Privacy Policy

Nexamail is built around a simple idea: your inbox belongs to you. This page explains what we collect, what we never collect, how we process it, and the rights you can exercise at any moment.

Data controller

AE TECHNOLOGIES GROUP LTD, a company registered in England and Wales under company number 17419062, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, operates Nexamail and acts as the data controller for the personal information you provide to create and operate your account, and for the metadata generated as you use the service. For any data protection question, contact privacy@nexamail.ai.

Data we collect

• Account details — name, email address, plan, region, language and preferences. Passwords are handled by our authentication provider and stored only as hashes; we never see them.
• Authentication data — OAuth access and refresh tokens for connected mailboxes (Google/Gmail, Microsoft/Outlook), kept server-side.
• Mailbox data — see the Google user data section below. In short: sender, recipients, subject, timestamps, thread and message identifiers, labels/folders, read state, and a short snippet or preview of the message are stored so your inbox, follow-ups and reminders can be rendered. Full message bodies and attachments are fetched from your provider on demand when you open or act on a message, and are not stored as a permanent copy.
• AI content — assistant conversations, generated drafts, summaries, triage results, subscription/scam analysis output, and any images you attach to an assistant conversation.
• AI memory — only if you enable it. You can clear it any time from Settings → Privacy.
• Billing metadata — plan, subscription status, renewal period, and the customer/subscription reference from Stripe (web) or RevenueCat/Google Play (Android). We never see or store your card details.
• Product analytics — pseudonymised event records (event name, platform, day, a salted per-day hash, and non-identifying properties) used to understand feature usage. Fields that look like emails, tokens, phone numbers or addresses are stripped before storage.
• Device data — platform (web/Android/iOS) and, if you enable push notifications, a push token for your device.
• Operational logs — request IDs, error traces, delivery logs for transactional email, and security signals needed to keep the service reliable and safe.

Data we never collect

• Your Gmail, Outlook, or any other provider password.
• Your card or bank details — these go directly to Stripe or Google Play.
• Advertising profiles, behavioural tracking for ads, or cross-site fingerprinting.
• Sensitive categories of data we do not need to operate the service.

Google user data & Limited Use

If you connect a Google account, Nexamail requests only the scopes it needs to work. Today those are:

• Email address and basic profile (userinfo.email, userinfo.profile) — to identify the connected mailbox and show it in the app.
• Read Gmail (gmail.readonly) — to list and display your messages, generate summaries, triage, follow-ups, scam checks and subscription detection.
• Modify Gmail (gmail.modify) — to apply the changes you ask for, such as marking read/unread, archiving, or changing labels. This scope is never used to delete mail on your behalf.
• Send Gmail (gmail.send) — used only when you press Send on a message or reply you have reviewed.

Nexamail does not request Google Calendar or Google Drive access. Calendar features on Google accounts are built from your email content and anything you add manually; Microsoft accounts additionally grant calendar read access if you connect Outlook.

Use of Google user data. Google user data is used solely to provide and improve the user-facing features described above. Nexamail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google user data for advertising, ad targeting, or to build advertising profiles.
• We do not sell Google user data, and we do not transfer it to third parties except to the service providers listed below who process it on our instructions to deliver the features you use, or where required by law or with your explicit consent.
• We do not allow humans to read your Gmail data, except where you explicitly ask us to (for example when you send us a support request containing a message), where required by law, for security investigations or abuse prevention, or where the data has been aggregated and de-identified.
• We do not use Google user data to develop, improve, or train generalised or general-purpose AI models, and we do not use it to train any model of our own. Where AI features process your mail, that content is sent to our AI processors only to produce the output you asked for, and is handled under those providers' API terms.

Disconnecting Google. You can disconnect at any time from Settings → Connections inside Nexamail. Disconnecting revokes the Google grant, deletes the stored tokens, and permanently deletes the synced Gmail data Nexamail held for that mailbox (see Disconnecting a mailbox). You can also revoke Nexamail independently at myaccount.google.com/permissions. Deleting your Nexamail account removes the connection and the mailbox data we hold (see Deleting your account).

Legal bases for processing

We process your personal data under one or more of the following lawful bases under UK GDPR and EU GDPR:

• Performance of a contract — to provide the Nexamail service you signed up for, including mailbox sync, AI features, and billing.
• Legitimate interests — to keep the service secure and reliable, prevent abuse, and understand aggregate product usage, balanced against your rights and expectations.
• Legal obligations — to comply with applicable laws, tax, and regulatory requirements.
• Consent — where required, for optional features such as AI memory, push notifications, marketing communications, or non-essential cookies. Consent can be withdrawn at any time.

How AI processing works

Nexamail uses AI to draft replies, summarise threads, triage and prioritise mail, detect follow-ups and subscriptions, check for scams, and power the in-app assistant. AI runs on content you have already surfaced in Nexamail.

• Who processes it. User-facing AI features (assistant, drafting, summaries, memory) are processed by OpenAI. Email classification and triage, and some support workflows, are processed by Google Gemini models accessed through the Lovable AI Gateway.
• What can be sent. Depending on the feature: sender and recipient details, subject lines, message snippets or full message text of the email in question, thread history you have open, your assistant prompts, any images you attach to an assistant conversation, and your saved AI memory and preferences. Attachment contents are only processed if a feature you invoke requires them.
• Why. Solely to produce the output you requested — the reply, summary, classification, or answer.
• Retention at the provider. Prompts are processed transiently to return a result. Our AI providers may retain request data for a limited period for abuse monitoring under their standard terms; they are contractually prohibited from using it to train their models.
• No model training. Your content is not used to train OpenAI's, Google's, or anyone else's general-purpose models, is never blended into a shared training corpus, and is never shown to other Nexamail users.
• Human approval. Nothing is sent, cancelled, scheduled, or accepted on your behalf without your explicit approval.
• Accuracy. AI output can be wrong or incomplete. Always review it before acting on it.

Outputs we store (drafts, summaries, classifications, assistant history, memory) live in your account and can be deleted from Settings → Privacy or by deleting your account.

AI Scam Checker

Nexamail's Scam Checker analyses the content of emails selected by the user to identify potential phishing attempts, impersonation, malicious links, suspicious attachments, and other indicators of fraud.

Scam analysis is provided to assist users in identifying potential risks and should not be relied upon as a guarantee that an email is safe or malicious.

Users remain responsible for making their own decisions before clicking links, downloading attachments, sending money, or sharing personal information.

Nexamail does not automatically delete, block, quarantine, or report emails without user action.

Subscription Management

Nexamail may identify recurring subscriptions, memberships, free trials, newsletters, and renewal emails by analysing email metadata and content within connected mailboxes.

Subscription detection is intended to help organise emails and provide reminders. Detection may not always be accurate and users should verify subscription details before relying on them.

Users may also manually create subscription entries. Future emails from associated senders may be linked to those subscriptions to improve organisation.

Nexamail does not automatically cancel subscriptions, unsubscribe users, or make payments on their behalf.

Third-party processors

We rely on a small set of service providers. Each processes data under contract and only for the purposes listed:

• Supabase — managed database, authentication, and file storage (the primary store for your Nexamail data).
• Cloudflare — application hosting, edge delivery, DDoS protection, and DNS.
• Google (Gmail / Microsoft Graph is separate) — your connected mailbox provider, accessed on your behalf via OAuth.
• Microsoft — Outlook mailbox and calendar access, if you connect a Microsoft account.
• OpenAI — AI inference for the assistant, drafting, summarisation, and memory. Content is sent through the OpenAI API solely to return your result; we do not enrol in any programme that would allow training on it.
• Google AI (Gemini) via the Lovable AI Gateway — AI inference for email classification, triage, and related workflows. Content is sent solely to return the classification result.
• Stripe — subscription billing for web purchases (PCI-DSS Level 1). We never see your card details.
• Google Play Billing — payment processing for purchases made inside the Android app.
• RevenueCat — subscription and entitlement management for Android purchases. RevenueCat receives your Nexamail user identifier, purchase and receipt data from Google Play, and device/platform information. It does not receive your mailbox content.
• Lovable email delivery — transactional email (verification, password reset, account and billing notices).
• Google Firebase Cloud Messaging — delivery of push notifications, if you enable them on a mobile device.

Cookies & local storage

This section is our cookie policy. Nexamail (operated by AE TECHNOLOGIES GROUP LTD) uses only essential cookies and browser storage. There are no advertising cookies, no cross-site trackers, and no third-party ad networks.

• Authentication — your signed-in session is kept in browser storage by our authentication provider so you stay logged in.
• Preferences — theme, language, dismissed banners, and your cookie choice are stored locally on your device.
• Product analytics — a random per-day identifier used to count events; it contains no personal data and is re-hashed server-side.

You can clear this at any time by clearing your browser storage or signing out. Because we set no advertising or tracking cookies, no consent is required for the essential items above; the in-app notice simply tells you what we use.

International data transfers

Some of our processors operate internationally, including in the United States. Where personal data leaves the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum. Providers are contractually required to protect your data to a standard equivalent to UK and EU data protection law.

Security measures

• Encryption — TLS in transit and encryption at rest across our database and storage.
• Access controls — role-based access with least-privilege principles across all internal systems.
• Secure credential handling — OAuth tokens are stored server-side and never exposed to client code.
• Monitoring — continuous monitoring for abuse, suspicious access, and service degradation.
• Row-level security — database tables enforce per-user isolation at the database layer, not just the API.

A deeper technical write-up lives on our Security page.

Your rights

Under UK GDPR, EU GDPR, and equivalent privacy laws (including CCPA), you can exercise the following rights at any time:

• Access — see what personal data we hold about you.
• Correction — update inaccurate or incomplete information.
• Deletion — request erasure of your personal data.
• Portability — receive a copy of your data in a portable format.
• Objection — object to processing carried out under legitimate interests.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Complain — you can lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.

Most rights can be exercised directly from Settings → Privacy. For anything else, email privacy@nexamail.ai and we will respond within 30 days.

Automated decision-making

Nexamail uses AI to prioritise, classify, and make suggestions about your mail. These are assistive suggestions only — they do not produce legal or similarly significant effects, and you can override any classification, correct it, or turn features off. No outbound action happens without your approval.

Deleting your account

• Where — Settings → Privacy inside Nexamail, on web or Android.
• Deactivate & schedule deletion — your account is paused immediately and permanent deletion is scheduled 30 days later. You can cancel during that window.
• Delete immediately — type DELETE to confirm and your account is purged straight away: mailbox connections and stored tokens, synced message metadata and snippets, AI drafts, summaries, memory, assistant history, subscriptions data, preferences and your login are removed, and any active subscription is cancelled.
• Connected mailboxes — deletion removes the tokens and the mail data Nexamail holds. It does not delete anything inside your Gmail or Outlook mailbox itself. You may also revoke access in your Google or Microsoft security settings.
• What remains — a minimal tombstone record (a one-way reference to the deleted address plus the deletion timestamp) so a deleted account cannot be silently revived, and records we must keep for legal, tax, or fraud-prevention reasons.
• Google Play purchases — deleting your Nexamail account does not by itself cancel a Google Play subscription. Cancel it in Google Play → Subscriptions.

A public, sign-in-free summary of this process lives at nexamail.ai/delete-account.

Disconnecting a mailbox

You do not need to delete your account to remove a mailbox. Disconnecting Gmail or Outlook from Settings → Connections deletes, for that mailbox only:

• the stored OAuth access and refresh tokens (for Gmail we also ask Google to revoke the grant);
• every synced message record for that provider — sender, recipients, subject, timestamps, thread/message identifiers, labels or folders, read state and snippet;
• the unified inbox items generated from those messages, including their AI classification, priority and reasoning fields;
• the AI drafts and classification telemetry attached to those items.

The deletion is scoped to your account and that one provider. Your Nexamail account, subscription, settings, notes, manually added subscriptions and any other connected mailbox are untouched, as is the mailbox itself at Google or Microsoft. Security and audit events recording that the disconnection happened are retained.

What we never do

• We never sell your data.
• Your inbox is never used to train public AI models — ever.
• We never send messages or accept calendar invites without your explicit approval.
• We never share your inbox content with advertisers or third parties.

Data processing agreements

Data Processing Agreements (DPAs) are available on request for business customers. Contact privacy@nexamail.ai to receive a copy.

Retention

• Active accounts — data is retained while your account is active and for as long as needed to deliver the service. Synced mailbox metadata and snippets are refreshed as your mailbox changes and removed when you disconnect the mailbox.
• Deactivated accounts — permanently deleted 30 days after you request deletion, unless you cancel.
• Immediate deletion — personal data is removed from active systems at the point of deletion.
• Backups — deleted data is removed from live systems immediately and is then removed from our managed provider's encrypted disaster-recovery backups as those backups age out.
• Legal holds — limited records may be retained longer where required by law (e.g. billing and tax records).

Children

Nexamail is not directed at children. You must be at least 13 years old (16 in the EEA) to create an account.

Changes to this policy

If we make material changes, we will notify you by email or in-app at least 14 days before they take effect.

Contact

Questions or data rights requests: privacy@nexamail.ai

Postal: AE TECHNOLOGIES GROUP LTD, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (company number 17419062, registered in England and Wales).