Privacy Policy
Mailopoly respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and services.
GDPR, UK GDPR and CCPA — Regional Privacy Notices
If you are in the European Economic Area or the United Kingdom, our EU/UK Privacy Notice (GDPR) sets out your rights under the General Data Protection Regulation (GDPR) and UK GDPR, the legal bases we rely on, and how international transfers are protected. If you are in California, see our California Privacy Notice (CCPA). Those notices supplement this policy and apply alongside it.
Information We Collect
We collect only the information necessary to provide and improve Mailopoly. This includes account details such as your email address, basic contact information, billing details processed by trusted payment providers, and communications you have with us.
When you connect your email account, we access and process your email content, metadata, and attachments as necessary to deliver our services. We also collect messages you send through our in-app assistant, Poly.
We also collect limited technical data automatically, such as device and browser information, IP address, and usage patterns, to ensure reliability, security, and performance.
Information About Other People
Mailboxes contain information about the people you correspond with. When you connect an account, we necessarily process that information too, in order to organise your mail and provide our services to you.
We act on your instructions in handling that content. We do not monitor, review, screen or moderate the content of connected accounts, and we are not able to assess whether you are entitled to share any particular message with us. You are responsible for ensuring that connecting an account, and having us process what it contains, is lawful and permitted — see our Terms of Use.
We may carry out automated security and abuse checks to protect the platform and its users. These checks are voluntary, are not a review of your content, and do not oblige us to detect or act on any particular material.
How We Use Your Information
Your information is used solely to operate Mailopoly, improve its features, communicate with you about updates or support requests, process payments, and protect the platform from abuse or fraud.
We do not sell your data or use it for advertising purposes.
AI-Powered Processing
Mailopoly uses artificial intelligence to process your emails and power conversations through Poly, our in-app assistant. To deliver these services, we use a combination of proprietary and third-party Large Language Models (LLMs).
We may transmit your email content and chat messages to third-party AI providers. Our current providers include Google (Gemini), Atlas Cloud, Fireworks AI, Anthropic (Claude), OpenAI, and xAI (Grok). Each operates under a commercial data processing agreement with Mailopoly. Your data is processed solely to deliver our services to you and is never used to train or improve AI models, nor for any other purpose. All third-party providers are contractually required to provide the same or equivalent level of data protection as described in this policy.
We evaluate models and providers continuously, and the provider or model handling any particular request may change at any time. Before we route customer data to a new provider, we test and review that provider against our security, confidentiality and data protection requirements, and we use only providers that are contractually bound to the standards described above. We review the list above periodically, but we do not undertake to name every provider or model in use at any given moment.
Cookies & Tracking Technologies
Mailopoly uses cookies and similar technologies to remember your preferences, understand how the product is used, and maintain security. You can control cookie settings through your browser at any time.
Data Retention
We keep your data only for as long as your account remains active or as required by law.
Disconnecting a single account. When you disconnect a connected mailbox, we immediately and permanently delete the stored credentials for it, and we stop retrieving mail from it. Messages already imported before you disconnected remain in your Mailopoly account, where they stay under your control and can be deleted individually or by deleting your Mailopoly account.
Deleting your Mailopoly account. Your subscription is cancelled, all connected mailboxes are disconnected and their credentials destroyed, and your email content, attachments, derived data (summaries, extracted tasks and events, keywords and embeddings) and account record are permanently erased within 30 days.
AI providers. Data transmitted to third-party AI providers for processing is not retained by those providers beyond the time required to complete the request, and is never used to train or improve their models.
We may retain billing records and other information where we are required to do so by law, and limited security and abuse logs, after deletion.
Data Security
We protect your information using industry-standard security practices, including encryption of data in transit and at rest, strict access controls, and regular security reviews. Mailopoly has completed CASA Tier 2 security assessment by TAC Security, reflecting our commitment to enterprise-grade security.
Connected Account Credentials
Where your provider supports it (for example Google and Microsoft), we connect using OAuth and never receive your password — only a revocable access token, which you can revoke at any time from your provider account.
Where your provider does not support OAuth and you connect a mailbox over IMAP, we require your IMAP username and password in order to retrieve your mail. That password is encrypted before it is stored, using AES-256 with a unique initialisation vector per credential. The encryption key is held in our application environment, separately from the database, so the stored value is not usable on its own. The password is decrypted in memory only at the moment a connection to your mail server is opened, is never written to logs, and is never displayed back to you or to our staff.
When you disconnect an account, the stored credential record is deleted outright at that moment — not marked inactive — so the credential no longer exists in our systems. We recommend using an app-specific password where your provider offers one, so that access can be revoked at your provider without changing your main password.
Third-Party Services
Mailopoly integrates with third-party services such as email providers, payment processors, and AI service providers as described above. These services operate under their own privacy policies, and we work only with providers that meet strict security and privacy standards. All third parties with whom we share user data are required to provide the same or equivalent level of data protection as set out in this policy.
Where Your Data Is Processed
Mailopoly Pty Limited is an Australian company. Your email content, attachments and derived data are stored and processed primarily in Australia, on Amazon Web Services infrastructure in the Asia Pacific (Sydney) region, with some supporting services operating in the United States. Requests sent to our AI providers are processed in the United States and in other locations determined by those providers.
We do not offer EU-only or region-restricted storage. Where we receive personal data from the European Economic Area or the United Kingdom, transfers are made under the EU Standard Contractual Clauses and the UK International Data Transfer Agreement, together with the technical and organisational measures described in this policy.
The regions and providers above are current as of the date of this policy and may change as we develop the Service. We will update this page when they do.
Business and Enterprise Customers
If you are connecting a mailbox on behalf of a company, you are the data controller for its contents and Mailopoly acts as your data processor. We offer a Data Processing Agreement meeting the requirements of Article 28 of the GDPR, incorporating the EU Standard Contractual Clauses. To request our Data Processing Agreement or our current list of subprocessors, contact us at privacy@mailopoly.com.
Customers in the EEA and UK should also read our EU/UK Privacy Notice. Customers in California should read our California Privacy Notice.
Your Rights and Choices
AI processing is how Mailopoly works. Sorting your mail, summarising it, extracting tasks and events, and answering you through Poly are all delivered by AI, so the Service cannot be provided without it and there is no separate opt-out. If you do not want your mail processed this way, do not connect an account — and you can delete your account at any time.
You may request access to, correction of, or deletion of your personal data by contacting us through the Mailopoly platform or at privacy@mailopoly.com.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated date.
Contact Us
If you have questions about privacy or data protection, you can contact us directly through the Mailopoly platform.