MailAction
Privacy Policy
Last updated: 2026-08-22
1. What we collect
We collect your account email address; the documents you scan, upload, or forward to your intake address; the data extracted from those documents (such as issuers, amounts, dates, and suggested actions); and the minimal usage data needed to operate the service, such as your AI extraction count for the month and basic logs for security and debugging. Document contents do not appear in our logs. We do not collect advertising identifiers and we do not track you across other sites.
2. How we use your data
We use your data solely to provide MailAction: reading your documents, extracting deadlines and actions, sending you reminders, and keeping your archive searchable. If you use household sharing, documents you choose to share are visible to the household member you invited; documents you keep personal are not. We never sell your data, and we never share it with anyone except the service providers listed below, who process it on our behalf under their own privacy commitments. There is no advertising in MailAction, we do not build profiles of you for anyone else, and we do not share data with data brokers. We would disclose data only if legally compelled to, and only the minimum required.
3. AI processing
To extract information, your documents are processed by US-based AI providers: Google (Gemini API) and OpenAI. We send them the document image or text and receive the extracted details back. Their API terms apply to this processing and do not permit training their models on your data.
4. Service providers (subprocessors)
We rely on a small set of providers to run MailAction:
- Supabase — database and file storage
- Vercel — hosting
- Stripe — payments (we never see your card details)
- Resend — email delivery for reminders and account emails
- Upstash — rate limiting and quotas
- Cloudflare and Postmark — email forwarding intake
- Google and OpenAI — AI document extraction
5. Retention and deletion
Your documents are kept until you delete them or delete your account. Deleting a single document removes the original file, the extracted text, and the actions created from it. Deleting your account permanently purges your documents, uploaded files, and account data from our systems. Backups held by our storage provider expire on their standard schedule.
6. Your rights
You can export your data from the app at any time, and you can delete individual documents or your entire account from Settings without asking us. If you have a privacy request we have not covered here — access, correction, or deletion — email us and we will handle it.
7. Security
Your data is encrypted in transit and at rest by our providers. Access to your archive is protected by row-level security, so your documents are only visible to you and to household members you explicitly invite. No system is perfectly secure, but we design MailAction to hold as little sensitive data as the service allows and to keep what it holds locked down.
8. Children
MailAction is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.
9. Changes and contact
If this policy changes, we will post the updated version here with a new “last updated” date, and we will notify you in the app about material changes. Questions about privacy? Email hello@mailaction.app. MailAction is operated by an individual sole proprietor in the United States.