Privacy Policy

MailScan AI collects information necessary to provide our email threat detection service. We believe in minimal data collection and only gather what is strictly required to operate, improve, and secure our platform.

Information you provide directly:

• Account registration data: your name, email address, and encrypted password.
• Email content submitted for analysis (processed ephemerally — never stored persistently after analysis).
• Payment information processed by our third-party payment processor, Stripe (we do not store card details).
• Support communications and enquiries sent to our team.

Information collected automatically:

• Usage data: pages visited, features used, scan history (results only, not email content), and session timestamps.
• Technical data: IP address, browser type and version, operating system, device type, and time zone.
• Log data: server logs including request metadata, error reports, and performance metrics.
• Cookies and similar tracking technologies (see Section 6).

We do not sell, rent, or monetise your personal data in any form. We do not use submitted email content to train AI models.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following lawful bases as defined in Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)): Processing your account data and scan submissions is necessary to fulfil our service agreement with you.
• Legitimate interests (Art. 6(1)(f)): We process usage data and logs to secure our platform, prevent fraud, and improve service quality. Our legitimate interests do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)): We may process data where required by applicable law, regulatory authority, or court order.
• Consent (Art. 6(1)(a)): For optional marketing communications and non-essential cookies, we rely on your explicit consent, which you may withdraw at any time.

For data subjects in California (USA), our practices are additionally governed by the California Consumer Privacy Act (CCPA). You have the right to know, delete, and opt out of the sale of personal information (we do not sell personal information).

We do not sell your personal data. We share data only in the following limited circumstances:

• AI inference provider: Email content is transmitted to our AI provider (OpenAI or equivalent) solely to generate your threat analysis. This transmission is covered by their Data Processing Agreement. Your content is not retained or used for training purposes under our agreements.
• Stripe (payments): Your payment information is processed directly by Stripe, Inc., which is PCI-DSS Level 1 certified. We receive only a transaction ID and payment status.
• Infrastructure providers: We use cloud infrastructure (such as AWS or equivalent) for hosting. These providers act as data processors under our Data Processing Agreements and cannot use your data independently.
• Legal requirements: We may disclose data when legally compelled by valid court orders, government requests, or to protect the safety and rights of our users and company.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you with 30 days' notice before any such transfer and provide an opportunity to delete your account.

All third-party processors we engage with are contractually required to maintain appropriate security standards and process data only under our instructions.

Depending on your location, you have the following rights regarding your personal data:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to our legal retention obligations.
• Right to restriction: Request that we limit processing of your data under certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@mailscan.ai. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g., the ICO in the UK, or your EU supervisory authority).

Our servers are primarily located in the European Union. However, some of our third-party service providers operate in the United States and other countries. Where personal data is transferred outside the EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to countries that benefit from an EU adequacy decision.
• Data Processing Agreements with all sub-processors that include appropriate safeguards.

You may request information about the specific safeguards in place for any international transfer by contacting us at privacy@mailscan.ai.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send a notification email to all registered users at least 14 days before changes take effect.
• Display a prominent notice on our platform.

Your continued use of MailScan AI after the effective date of any changes constitutes acceptance of the updated policy. If you disagree with any changes, you may delete your account before the effective date.