Privacy Policy

Last updated: 22 October 2026

Short version: we read your new emails only to pick a category, using open-weight AI models we host ourselves. Email content is processed in memory and never stored. We keep sender, subject, category and confidence for 30 days so you can see what happened. On every plan, including the free trial, so you can handle your mail in MailTag, we also keep an index of your emails (who, to whom, subject, date, state and folder, never their text or attachments) while the mailbox is connected. We never permanently delete your email, we send only what you send from MailTag, or an AI agent you allowed to, and we don't sell data.

1. Who we are (data controller)

MailTag is operated by Lucas García de Viedma Pérez, a sole trader (NIF 09105953T), Avenida de Castilla 6, 5.º B, 28804 Alcalá de Henares (Madrid), Spain, who is the data controller for personal data processed through mailtag.app. Contact: support@mailtag.app. We are established in the EU, so no EU representative is required, and given the nature and scale of our processing we have not appointed a data protection officer; write to the address above for anything about your data.

2. What we collect

Account data: email address, hashed password, plan and trial status, when you last used MailTag, account settings and your custom categories.
Mailbox connection data: IMAP host, username and app password. App passwords are encrypted at rest with AES-256-GCM.
Email content (transient): to classify a message we fetch its sender, subject and body text. This content is processed in memory and discarded immediately after classification. It is not written to our database or logs.
Reading and sending in MailTag (paid plans): when you open an email in MailTag we fetch it, with its attachments, from your mailbox and show it to you; it is not stored, and, as in any mail app, opening it marks it as read in your mailbox. Images from the internet stay blocked until you choose to show them, and we remember the senders whose images you always want to see. Email you write is put together in memory and sent from your mailbox through your provider's server. While you write it, it is saved in your mailbox's Drafts; once sent, a copy goes to your Sent folder. If you undo a send or it can't be sent, we keep it in memory for up to an hour so you can reopen it. For the daily sending limits we keep only, for 30 days, when each email was sent, from which mailbox, to how many people and, if an agent sent it, which agent; never the addresses or the content. When an agent writes a draft, we keep for 30 days which agent wrote it and for which email (the draft itself is in your mailbox).
Mail index (every plan, including the free trial): so MailTag can show your whole mailbox, search it and keep it up to date in seconds, we keep, for each email in your inbox and your mailbox's main folders (the most recent ones of each), the sender, the recipients, the subject, the date, the size, whether it is read, answered or has attachments, the folder or labels it is in, its Message-ID and the category MailTag gave it. Never its text or its attachments: those are read from your mailbox each time you open the email. To keep it current, MailTag keeps a connection open to your mailbox that listens for changes and, when new mail arrives, labels it right away. What you do in MailTag (archive, move to spam or to your mailbox's trash, mark as read or unread, change a label) is done in your mailbox, so every app you use sees it.
Activity log: for each processed email we store sender, subject, assigned category and confidence score, plus its Message-ID and mailbox position and whether it is read, replied or no longer in the inbox (so you can open it and see what's pending), for 30 days.
Inbox analysis: when you run the inbox analysis we read message headers only (sender, unsubscribe headers and read status — never bodies or subjects) and store, per bulk sender (senders whose mail carries an unsubscribe header), the address, display name and message counts. Personal senders are not stored.
One-time tidy-ups: when you buy a tidy-up we read the past emails of the date range you choose, exactly as we read new emails (headers and the beginning of the text, in memory, never attachments). We keep only the date range, the number of emails and the number per category. The list of message identifiers is deleted when the tidy-up ends. The free trial tidy-up works the same way on your 50 newest emails of the range.
Email index (Insights): for each email we see, its date, sender address and display name, the category MailTag assigned and its Message-ID (so you can open it from the sender's history), so we can show your email volume and distributions over time. Never subjects or content.
Unsubscribe links and sender rules: the unsubscribe link of each bulk sender (encrypted, as it may contain a personal token), the actions you take (unsubscribe, archive, spam, label) and the sender rules you create.
Webhook and API data: webhook URLs and signing secrets you configure, and API keys (Business). Content you send to the triage API is processed in memory and not stored.
Safety check: if you turn it on in your settings: for each new email, a level (safe, doubtful or dangerous), a score and short reason codes (for example “lookalike domain”), worked out on our own servers from the sender's authentication headers, the links and the text. We keep the result, never the text it was based on.
Connected AI agents: the agents you connect (for example Claude or ChatGPT), what you allowed each one to see and do, when it was last used, and a log of which tools it called and how many emails it got back (kept 90 days, never the emails or the questions). Sign-in tokens and agent keys are stored only as hashes.
Browser extension (Lite, Pro and Business): if you install the MailTag extension for Chrome or Edge and connect it, we keep that connection like an agent's: what you allowed it to see, when it was last used, and its sign-in tokens, stored only as hashes. We don't log what it asks for.
Help & contact messages: the messages you send us from Help & contact and our replies, the topic you pick, the MailTag page you wrote from, your browser and system name (for example, “Chrome on macOS”) and your plan at that moment. They stay inside MailTag: we don't send them by email.
Billing data: handled by Stripe. We receive a customer ID, subscription status and limited card details (brand, last four digits); we never see full card numbers.
Technical data: we keep no access logs. Your IP address is held in memory only, for up to one hour, to limit repeated sign-up, login and password-reset attempts. Application logs record technical events (for example, that a mailbox sync failed), never email content or IP addresses, and are overwritten automatically as they rotate.

3. How we use it and our lawful basis (GDPR Art. 6)

Providing the Service — connecting to your mailbox, classifying emails, applying labels, sending webhooks, showing your activity log: performance of a contract (Art. 6(1)(b)).
Billing and accounting: performance of a contract and legal obligation (Art. 6(1)(c)) for tax records.
Support — answering your messages and fixing problems with your account: performance of a contract. To help you we can see your account data and counts (plan and amounts paid, your mailbox addresses and their connection status or error, how many categories and rules you have, how many emails were labeled), never the content, subjects or senders of your emails. We keep a record of when we open your account and what we do on it (for example, extending your trial).
Security, abuse prevention and debugging: legitimate interests (Art. 6(1)(f)) in keeping the Service safe and working.
Service emails (billing, security notices, and the notice a week before mailbox credentials are deleted; the reminder before your free trial ends is sent by Stripe): performance of a contract. We only send marketing emails with your consent (Art. 6(1)(a)), which you can withdraw anytime.

Emails in your mailbox may contain personal data of third parties (your correspondents). We process that data only on your instructions and only to classify the message; for that processing you act as controller and we act as your processor. If you need a data processing agreement (Art. 28 GDPR), write to support@mailtag.app and we will send you ours to sign.

4. AI processing

Classification runs on open-weight language models hosted on our own infrastructure. Your email is not sent to OpenAI, Google, Anthropic or any other third-party AI provider, and it is not used to train models. Classification is automated but produces only a label in your own mailbox; it has no legal or similarly significant effect on you.

5. What we never do

We never permanently delete email: what you move to the trash in MailTag goes to your mailbox's own trash, which your provider empties on its own schedule. We never send email from your mailbox unless you send it from MailTag, or an AI agent you allowed sends it.
We never sell or rent personal data, and we don't use it for advertising.
We never store email bodies.

6. Subprocessors

Your email content is never shared with any third party. We use only the infrastructure providers needed to run the Service, none of which receive the content of your emails:

Hetzner Online GmbH (Germany) — servers we operate for the application, database and AI model inference. Email content is processed only on these servers, in the EU.
Stripe — payment processing and merchant of record for subscriptions. Receives billing details only (privacy policy).
Cloudflare, Inc. — DNS for mailtag.app and forwarding of messages you send to our support addresses. Does not proxy the Service or see your mailbox data.
Resend — delivery of account emails such as password resets. Receives your account email address only.

We do not use any external AI provider, analytics, advertising, tracking or data-broker services, and we load no third-party resources (including fonts) on our pages.

Webhook destinations (e.g. Slack, Discord, Zapier, Make, n8n) are chosen and configured by you; data you route there is governed by those services' policies.

AI agents you connect (for example Claude, ChatGPT or Cursor) are also chosen by you, and receive only what you allow each one: an email's category, date, mailbox, safety check, Message-ID and a link to open it, only for the emails you choose (all, some categories or some saved views, and how far back) and, if you allow it, the sender's domain or name and address, the subject, and whether it is read, answered or done. On every plan, and only if you allow it, an agent can also read an email's text and open its attachments (fetched from your mailbox when it asks, not kept by MailTag), write drafts into your mailbox's Drafts, and send email from your mailbox within the limits you set (replies only or new email too, to whom, and how many a day). It also sees the names and descriptions of the categories and saved views it can use. If you allow it, an agent can also move emails between your categories and create or change categories and saved views; it can never delete email. You can change or remove any agent's access at any time in Settings → Agents. What the agent's provider does with that information is governed by its own policies.

The MailTag browser extension is ours and talks only to mailtag.app. In your browser it shows the saved views you choose and how many emails each has, with, for each email and depending on what you allow when you connect it, the sender, the subject, the category, whether it is read and its safety check — never the text of an email or attachments. It keeps its sign-in and the last list it showed in your browser's storage until you sign it out, and it only reads; it can't change anything in your mailbox. You can sign it out from the extension or disconnect it in Settings → Agents at any time.

7. International transfers

Where personal data is transferred outside the EEA/UK (for example to Stripe in the United States), we rely on adequacy decisions or Standard Contractual Clauses as appropriate.

8. Retention

Email content: not retained; discarded right after classification.
Activity log (sender, subject, category, confidence, Message-ID, read/replied state): automatically deleted after 30 days.
Inbox analysis (per-bulk-sender counts and your actions): automatically deleted after 30 days. Unsubscribe links: deleted after 7 days, or as soon as they are used.
Sender rules: until you delete them or your account.
Mail index (every plan, including the free trial): kept while the mailbox is connected and your plan includes reading mail in MailTag; deleted at once when you remove or pause the mailbox or delete your account, and within a minute when your plan no longer includes it. An email deleted or moved out of the indexed folders leaves the index at the next check: within seconds for the inbox, within half an hour for other folders.
Free-trial record: one-way fingerprints of your email address and of the mailbox addresses you connect (not the addresses themselves), and the fingerprint Stripe gives your card (not the card), kept after your account is deleted, only so the free trial and the free tidy-up are given once.
Email index (Insights): automatically deleted after 12 months, or when you remove the mailbox or delete your account.
Mailbox credentials: until you remove the mailbox or delete your account. If your account has no plan (the free trial was cancelled or the subscription ended), they are deleted after 90 days without a plan; we email you a week before. If you connect a mailbox and never add a card, its password or token is deleted 48 hours after connecting it, with anything else we kept about it. For a Microsoft mailbox we delete our token; you can also remove MailTag from your Microsoft account's permissions.
Account data: for as long as your account exists.
Help & contact messages and the record of when we opened your account and what we did on it: for as long as your account exists; deleted with it.
Billing records: as long as required by tax law (currently 6 years under Spanish commercial and tax law).

9. Account deletion

You can delete your account at any time from your account settings. When you do, we delete your account data, stored mailbox credentials, categories, webhooks, API keys and activity log immediately from the live database, and from our backups within 14 days, when the oldest backup is overwritten, except billing records we must keep by law and the free-trial record (a one-way fingerprint of your address, not the address). Your emails and any labels already applied remain in your mailbox, unless you choose to have MailTag's labels removed first: in that case we use your stored credentials one last time to remove MailTag's labels, keywords and folders (no email is deleted), and then delete everything as above. While that runs, usually a few minutes and at most one day, you can't sign in. You can also revoke our access at any time by deleting the app password in your email provider's settings.

10. Security

App passwords are encrypted at rest with AES-256-GCM, all traffic uses TLS, and webhook deliveries are signed with HMAC-SHA256. Access to production systems is restricted to the operator.

11. Your rights

Depending on where you live (including under the GDPR and UK GDPR), you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, email support@mailtag.app; we respond within 30 days. You also have the right to lodge a complaint with your local data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es).

California and other US state residents

If you live in California (CCPA/CPRA) or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights. The categories we collect are listed in section 2 and are used only to provide the Service. We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the Service. To make a request, email support@mailtag.app; we will verify it against your account email and respond within 45 days.

12. Cookies

We use only strictly necessary cookies to keep you logged in and protect forms against CSRF. We don't use advertising or third-party tracking cookies.

13. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their data.

14. Changes

We will post any changes on this page and update the date above. For material changes we will notify you by email before they take effect.

15. Contact

Lucas García de Viedma Pérez
NIF: 09105953T
Avenida de Castilla 6, 5.º B, 28804 Alcalá de Henares (Madrid), Spain
Email: support@mailtag.app