Privacy Policy

Nexamail is built around a simple idea: your inbox belongs to you. This page explains what we collect, what we never collect, how we process it, and the rights you can exercise at any moment.

Data controller

Nexamail acts as the data controller for the personal information you provide to create and operate your account, and for the metadata generated as you use the service. Nexamail is operated from the United Kingdom. For any data protection question, contact privacy@nexamail.ai.

Data we collect

• Account details — name, email address, password hash, plan, and preferences.
• Authentication data — OAuth tokens from connected providers (Gmail, Outlook), stored encrypted server-side.
• Email metadata — the minimum subject lines, senders, recipients, timestamps, and thread identifiers needed to surface drafts, follow-ups, and reminders.
• User preferences — language, theme, notification settings, drafting tone, automation rules.
• AI memory — only if you explicitly enable it. You can clear it any time from Settings → Privacy.
• Billing metadata — subscription status, plan, and the Stripe customer reference. We never see your card details.
• Operational logs — request IDs, error traces, and security signals needed to keep the service reliable and safe.

Data we never collect

• Your Gmail, Outlook, or any other provider password.
• Mailbox content beyond what is needed to render the features you actually use.
• Advertising profiles, behavioural tracking for ads, or cross-site fingerprinting.
• Sensitive categories of data we do not need to operate the service.

Legal bases for processing

We process your personal data under one or more of the following lawful bases under UK GDPR and EU GDPR:

• Performance of a contract — to provide the Nexamail service you signed up for.
• Legitimate interests — to keep the service secure, reliable, and continuously improving, balanced against your rights and expectations.
• Legal obligations — to comply with applicable laws, tax, and regulatory requirements.
• Consent — where required, for optional features such as AI memory, marketing communications, or non-essential cookies. Consent can be withdrawn at any time.

How AI processing works

AI features run only on emails you have already chosen to surface — drafts, summaries, prioritisation, and follow-up detection.

• Prompts are sent to AI providers solely to produce the feature you requested and are processed transiently.
• Under our enterprise terms with OpenAI and Google, your content is not retained for training their public models.
• Your data is never blended into a shared training corpus, sold, or shown to other Nexamail users.
• AI memory is opt-in, can be disabled, and can be wiped in one click from Settings → Privacy.
• Nothing is sent, scheduled, or accepted on your behalf without your explicit approval.

AI Scam Checker

Nexamail's Scam Checker analyses the content of emails selected by the user to identify potential phishing attempts, impersonation, malicious links, suspicious attachments, and other indicators of fraud.

Scam analysis is provided to assist users in identifying potential risks and should not be relied upon as a guarantee that an email is safe or malicious.

Users remain responsible for making their own decisions before clicking links, downloading attachments, sending money, or sharing personal information.

Nexamail does not automatically delete, block, quarantine, or report emails without user action.

Subscription Management

Nexamail may identify recurring subscriptions, memberships, free trials, newsletters, and renewal emails by analysing email metadata and content within connected mailboxes.

Subscription detection is intended to help organise emails and provide reminders. Detection may not always be accurate and users should verify subscription details before relying on them.

Users may also manually create subscription entries. Future emails from associated senders may be linked to those subscriptions to improve organisation.

Nexamail does not automatically cancel subscriptions, unsubscribe users, or make payments on their behalf.

Third-party processors

We rely on a small set of trusted infrastructure partners. Each one processes data strictly under contract and only for the purposes listed below:

• Supabase — managed database, authentication, and file storage.
• Cloudflare — edge delivery, DDoS protection, and DNS.
• Stripe — subscription billing and payment processing (PCI-DSS Level 1). We never see your card details.
• OpenAI — AI inference for drafting, summarisation, and prioritisation under enterprise terms with no training on your data.
• Google AI services — supplementary AI inference under enterprise terms with no training on your data.
• Mailgun — transactional email delivery (verification, password reset, notifications).

International data transfers

Some of our processors operate internationally, including in the United States. Where personal data leaves the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum. Providers are contractually required to protect your data to a standard equivalent to UK and EU data protection law.

Security measures

• Encryption — TLS 1.2+ in transit, AES-256 at rest.
• Access controls — role-based access with least-privilege principles across all internal systems.
• Secure credential handling — refresh tokens are encrypted, stored server-side, and never exposed to client code.
• Monitoring — continuous monitoring for abuse, suspicious access, and service degradation.
• Row-level security — every database table enforces tenant isolation at the database layer, not just the API.

A deeper technical write-up lives on our Security page.

Your rights

Under UK GDPR, EU GDPR, and equivalent privacy laws (including CCPA), you can exercise the following rights at any time:

• Access — see what personal data we hold about you.
• Correction — update inaccurate or incomplete information.
• Deletion — request erasure of your personal data.
• Portability — receive a copy of your data in a portable JSON or CSV format.
• Objection — object to processing carried out under legitimate interests.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

Most rights can be exercised directly from Settings → Privacy. For anything else, email privacy@nexamail.ai and we will respond within 30 days.

What we never do

• We never sell your data.
• Your inbox is never used to train public AI models — ever.
• We never send messages or accept calendar invites without your explicit approval.
• We never share your inbox content with advertisers or third parties.

Data processing agreements

Data Processing Agreements (DPAs) are available on request for business customers. Contact privacy@nexamail.ai to receive a copy.

Retention

• Active accounts — data is retained while your account is active and for as long as needed to deliver the service.
• Deleted accounts — deletion is scheduled immediately and personal data is removed from active systems within 30 days.
• Backups — encrypted backups roll off within 30 days, after which residual copies are purged.
• Legal holds — limited records may be retained longer where required by law (e.g. billing and tax records).

Children

Nexamail is not directed at children. You must be at least 13 years old (16 in the EEA) to create an account.

Changes to this policy

If we make material changes, we will notify you by email or in-app at least 14 days before they take effect.

Contact

Questions or data rights requests: privacy@nexamail.ai