you have bought something, Polar keeps its own customer and transaction records as its policy and tax law require.

Legal basis: contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for records we must keep under tax and commercial law, such as Polar's statements of the sales and payouts it makes for us; legitimate interests (Article 6(1)(f)) in assigning payments to the right Account, preventing misuse of trials and selling only to business customers (Terms, Section 3.5).

4.11 Usage records, cost control and fair use

AI usage records: described in section 4.6.5 (no content; 180 days). They show what an AI request cost, let us charge Credits correctly, enforce limits and detect faults and misuse. They are included in your data export.

Limits: to protect the Service and our costs, we apply technical limits, such as a daily limit on the cost of your AI requests and a limit on AI requests per hour. Reaching a limit pauses AI requests until the limit resets.

App activity: we record one entry for each day on which you use the App (kept for 90 days) and the last time the App was active (kept until you delete your Account). We use this to show your Plan and trial correctly, to recognize inactive Accounts and to plan capacity. A person at Mailistix may also look at your sign-in activity and AI usage when deciding on a goodwill gesture such as a one-time trial extension.

Legal basis: contract (Article 6(1)(b)) for charging Credits; legitimate interests (Article 6(1)(f)) in controlling costs, keeping the Service stable, preventing misuse and managing Accounts. These records contain no email content and are kept for short periods.

4.12 Optional analytics and crash reports (only with your consent)

During setup, the App asks "Help improve Mailistix?" with the answers "No thanks", "Yes, I'm in" and "Choose separately". Nothing is preselected. You can change your choice at any time in Settings › Privacy & AI › Product improvement.

Usage and reliability statistics (PostHog). If you switch them on, the App sends a fixed list of events to PostHog's EU cloud (Frankfurt, Germany), for example: setup steps completed, a mailbox connected (Gmail, Outlook or IMAP), an email opened, a reply sent, a search performed, an AI action requested, completed or failed (with the provider and a token range), an update installed, your Plan category, App version, operating system, processor type and language. Some events carry coarse time ranges, such as how long a sync or a search took. They carry no counts derived from your mailbox, such as how many messages a sync loaded or how many results a search found. The statistics never contain email content, subjects, addresses, search text, file names, questions, answers or quotations. Location lookup from your IP address, automatic click tracking and session recording are switched off. Events are linked to a random ID that is created only when you opt in and is stored with your Account, so that we can delete the data on request; we never send your user ID or email address. The data is therefore pseudonymous, not anonymous. Analytics for Ask AI are currently switched off entirely.

"Something broke" reports (Sentry). If you switch them on, the App sends cleaned error reports to Sentry's EU region (Germany): the error, App version and operating system, without user, request details, email content, prompts or passwords. The App shows this option only in versions that can send these reports; the current version cannot, so it does not offer the option.

Withdrawing consent. If you switch an option off, the App stops sending at once and deletes any reports waiting on your computer. Settings › Privacy & AI › Delete optional usage data also switches collection off and asks PostHog to delete all events and other data linked to your random ID; PostHog carries out the deletion shortly afterwards. Withdrawal does not affect processing before it.

Legal basis: consent (Article 6(1)(a) GDPR) and, for reading and storing information on your computer for these purposes, consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or the corresponding national law implementing the ePrivacy Directive.

4.13 Server error monitoring

Our server functions report errors to Sentry's EU region (Germany) so that we notice failures quickly. These reports contain fixed error codes, the name of the function and technical result tags, but no request content, raw error messages, user IDs or IP addresses. One exception: when an AI answer is held back by our safety check (section 4.15), the report contains a shortened one-way hash of your user ID and the date, so that we are alerted at most three times per user and day.

Legal basis: legitimate interests (Article 6(1)(f)) in the availability and security of the Service.

4.14 Support and diagnostic logs

Email support. When you write to us, we process your email address, your message and anything you include, to answer you. Please do not send us passwords. We will not access your mailbox. If you send us specific email content to help with a problem, we use it only for that request. Support emails are kept in our email system at Microsoft 365 (section 8) for the period in section 10.

Diagnostic logs. In Settings › Support › Diagnostic logs, you can send us a diagnostic package. The App shows you its content before sending: App version and build, operating-system type and version, the App's language, a cleaned technical timeline with fixed codes (for example why a sync, a sign-in, an AI draft, an update or a sending failed), for each type of mailbox the number of connected accounts, how many need a new sign-in and the codes of the last sync errors, the state of the search index and of text recognition in attachments as counts, memory use and an optional note from you. It contains no email content, email addresses, names, or server or folder names. It is linked to your Account so that we can match it to your request, stored in a private storage area and deleted after 30 days. You can send up to five packages per day. When a package arrives, our email system (Microsoft 365, section 8) notifies us with its reference and technical details (App version, number of entries, size), but not its content, your note or your email address. After sending, the App shows you the reference and lists it in the same place until the package is deleted, so that you can name it when you write to us. This works independently of your analytics choice. You can also delete the local log ("Delete local").

Legal basis: contract (Article 6(1)(b)) to handle your request; legitimate interests (Article 6(1)(f)) in fixing faults in the Service. Role: personal data of other people, or email content, that you include in a support message or in the note of a diagnostic package is Customer Personal Data, which we process as processor for your Business Customer (section 2.3).

4.15 Security and abuse prevention

Data: security events (the type of event, its result, a code, the source, a small amount of technical context and your user ID; for example a held-back AI answer, a granted trial extension or a connected mailbox that other Accounts connected before, with only the number of those Accounts), the fingerprints of the mailboxes you connect (section 4.3), rate-limit counters (for example for sign-in attempts per IP address), the log of our authentication service (sign-ins, sign-outs and changes to your Account, with your email address and IP address; each entry is kept for 180 days, also if you delete your Account in the meantime), and the request logs of our hosting provider, including IP addresses, which our hosting provider keeps for at most 7 days.

Protection of the AI Features: emails are passed to the model as marked, untrusted data; the instructions stay on our server; a safety check holds back answers that might reveal those instructions; and the App performs no action in your mailbox based on AI Output.

Misuse of free trials: when you connect a mailbox, we compare its fingerprint (section 4.3) with the fingerprints of other Accounts, including Accounts deleted in the last 12 months, to detect a mailbox that is used again and again for new free trials under new Accounts. A match is recorded as a security event with only the number of other Accounts. This does not block or restrict any Account automatically.

Legal basis: legitimate interests (Article 6(1)(f)) in protecting you, other users and the Service against attacks, fraud and misuse, including the misuse of free trials; legal obligation (Article 6(1)(c)) where the law requires security measures (Article 32 GDPR).

4.16 App updates

About 15 seconds after it starts, and then every four hours while it is running, the App checks our update server (a public storage area at Supabase) for a new version. If there is one, the App downloads it in the background from our download server at Cloudflare (storage in the EU, delivered through Cloudflare's network) and installs it only after you confirm ("Restart & Install"). The App also learns of a new version as soon as we publish it: while it runs, it keeps a connection to Supabase Realtime open that receives only our release announcements, and an announcement starts a check within about two minutes. The App sends no data about your Account over this connection; Supabase receives your IP address. Each check and download transmits your IP address, the name of the update file for your operating system and processor type, and a random installation identifier that the update component creates on your computer and that is not linked to your Account; these appear in the request logs of Supabase and Cloudflare. Downloading the App from downloads.mailistix.com likewise transmits your IP address and the request data to Cloudflare.

Legal basis: contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)) in keeping installations secure.

4.17 Emails we send you

We send emails needed for your Account, such as confirmation emails, one-time sign-in codes and confirmations of a change of email address, in your interface language, through Microsoft 365, our email system (section 8). Polar sends receipts and billing emails. We may email you about material changes to this policy or the Terms and about security matters. If you join the waitlist for the beta (section 4.18), we send you a short confirmation and an email when the beta for your platform is ready. We currently do not send newsletters or other marketing emails; if we start, we will ask for your consent where the law requires it, and every such email will contain an unsubscribe link.

Legal basis: contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for notices the law requires; consent (Article 6(1)(a)) for the waitlist emails.

4.18 Our website

When you visit mailistix.com, the web server processes technical data that is needed to deliver the pages and protect them, such as your IP address, browser type, the page requested and the time. The website is hosted by Cloudflare (Cloudflare Pages), which also operates our domain's DNS and processes these data for us, as our processor, to deliver the website and protect it against attacks; the request is answered by the Cloudflare data center nearest to you. We do not keep server logs of the website ourselves. The website sets no cookies for tracking or advertising and does not embed content from third parties, except Cloudflare Web Analytics for visitors outside the EU and Google reCAPTCHA in the contact form and the waitlist, which loads only after you allow it (both below); its fonts are served from our own domain. While the website or parts of it are password-protected, a strictly necessary cookie remembers for up to 30 days that you entered the password; it contains no identifier and is the same for every visitor. Cloudflare may also set a strictly necessary security cookie that helps it tell people from automated traffic.

Website statistics (Cloudflare Web Analytics), outside the EU only. For visitors outside the European Union, Cloudflare adds a small script (from static.cloudflareinsights.com) to our pages that measures page views and loading times: the page address and the page you came from, browser, operating system and device type, the country derived from your IP address, and timing values. Cloudflare processes these data for us as our processor and shows us only aggregated statistics, not individual visitors; it does not use them to follow you across websites. Detailed measurements are kept for 7 days, after that only a sample of about 10 %. Visitors in the EU do not get the script.

Contact form. If you write to us through the form at https://mailistix.com/contact, we process your name, email address and message to answer you. The form delivers your message to our mailbox legal@mailistix.com at Microsoft 365, our email system (section 8), and sends you a confirmation from that mailbox that contains none of your message; we keep no copy of the confirmation. We keep your message in our mailbox like a support email (section 10). To limit misuse, the form accepts at most five attempts per hour from one IP address and sends at most two confirmations per day to one email address. The counters are kept in Cloudflare's cache at the Cloudflare location that handled the request and hold only a keyed one-way hash (HMAC with a secret key) of the IP address or email address, not the address itself (section 10). A hidden field that people do not see filters out automated submissions. Before sending, you confirm that you have read this Privacy Policy.

Waitlist. If you join the waitlist for the Mailistix beta at https://mailistix.com, we process your email address, the platform you chose (Mac or Windows) and the time at which you ticked the box described below. We use them only to send you a short confirmation straight away and to email you once when the beta for your platform is ready (once for each platform, if you joined for both). We do not use them for newsletters or any further marketing and do not pass them on, except to the processors named in section 8. The waitlist delivers your entry to a mailbox of ours at Microsoft 365, our email system (section 8), and sends you the confirmation from that same mailbox, so replies reach us there; we keep no copy of the confirmation. The entries in our mailbox are the waitlist; we keep it nowhere else. Before joining, you tick a box to confirm that you have read this Privacy Policy and agree that we use your email address as described here. You are on the waitlist as soon as you submit the form; the confirmation email asks for no further step. To limit misuse, the waitlist accepts at most ten attempts per hour from one IP address and sends at most two confirmations per day to one email address. The counters are kept in Cloudflare's cache at the Cloudflare location that handled the request and hold only a keyed one-way hash (HMAC with a secret key) of the IP address or email address, not the address itself (section 10). A hidden field that people do not see filters out automated submissions.

Google reCAPTCHA in the contact form and the waitlist. To protect the contact form and the waitlist against spam and automated abuse, we use reCAPTCHA v3, which Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland ("Google"), provides to us under the Google Cloud terms and the Cloud Data Processing Addendum. Since 2 April 2026, Google processes reCAPTCHA data on our behalf as our processor, not under its own privacy policy. reCAPTCHA is not loaded when you open the page. Only when you press "Send message" and then "Allow and send" in the dialog that opens (contact form), or press "Join the waitlist" and then "Allow and join" in the waitlist dialog (waitlist), does your browser load reCAPTCHA from Google's servers. Google then receives your IP address and information about your browser and device (for example browser type, language and screen size), the address of the page, the date and time, and how you interact with the page (for example mouse movements and time spent on it). reCAPTCHA reads and sets a cookie for its risk analysis and may read other identifiers in your browser. From this, Google assesses how likely it is that a person is sending the form. Our server passes the resulting token to Google, without your IP address, receives only this assessment, uses it to accept or reject the message or entry and does not store it. Google may process these data outside the EU, in particular at Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework; Google's data processing terms also include the Standard Contractual Clauses (section 9.3).

Legal basis: legitimate interests (Article 6(1)(f)) in providing a secure website and in answering the messages people send us, including protecting the contact form and the waitlist against misuse, and in knowing how our pages are used and how fast they load (website statistics outside the EU); contract (Article 6(1)(b)) where your message concerns your Account or a contract with us; for the password cookie and Cloudflare's security cookie, Section 25(2) no. 2 TDDDG (strictly necessary); for Google reCAPTCHA, your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG), which you give in the dialog. Your consent applies only to the current visit of the page; you can withdraw it at any time with effect for the future by closing the browser tab or reloading the page, after which reCAPTCHA is not loaded again until you allow it again. Without it you cannot send the form or join the waitlist, but you can email us at legal@mailistix.com.

Legal basis of the waitlist: your consent (Article 6(1)(a) GDPR), which you give by ticking the box. You can withdraw it at any time with effect for the future by replying to the confirmation email or by writing to legal@mailistix.com; we then delete your entry. If someone else entered your address, you can ask us in the same way to delete the entry. Processing before the withdrawal stays lawful. Without your consent you cannot join the waitlist, but you can email us at legal@mailistix.com.

5. Google user data

This section explains how Mailistix accesses, uses, stores, shares and deletes data it receives from Google APIs ("Google user data"), such as data from Gmail and Google Calendar.

5.1 Limited Use

Mailistix's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We also comply with the Google Workspace API User Data and Developer Policy.

5.2 What Mailistix accesses and why

Mailistix does not request access to your Google Contacts, Google Drive or other Google services.

5.3 How Mailistix uses Google user data

Mailistix uses Google user data only to provide the features you see and use in the App: reading, organizing, searching, writing and sending email, your calendar and meetings, and the AI Features you choose to use. In addition, for security purposes, our server derives from your Gmail address the mailbox fingerprint described in section 4.3, which serves only to detect misuse such as repeated free trials. Mailistix does not use Google user data for any other purpose.

5.4 Where Google user data is stored

• On your computer: your emails, attachments, labels, calendar events and the access tokens, in the App's encrypted database and your operating system's secure storage (section 4.4).
• On our servers: only your Gmail address, a change number and the link to your Account for real-time notifications (section 4.5); the mailbox fingerprint, a code derived from your Gmail address for security purposes that is not the address and cannot be turned back into it without our server's key (section 4.3); and your AI usage records, which contain no Google user data. Email content is not stored on our servers.
• At our AI providers: the content of an AI request, only for processing it and the limited provider-side periods in section 4.6.5.

5.5 With whom Google user data is shared

We transfer Google user data to others only:

1. to provide the features you use, with your permission: to Microsoft Azure OpenAI and Google Vertex AI when you use an AI Feature, after you have switched the AI Features on (section 4.6); to Google itself when Ask AI searches your mailbox; and to a newsletter sender when you unsubscribe (section 4.8);
2. to service providers that operate the Service for us under contracts that bind them to our instructions and to confidentiality, namely Supabase (hosting, Frankfurt) and Google Cloud Pub/Sub (notification metadata);
3. for security purposes, for example to investigate abuse;
4. to comply with applicable law, for example a binding court order; and
5. as part of a merger, acquisition or sale of assets, only after we have obtained your explicit prior consent.

5.6 What we never do with Google user data

• We do not sell Google user data, and we do not transfer it to advertising platforms, data brokers or information resellers.
• We do not use it to serve advertising, including retargeting, personalized or interest-based advertising.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not use Google Workspace data, including Gmail and Calendar data, to develop, improve or train generalized or non-personalized AI or machine-learning models. The only personalization is the per-user personalization described in section 4.6.6, which is used solely to provide features to you, is stored on your computer and does not change any model.
• We do not allow humans to read Google user data, except (a) where you have given your affirmative agreement for specific messages or data, for example in a support request; (b) where it is necessary for security purposes, such as investigating abuse or a security incident; (c) to comply with applicable law; or (d) where the data, including derivations, has been aggregated and anonymized and is used for internal operations in line with applicable law. Our AI providers' automated abuse monitoring may flag a request for review by authorized employees of Google or Microsoft, within the limits described in section 4.6.5.

5.7 Deleting Google user data and revoking access

• Remove a mailbox: Settings › Email Accounts › "Remove account". The App stops real-time notifications for that mailbox, deletes our notification records, deletes the mailbox's data and tokens from your computer and revokes Mailistix's access to your Google account at Google.
• Delete your Account: Settings › General › Account › Delete account (section 12.4). This removes your data from our servers, except the records that section 12.4 lists as remaining for a limited time, and, on that computer, from the App, and revokes the Google permission.
• Revoke access at Google: you can also remove Mailistix at any time on the "Third-party apps & services" page of your Google Account (https://myaccount.google.com/connections). The App then can no longer access your mailbox; data already on your computer stays there until you remove it as described above.
• Request deletion by email: write to legal@mailistix.com. Note that we cannot reach data on your computer.

Removing Mailistix's access does not delete anything in your Gmail mailbox or Google Calendar. The mailbox fingerprint (section 4.3) is kept for security purposes: it stays when you remove a mailbox or revoke access and is deleted 12 months after your Account is deleted.

6. Microsoft user data

6.1 Permissions. For Microsoft mailboxes (Outlook.com and Microsoft 365), Mailistix requests: sign-in and basic profile (openid, profile, email, User.Read) to identify the mailbox, show your name and derive the mailbox fingerprint (section 4.3); offline_access to keep it in sync; Mail.ReadWrite to sync, organize, move and delete messages and save drafts; Mail.Send to send the emails you write; and Calendars.ReadWrite for your meetings, invitations and events. Your organization may need to approve these permissions.

6.2 Use, storage and sharing. Microsoft user data is handled exactly as described for Google user data in sections 5.3 to 5.6: stored on your computer, used only for the features you use, sent for AI processing only when you use an AI Feature, never sold, never used for advertising or to train AI models, and not read by people except in the cases listed in section 5.6. Our servers store only the notification metadata described in section 4.5 and the mailbox fingerprint described in section 4.3, which we derive for security purposes from the address in Microsoft's sign-in response.

6.3 Revoking access. Removing a Microsoft mailbox in the App ends the notification subscription, deletes our notification records for that mailbox and deletes the mailbox's data and tokens from your computer; the mailbox fingerprint stays as described in section 4.3. To also remove the permission at Microsoft, use the app permissions page of your Microsoft account (for personal accounts: https://account.live.com/consent/Manage; for work or school accounts: https://myapps.microsoft.com, or ask your administrator).

7. If someone you correspond with uses Mailistix

This section is for people who are not Mailistix users but whose data reaches Mailistix because they exchange emails or meetings with a Mailistix user.

• Who is responsible: Mailistix users use Mailistix for a business: their employer or another organization, a client, or their own business (the "Business Customer", section 2.3). The Business Customer is the controller of your data in the user's mailbox, in the App and in the AI Features. It decides on the legal basis and is responsible for informing you (Articles 13 and 14 GDPR). Where your data reaches our servers, we process it only on the Business Customer's behalf, as its processor under our DPA. We provide the following information so that you know what happens with Mailistix.
• What data: your name, email address and the content of emails you exchange with the user (including attachment names and text), and meeting details such as invitations you send.
• Source: the Mailistix user's mailbox at their mailbox provider (for example Google or Microsoft).
• On the user's computer: the App stores this data in the user's encrypted local database. This is under the control of the user and the Business Customer; we have no access to it.
• On our servers and at our AI providers: only when the user uses an AI Feature, for example to summarize your email or draft a reply to you, the relevant content is processed as described in section 4.6. It is not stored by us and is not used to train AI models.
• Purpose and legal basis: to let the user read, organize and answer their correspondence. The legal basis is the Business Customer's; usually it is its legitimate interest in handling its correspondence efficiently with the tools it chooses (Article 6(1)(f) GDPR).
• Recipients and transfers: Supabase and our AI providers, as the Business Customer's subprocessors (section 8), with the transfers described in section 9.
• Your rights: please contact the Mailistix user or the Business Customer, which can also reach the data on the user's computer. If you write to us at legal@mailistix.com, we pass your request on to the Business Customer where we can identify it, and help it to answer (section 12.7). We do not know who you are unless the user processes your email with an AI Feature, and we do not store your data, so we cannot contact you ourselves.

8. Who receives personal data

We share personal data only as described in this policy. Our processors act only on our instructions under data processing agreements; for Customer Personal Data (section 2.3) they are our subprocessors under the DPA. The current list, with details, is on our Subprocessors page.

We do not sell personal data, and we do not share it with third parties for their advertising.

9. International data transfers

9.1 Processing in the EU by default. Our servers are in Frankfurt, Germany. AI processing takes place in the EU for users in the EU and for users who have not answered the region question. Our optional analytics and error monitoring run in the EU.

9.2 Server function locations. Our server functions for AI requests run in EU locations. Our other server functions (for example the exchange of sign-in tokens with your mailbox provider, checkout, data export and one-click unsubscribe) run in the Supabase edge location closest to you, which can be outside the EU if you are outside Europe; they pass data through without storing it there, and the database stays in Frankfurt.

9.3 Providers outside the EU. Several of our providers are, or belong to, companies outside the EU: Microsoft, Google, Sentry (Functional Software, Inc.), PostHog, Cloudflare and Polar are headquartered in the United States, and our contract partner at Supabase is Supabase Pte. Ltd. in Singapore, part of a group that also includes Supabase, Inc. in the United States. Even where data is stored in the EU, these companies may access it from outside the EU for support or maintenance, and they may be subject to the laws of those countries. We protect such transfers as follows:

• Google, Microsoft, Cloudflare, Sentry and PostHog are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Commission Implementing Decision (EU) 2023/1795). Their data processing terms also include the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
• Supabase is not certified under the Data Privacy Framework, and Singapore has no adequacy decision. We rely on the Standard Contractual Clauses in Supabase's data processing agreement: Module 2 for data for which we are the controller, Module 3 for Customer Personal Data, with the addenda for the United Kingdom and Switzerland.

In addition, we limit what leaves your computer, host our database and our AI server functions in the EU, encrypt data in transit and at rest, and do not store the content of AI requests.

9.4 Users outside Europe. If you answered that you are based outside Europe, some of your AI requests are processed on Google's global endpoint, which may process data in any country where Google offers the model. These transfers are covered by Google's Cloud Data Processing Addendum, including Standard Contractual Clauses, and Google LLC's certification under the Data Privacy Framework.

9.5 Polar. Data we send to Polar is transferred to the United States. Polar is not certified under the Data Privacy Framework. Our agreement with Polar includes Polar's data processing addendum with the Standard Contractual Clauses. Where these do not cover a transfer, it is based on Article 49(1)(b) GDPR, because it is necessary for the purchase that you request.

9.6 Copies. You can request a copy of the safeguards we use by writing to legal@mailistix.com. For the United Kingdom and Switzerland, see sections 16.3 and 16.4.

9.7 Servers you choose to contact. When you load images in an email, open an unsubscribe page or unsubscribe with one click (sections 4.8 and 4.9), the request goes to the sender's server, wherever it is located, because you ask for it.

9.8 EU Data Act. Where the infrastructure of each part of the Service is located, which law it is subject to, and how we protect data held in the EU against unlawful access by foreign authorities is described on our Subprocessors page (section 4) and in Section 13 of the DPA.

10. How long we keep data

We keep personal data only as long as we need it for the purposes in section 4, and then delete it. When you delete your Account, server-side data linked to it is deleted at once, except where this table says otherwise. If your agreement ends in another way, for example by termination, your Account remains for a data-retrieval period of 30 days, in which you can export your data (if you cannot sign in, we send you the export file on request), and is then deleted in the same way (Terms, Section 15.10). In this table, "until your Account is deleted" covers both cases.

On our servers and at our providers

On your computer (under your control; deleted when you delete your Account on that computer)

We may keep data longer where the law requires it or where we need it to establish, exercise or defend legal claims, and only for that purpose.

11. How we protect your data

We use technical and organizational measures appropriate to the risk, including:

• encrypted connections (TLS 1.2 or 1.3) for all traffic; release versions of the App refuse to switch off certificate checks;
• an encrypted local database whose key is protected by your operating system, mailbox tokens in your operating system's secure storage, and encrypted caches for attachments;
• on our servers: row-level access rules on every table, so that each user can reach only their own records; short-lived sign-in tokens with rotating refresh tokens; rate limits; re-confirmation of your identity before deleting your Account; verification of the notifications we receive from Google, Microsoft and Polar; secrets kept in a protected vault; and logs without content or tokens;
• in the App: a content security policy, emails displayed in a sandbox without scripts, sanitized email HTML, and attachment previews without network access;
• protection of the AI Features against manipulation by email content (section 4.15);
• access to administrative consoles limited to the people who need it.

No system is completely secure. If a personal data breach is likely to result in a risk to you, we will inform the competent authorities and, where required, you, as the law requires.

12. Your rights and choices

12.1 Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict processing (Article 18);
• receive the data you provided to us in a structured, machine-readable format and have it transmitted to another provider (data portability, Article 20);
• object to processing based on legitimate interests (Article 21; see the box below);
• withdraw your consent at any time with effect for the future (Article 7(3)); and
• lodge a complaint with a supervisory authority (Article 77; section 12.6).

Your right to object (Article 21 GDPR)

Where we process your personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

We do not use your data for direct marketing, except for the email we send to the waitlist when the beta is ready; it rests on your consent (section 4.18). If we ever use your data for other direct marketing, you can object at any time without giving reasons, and we will stop.

To object, write to legal@mailistix.com.

12.2 Controls in the App

12.3 Exercising your rights by email

You can exercise all rights by writing to legal@mailistix.com from the email address of your Account (for the waitlist: the address you joined with). If we cannot be sure that a request comes from you, we may ask you to confirm it, for example by signing in to the App. We answer within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

12.4 Deleting your Account

The deletion takes effect at once, so the App offers Export data in the same dialog first. To delete your Account, you must have signed in within the last 10 minutes and type DELETE to confirm. If a paid subscription could still charge you, the App first asks you to cancel it. When you delete your Account, our server deletes your support uploads, your analytics data at PostHog, your notification and quota records, your Polar customer record if you never bought anything, and then your Account with all data linked to it, including your consent records; a copy of your acceptance of the Terms and the DPA stays without your email address (section 10). If your agreement ends in another way, the same deletion follows after the 30-day data-retrieval period (section 10; Terms, Section 15.10). Some records remain for a limited time (section 10): the copy of your acceptance records until 1 January of the fourth year after the deletion, the mailbox fingerprints for 12 months, security events for up to 180 days without your user ID, entries in the log of our authentication service for up to 180 days, and Polar's notifications for up to 30 days after processing. Polar keeps its own records of purchases (section 4.10). If you cannot use the App, you can ask us by email to delete your Account; after confirming that the request comes from you, we run the same deletion on our servers, but we cannot reach the data on your computer or revoke the Google or Microsoft permission for you (sections 5.7 and 6.3). On the computer where you delete your Account, the App also stops real-time notifications, revokes Mailistix's access to your Google mailboxes and deletes all local data of your Account. On other computers where you used the App, you are signed out, but the local data stays until you delete the App's data folder there (section 4.4); Settings › General › Danger Zone › Clear All Emails removes the stored emails.

12.5 Data we cannot reach

Your emails and other data on your computer are not on our servers, so we cannot access, correct, export or delete them for you; you can do this yourself in the App. Your mailbox itself stays with your mailbox provider, and you can export it there.

12.6 Complaints

You can complain to the data protection supervisory authority in the EU or EEA country where you live or work or where an alleged infringement took place. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de. We would be grateful if you contacted us first, so that we can try to resolve the matter.

12.7 Data we process for a Business Customer

For Customer Personal Data (section 2.3), the Business Customer is the controller, and requests to exercise your rights should go to it. If you send such a request to us, we pass it on to the Business Customer without undue delay where we can identify it, tell you that we have done so, and help the Business Customer to answer. The controls in section 12.2 remain available to you as a user.

13. Is providing your data required?

You are not legally obliged to provide any personal data to us. However:

• your email address and the sign-in codes we email to it are required to create and use an Account;
• connecting a mailbox is required to use Mailistix as an email client;
• the App asks everyone where they are based during setup; until you answer, AI processing stays in the EU;
• a paid Plan requires the payment details that Polar asks for;
• the contact form requires your name, email address and message, your confirmation that you have read this policy and your consent to Google reCAPTCHA; without them, you can email us instead;
• the waitlist requires your email address, your platform, your confirmation that you have read this policy and your consent to the use of your address and to Google reCAPTCHA; without them, you can email us instead; and
• the AI Features, the calendar permission, analytics, crash reports and diagnostic logs are optional. Without them, the corresponding features are not available, but you can use the rest of the Service.

14. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The Service applies technical rules that follow from your Plan and the Terms, such as Credit limits, a daily AI cost limit, rate limits and the move to the Basic Plan after an unpaid subscription; these are not based on an evaluation of your personal aspects. A note that a mailbox was connected by several Accounts (section 4.15) does not lead to any automatic measure. AI Output consists of suggestions that you decide whether to use.

15. Children

Mailistix is intended only for people aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe that a child has given us personal data, please contact legal@mailistix.com, and we will delete it.

16. Regional supplements

The following sections apply in addition to the rest of this policy to people in the regions named. If they conflict with the rest of this policy, the regional section prevails for that region. In every region, we process Customer Personal Data (section 2.3) as a service provider or processor for the Business Customer, which is responsible for it under the local law; the rights described below then apply against the Business Customer, and we support it as described in section 12.7.

16.1 United States

16.1.1 Notice at collection (California). This notice applies to residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). The CCPA also protects individuals who act for a business, such as our users. We may not currently meet the CCPA's applicability thresholds (for example, annual gross revenue above USD 26,625,000 for 2025 and 2026), but we honor the rights below for all US residents. In the last 12 months we collected the following categories of personal information. Data that stays only on your computer is not collected by us. Where we process personal information on behalf of a Business Customer (section 2.3), we act as its service provider under Section 16 of the DPA.

We do not collect biometric information, precise geolocation, or professional, employment or education information as such; such information may appear in emails you process with AI Features and is then handled as contents of email.

16.1.2 No sale, no sharing, no targeted advertising. We do not sell or share personal information (as those terms are defined in the CCPA), have not done so in the last 12 months, and do not use it for cross-context behavioral or targeted advertising. We have no actual knowledge of selling or sharing personal information of consumers under 16. Because we do not sell or share, we do not offer a "Do Not Sell or Share" link; we nevertheless treat a Global Privacy Control signal as a valid request to opt out of sale and sharing.

16.1.3 Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under Cal. Code Regs. tit. 11, § 7027(m), such as providing the Service you request and ensuring security and integrity. We do not use it to infer characteristics about you.

16.1.4 Your rights. You have the right to: know what personal information we collect, use and disclose and to access it; delete it; correct inaccurate personal information; opt out of sale or sharing (not applicable, as we do not sell or share); limit the use of sensitive personal information (not applicable, see above); and not be discriminated against for exercising your rights. Use the controls in section 12.2 or write to legal@mailistix.com. We confirm receipt within 10 business days and respond within 45 calendar days, which we may extend once by 45 days with notice. We verify requests by matching them to your Account, for example by asking you to sign in to the App.

16.1.5 Authorized agents. You may use an authorized agent. We will ask the agent for your signed permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

16.1.6 Non-discrimination. We will not deny you the Service, charge you a different price or provide a different quality of service because you exercised your privacy rights.

16.1.7 Other disclosures. We do not disclose personal information to third parties for their direct marketing purposes (Cal. Civ. Code § 1798.83). We do not track you across third-party websites, so browser "Do Not Track" signals do not change how we operate.

16.1.8 Other US states. The comprehensive privacy laws of other states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, generally do not protect individuals acting in a commercial or employment context, which is how Mailistix is used, and apply only above thresholds that we may not meet. Where such a law applies to you, you may have the right to confirm whether we process their personal data, to access, correct and delete it, to obtain a portable copy, and to opt out of targeted advertising, sale and profiling with legal or similarly significant effects. We do not engage in targeted advertising, sale or such profiling. To exercise your rights, use the controls in section 12.2 or write to legal@mailistix.com. We respond within 45 days, which we may extend once by 45 days where the law allows.

Appeals. If we decline to act on your request, you may appeal by writing to legal@mailistix.com with the subject "Privacy appeal" within a reasonable time after our decision. We will respond within the period your state's law requires (generally 45 or 60 days) and explain our decision. If you are not satisfied, you may contact your state's Attorney General.

16.1.9 Nevada. We do not sell covered information as defined in Nevada law (NRS 603A). You may nevertheless send an opt-out request to legal@mailistix.com.

16.2 Canada

16.2.1 PIPEDA. We handle the personal information of people in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. By using the Service you consent to the processing described in this policy; you can withdraw consent at any time, subject to legal or contractual restrictions, and we will tell you what that means for the Service. You can access and correct your personal information as described in section 12. Your personal information is processed outside Canada, mainly in the EU and, through the providers named in section 8, possibly in the United States and, for users outside the EU, other countries where Google operates. It may then be accessible to courts and authorities of those countries. Where we process personal information for a Business Customer (section 2.3), that customer remains accountable for it, and we use it only to provide the Service to that customer. You can contact us about privacy at legal@mailistix.com and complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

16.2.2 Quebec. The person in charge of the protection of personal information is our managing director, Marvin Muvunyi, reachable at legal@mailistix.com. Under Quebec's Act respecting the protection of personal information in the private sector, you have the right to access and correct your personal information, to withdraw your consent, to receive computerized personal information you provided in a structured, commonly used technological format (portability), and to ask us to stop disseminating your personal information or to de-index any hyperlink attached to your name where the legal conditions are met. Mailistix does not use technology that identifies, locates or profiles you by default: optional analytics are off unless you switch them on, and we do not collect your location. Before communicating personal information outside Quebec, we assess whether it will receive adequate protection. You may file a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca). We do not yet offer the Service in Quebec (Terms, Part II, Section D.1); before we do, we will provide this policy in French. Until then, this section applies mainly to people in Quebec who correspond with Mailistix users (section 7).

16.3 United Kingdom

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, apply, and references to the GDPR in this policy mean the UK GDPR. You have the rights described in section 12. You can complain to us about our use of your personal data by writing to legal@mailistix.com; we will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk). Transfers of your data to the EU rely on the UK's adequacy regulations for the EEA; transfers to the United States rely on the UK Extension to the EU-U.S. Data Privacy Framework where the recipient is certified, and transfers to the United States, Singapore or other countries otherwise rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses or the International Data Transfer Agreement. In the region question, people in the UK answer "In Europe"; their AI requests are then processed in the EU (section 4.6.4). We have not yet appointed a representative in the UK under Article 27 UK GDPR; we will appoint one before we actively offer the Service in the UK.

16.4 Switzerland

If you are in Switzerland, the Federal Act on Data Protection (revFADP) applies. You have the rights to information, access, correction, deletion, objection and data portability, and you can complain to the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch). Your data is processed mainly in the EU, whose countries Switzerland recognizes as providing adequate protection; transfers to the United States rely on the Swiss-U.S. Data Privacy Framework where the recipient is certified, and transfers to the United States, Singapore or other countries otherwise rely on the EU Standard Contractual Clauses with the amendments required for Switzerland. In the region question, people in Switzerland answer "In Europe"; their AI requests are then processed in the EU (section 4.6.4).

16.5 Brazil

If you are in Brazil, the General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law No. 13,709/2018) applies. We rely on the legal bases of performance of a contract, legitimate interests, compliance with legal obligations and consent, as described in section 4. Under Article 18 LGPD you have the right to confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about the entities with which we share data and about the possibility of not giving consent and its consequences, and revocation of consent. You can also petition the National Data Protection Authority (ANPD, www.gov.br/anpd). International transfers rely on the safeguards in section 9 and, where required, on the standard contractual clauses approved by the ANPD. Our data protection contact (encarregado) is our managing director, Marvin Muvunyi, reachable at legal@mailistix.com.

16.6 Australia

If you are in Australia, we handle your personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). We disclose personal information to recipients outside Australia: in the EU (Germany, Sweden and other EU countries), in Singapore and the United States and, if you answered that you are based outside Europe, in other countries where Google operates (sections 8 and 9). You can access and correct your personal information as described in section 12. If you have a complaint, please contact us first; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (www.oaic.gov.au).

16.7 New Zealand

If you are in New Zealand, the Privacy Act 2020 applies. You have the right to access and request correction of your personal information. We disclose personal information to recipients outside New Zealand as described in sections 8 and 9, under contractual safeguards that require comparable protection. If someone who writes to you uses Mailistix, section 7 describes how your information is handled. You can complain to the Office of the Privacy Commissioner (www.privacy.org.nz).

16.8 Japan

If you are in Japan, the Act on the Protection of Personal Information (APPI) applies. We provide personal data to recipients in foreign countries as described in sections 8 and 9: in the EU, which the Personal Information Protection Commission recognizes as having a system for protecting personal information equivalent to Japan's; in the United States, which has no comprehensive federal privacy law, and in Singapore, which has the Personal Data Protection Act 2012; in both, our recipients are bound by contracts to protect the data in line with the APPI's principles; and, for users who answered that they are outside the EU, in other countries where Google operates. Our security control measures are described in section 11. You may request disclosure (including records of provision to third parties), correction, suspension of use, erasure and cessation of provision to third parties by writing to legal@mailistix.com. For our name, address and representative, see section 1.

16.9 South Korea

If you are in the Republic of Korea, the Personal Information Protection Act (PIPA) applies. The purposes, items, retention periods and processors are described in sections 4, 8 and 10. Overseas transfers: your personal information is transferred over the network, when you use the Service, to the recipients and countries listed in section 8 (Germany and other EU countries; Singapore and the United States; and, for users who answered that they are outside the EU, other countries where Google operates), for the purposes and retention periods stated in sections 4, 8 and 10. The recipients' names are listed in section 8 and on our Subprocessors page; you can reach them through us at legal@mailistix.com. You can refuse an overseas transfer by not using the feature concerned (for example the AI Features or optional analytics) or by deleting your Account; the core email client may then not be available. Destruction: when the retention period ends, we delete electronic files so that they cannot be restored. You can exercise your rights to access, correction, deletion and suspension of processing as described in section 12. Our privacy officer is our managing director, Marvin Muvunyi, reachable at legal@mailistix.com. You can also contact the Personal Information Protection Commission's dispute mediation committee (www.kopico.go.kr) or the KISA Privacy Infringement Report Center (privacy.kisa.or.kr, phone 118).

16.10 India

If you are in India, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 apply as they come into force. This policy is our notice of the personal data we process and its purposes (section 4). Where we rely on your consent, you can withdraw it as easily as you gave it (section 12.2); where you provide data voluntarily for a specified purpose, such as creating an Account, we process it for that purpose. You have the right to access information about your personal data, to correct, complete, update and erase it, to nominate another person to exercise your rights in case of death or incapacity, and to grievance redressal. Please send grievances to our managing director, Marvin Muvunyi, at legal@mailistix.com; we respond within the period the Digital Personal Data Protection Rules set, at most 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

16.11 Singapore

If you are in Singapore, the Personal Data Protection Act 2012 (PDPA) applies. You can request access to and correction of your personal data and withdraw your consent by giving us reasonable notice; we will tell you the likely consequences of withdrawal. When we transfer personal data outside Singapore, we ensure through contracts that recipients provide protection comparable to the PDPA. The person responsible for our compliance with the PDPA is our managing director, Marvin Muvunyi, reachable at legal@mailistix.com. You can also complain to the Personal Data Protection Commission (www.pdpc.gov.sg).

16.12 South Africa

If you are in South Africa, the Protection of Personal Information Act, 2013 (POPIA) applies. You have the right to access, correct and delete your personal information, to object to processing on reasonable grounds, and to complain to the Information Regulator (inforegulator.org.za). We transfer personal information outside South Africa only under the safeguards described in section 9, which provide protection substantially similar to POPIA. Our information officer is our managing director, Marvin Muvunyi, reachable at legal@mailistix.com.

16.13 Türkiye

If you are in Türkiye, the Personal Data Protection Law No. 6698 (KVKK) applies. We are the data controller for the processing described in section 2.2; for Customer Personal Data (section 2.3), the Business Customer is the data controller and we are its data processor. We process your personal data for the purposes in section 4, based on the performance of a contract, our legitimate interests, compliance with legal obligations and, where required, your explicit consent (Article 5 KVKK). We transfer personal data abroad (section 9) on the basis of the safeguards permitted by Article 9 KVKK. Under Article 11 KVKK you have the right to learn whether your data is processed and to request information about it, to learn the purpose of processing, to know the recipients in Türkiye and abroad, to request correction and deletion and the notification of these to recipients, to object to a result against you arising exclusively from automated analysis, and to claim compensation for damage caused by unlawful processing. Send applications to legal@mailistix.com; if we reject your application or do not respond within 30 days, you may complain to the Personal Data Protection Board.

17. Changes to this policy

We update this policy when the Service or the law changes. The version number and the date from which it applies are at the top, and earlier versions remain available on our website. We will inform you of material changes in the App or by email at least 30 days before they take effect. Where a change requires your consent, we will ask for it.

18. Contact

Mailistix UG (haftungsbeschränkt)
Kolonnenstr. 8
10827 Berlin
Germany
Privacy and legal: legal@mailistix.com

Related documents: Terms of Service · Software License Agreement · AI Features Notice · Subprocessors · Data Processing Agreement