At NextEmail.ai, operated by CalMax Systems ("we," "us," or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your information when you use our service.
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Email address (required)
- Name (provided via social login or entered manually)
- Password (securely hashed; not stored if you sign in exclusively via Google, Microsoft, or Apple)
- Referral code (if you were invited by another user)
1.2 Email Data
When you connect your email account (Gmail or Microsoft 365), we download and persistently store the following on our servers:
- Email metadata: sender, recipient, subject line, date, message ID, folder/label assignments
- Email body content: plain text and HTML content of your email messages
- Attachment metadata: file names, content types, and sizes (we do not download attachment file content)
- Email headers: authentication results (SPF, DKIM, DMARC) used for threat detection
- Folder and label structure: your mailbox organization as reported by your email provider
Why we store your email data: Persistent storage is required for continuous security scanning (threat detection runs approximately every 60 seconds), AI-powered search, and email organization. Without stored data, we could not provide real-time protection or search functionality.
No human reads your emails. All email processing is performed by our automated AI systems running on our own servers. Your email content is never sent to third-party AI services.
1.3 Billing Information
When you subscribe to a paid plan, payment information (credit card number, billing address) is collected and processed by Stripe. We store only your Stripe customer ID and subscription status — we never see or store your full credit card number.
1.4 Usage Data
We automatically collect:
- Log data (IP address, browser type, pages visited)
- Device information (operating system, app version for mobile users)
- Feature usage patterns (e.g., search queries, dashboard views) to improve our service
1.5 Device Tokens (Mobile App)
If you use our iOS app, we collect your Apple Push Notification service (APNs) device token to send you push notifications. You can disable notifications in your device settings at any time.
2. How We Use Your Information
We use collected information to:
- Provide security protection: Scan emails for phishing, spam, and other threats using our AI models
- Organize your email: When enabled, classify and label emails by sender and topic
- Enable search: Power natural language search across your stored emails
- Auto-unsubscribe: Send RFC 8058 unsubscribe requests for detected spam
- Process payments: Manage your subscription through Stripe
- Send service communications: Billing notifications, security alerts, trial expiry warnings
- Improve our service: Analyze aggregate usage patterns (not individual email content) to improve AI accuracy and features
- Detect abuse: Prevent unauthorized access and enforce our Terms of Service
We do not use your email content to train our AI models. Our AI models are trained on separate datasets and deployed on our servers. Your email data is only used for providing the service to you.
3. Data Storage and Security
Your data security is our priority:
- All data is encrypted in transit using TLS 1.3
- OAuth tokens (used to access your email provider) are encrypted at rest using Fernet symmetric encryption
- We never store your email provider password — access is granted through OAuth 2.0 tokens that you can revoke at any time
- Email data for all users is stored in a single PostgreSQL database, secured with row-level security (RLS) policies that restrict each application process to accessing only authorized data
- Our servers are located in the United States
- AI processing runs on dedicated GPU servers on our own infrastructure — no cloud AI APIs are used
4. Data Sharing
We do not sell your personal information. We may share data only:
- With your consent: When you explicitly authorize sharing
- To comply with legal obligations: In response to valid legal process (subpoena, court order, government request)
- To protect rights and safety: When necessary to enforce our Terms, protect our users, or address fraud
- With service providers: See Section 8 (Sub-processors) for details
5. Automated Decision-Making
NextEmail.ai uses fully automated AI systems to make decisions that directly affect your email. Under GDPR Article 22 and similar regulations, you have the right to understand these decisions:
5.1 Threat Classification
Our AI analyzes each incoming email and classifies it as safe, spam, or phishing. Emails classified as threats are automatically moved to a filtered folder ("AI Filtered Spam") in your email provider. This happens without human review.
Logic: Our AI model (a large language model running locally on our servers) analyzes the email's sender, subject, body content, attachment metadata, and authentication headers to produce a classification. Post-model heuristics check for known threat patterns (brand impersonation, sender spoofing, attachment-based scams).
Significance: Emails classified as threats are moved out of your inbox. You may miss a legitimate email if it is incorrectly classified (false positive).
Your rights: You can review all classified emails in your dashboard. Moving a misclassified email back to your inbox in your email provider overrides our classification. You can contact us to request human review of any classification decision.
5.2 Email Organization
When AI Organize is enabled, our AI assigns category labels (e.g., "AI/Amazon," "AI/Bank of America") to safe emails. This is optional and disabled by default for new accounts.
5.3 Auto-Unsubscribe
For spam emails that include RFC 8058 one-click unsubscribe headers, our system automatically sends an unsubscribe POST request. This only applies to spam categories — never to emails classified as phishing (to avoid interacting with attacker infrastructure).
6. Your Rights
Regardless of your location, you have the right to:
- Access your personal data stored by NextEmail.ai
- Correct inaccurate account information
- Delete your account and all associated data
- Disconnect your email account and stop all processing
- Object to automated decision-making (see Section 5)
- Opt out of marketing communications
To exercise any of these rights, contact us at [email protected] or use the account management features in your settings.
7. Data Retention
We retain your data as follows:
- Active accounts: Email data is retained as long as your account is active and your mailbox is connected
- Disconnected mailboxes: When you disconnect a mailbox, your OAuth tokens are revoked and AI processing stops immediately. Your stored email data is preserved so you can reconnect later. To permanently delete email data, use the "Delete mailbox" option in settings
- Deleted mailboxes: When you delete a mailbox (not just disconnect), all email data for that mailbox is permanently deleted from our database immediately
- Deleted accounts: When you delete your account, all data (account information, email data, subscription records) is permanently deleted immediately
- Lapsed subscriptions: Email data is retained for 30 days after your subscription lapses to allow reactivation, then permanently deleted
- Server logs: Access logs are retained for up to 90 days for security and debugging purposes
8. Sub-Processors (Third-Party Service Providers)
We use the following third-party services to operate NextEmail.ai. These providers process data on our behalf under contractual obligations to protect your information:
| Provider |
Purpose |
Data Shared |
| Stripe |
Payment processing |
Email address, payment method (collected directly by Stripe) |
| Cloudflare |
DNS, CDN, DDoS protection (marketing site) |
IP address, page requests (marketing site only) |
| Google reCAPTCHA |
Bot prevention on referral invitations |
Browser fingerprint, IP address |
| Microsoft Graph API |
Office 365 email access (at your request) |
OAuth tokens (encrypted), email data (downloaded to our servers) |
| Google Gmail API |
Gmail email access (at your request) |
OAuth tokens (encrypted), email data (downloaded to our servers) |
No third-party AI services. Our AI models (for security scanning, email organization, and search) run entirely on our own GPU servers. Your email content is never sent to OpenAI, Google AI, Anthropic, or any external AI provider.
9. Google API Services Disclosure
NextEmail.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Limited Use Disclosure
NextEmail.ai's use of information received from Gmail APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Gmail data to provide the email security scanning and threat detection services described to you, and optionally, AI-powered email organization and search
- We do not transfer Gmail data to third parties except as necessary to provide our service, with your consent, or as required by law
- We do not use Gmail data for serving advertisements
- Human review of Gmail data is limited to investigating security issues, abuse, or when required by law, or with your explicit consent
Gmail Permissions We Request
When you connect your Gmail account, we request the following permissions:
- gmail.readonly — To download and analyze your email messages for AI-powered security scanning and threat detection
- gmail.modify — To apply labels to classified emails and move detected threats to a filtered folder
- gmail.labels — To create and manage labels used for AI security classification and optional email organization
- userinfo.email — To verify your email address during OAuth authentication
How We Use Gmail Data
We use your Gmail data exclusively to:
- Detect threats: Analyze email content, headers, and sender information to identify phishing, spam, and email-borne attacks
- Protect your inbox: Automatically move detected threats to a filtered folder and send unsubscribe requests for spam
- Organize email (optional): When AI Organize is enabled, classify and label emails by sender and topic
- Enable search: Power natural language search across your connected Gmail account
What We Do NOT Do With Gmail Data
- We do NOT use Gmail data for advertising or marketing purposes
- We do NOT sell, rent, or share Gmail data with third parties
- We do NOT use Gmail data to build user profiles for advertising
- We do NOT allow humans to read your emails — only our automated AI systems process them
- We do NOT use your Gmail data to train our AI models
- We do NOT send your Gmail data to any external AI service
Revoking Access
You can revoke NextEmail.ai's access to your Gmail data at any time by:
When you revoke access, we will permanently delete your Gmail data from our servers. If you disconnect via NextEmail.ai settings, deletion is immediate. If you revoke via Google, deletion occurs within 30 days.
10. Cookies
We use the following cookies:
- Session cookie (essential): Maintains your login session. Required for the service to function.
- CSRF cookie (essential): Protects against cross-site request forgery attacks. Required for security.
We do not use advertising cookies or third-party tracking cookies on our application. The marketing site (nextemail.ai) may use Cloudflare analytics.
11. Children's Privacy
Our service is not intended for users under 16 years of age. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.
12. Data Breach Notification
In the event of a data breach that compromises your personal information:
- We will notify affected users via email within 72 hours of becoming aware of the breach
- We will notify relevant supervisory authorities as required by applicable law (e.g., GDPR Article 33)
- Our notification will include: the nature of the breach, the data affected, steps we are taking, and recommended actions for you
13. International Data Transfers
Our servers are located in the United States. If you access our service from outside the United States, your data will be transferred to and processed in the United States. By using our service, you consent to this transfer.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on your explicit consent (provided when you connect your email account) as the legal basis for this transfer under GDPR Article 49(1)(a).
14. For Residents of the European Economic Area (GDPR)
If you are located in the EEA, UK, or Switzerland, the following additional terms apply:
14.1 Legal Basis for Processing
- Contract performance (Art. 6(1)(b)): Processing your email data to provide the security scanning, organization, and search services you signed up for
- Legitimate interest (Art. 6(1)(f)): Improving our service, preventing abuse, and maintaining security
- Consent (Art. 6(1)(a)): Sending marketing communications (you can withdraw consent at any time)
- Legal obligation (Art. 6(1)(c)): Complying with applicable laws and regulations
14.2 Your GDPR Rights
In addition to the rights listed in Section 6, you have the right to:
- Data portability: Receive your personal data in a structured, machine-readable format
- Restriction of processing: Request that we limit how we use your data
- Object to automated decision-making: Request human review of any automated classification decision (see Section 5)
- Lodge a complaint: File a complaint with your local data protection authority
14.3 Data Protection Contact
For GDPR-related inquiries, contact our data protection point of contact at [email protected].
15. For Residents of California (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know: Request what personal information we collect, use, disclose, and sell
- Right to delete: Request deletion of your personal information
- Right to opt out of sale: We do not sell your personal information
- Right to non-discrimination: We will not discriminate against you for exercising your rights
- Right to correct: Request correction of inaccurate personal information
To exercise these rights, contact us at [email protected] or use the account management features in your settings. We will respond within 45 days.
16. Changes to This Policy
We may update this policy periodically. We will notify you of material changes via email at least 14 days before they take effect. The "Effective" date at the top of this page indicates when this version was last updated.
17. Contact Us
For privacy-related questions or concerns: