Privacy

What IMAP2AI stores, what it does not, and where it runs. Written to be checked, not to be skimmed.

Last updated 11 October 2026.

Who is responsible

The controller is Jure Šavron s.p., Ferarska ulica 30, 6000 Koper, Slovenia, entered in the Poslovni register Slovenije (AJPES) (+386 40 202 488). There is no data protection officer: the operation is one person and does not meet the threshold in Article 37. For anything in this policy, including a request to see or delete your data, write to info@imap2ai.com.

The short version

Email contents are fetched on demand and are not retained by IMAP2AI. If you connect WhatsApp, the service keeps a local cache of chats, contacts and messages, together with the session keys needed to stay connected. Google connections store an encrypted refresh token. Your chosen AI assistant receives the data its connector requests. The activity log records action metadata, without message contents.

What is stored

Your account

The email address you sign in with, and the identity record our authentication provider keeps for it.

Mailbox settings

A label, the mailbox address, the IMAP and SMTP host, port and security setting, the username, any folder overrides, and whether sending is enabled.

Your mailbox password

Encrypted with AES-256-GCM before it reaches the database, under a key held only in the server’s environment and never written beside the data. Each mailbox gets its own data key, cryptographically bound to that mailbox so a record cannot be moved to another account and opened. A copy of the database, without the environment, decrypts nothing.

WhatsApp and Google connections

Account labels, linked identity and permissions. WhatsApp session keys and message cache are kept per account on the application volume. Google refresh tokens are encrypted with AES-256-GCM and bound to both the customer and account id.

Connector URLs

Only a SHA-256 hash of each one. The URL itself is shown to you once and never stored, which is also why we cannot show it to you again. Revoking one takes effect immediately.

A usage log

One row per request: which account, which tool ran, when, and whether it succeeded. No arguments and no results — never a subject, a sender, a folder name or a message. It exists to enforce the daily limit and to let you see what has been happening in your mailbox.

Billing, if you subscribe

A Stripe customer id, your plan, subscription status and renewal date. Card details are entered on Stripe’s own hosted page and never reach this service.

Message content and local storage

Email message bodies and attachments are not mirrored into our database. They pass through server memory during a request. WhatsApp is different: its local searchable cache includes message text and message payloads. Session keys and this cache live on the persistent application volume, protected by the hosting provider’s disk encryption; they are readable by the running service. Google API results are fetched on demand by the connector.

Your mail is never used to train any model and is never sold. Apart from the AI client you choose to connect — which is the whole purpose, and is the first entry below — it is never shared with anyone other than the processors listed below.

Where it runs

The application server is in Frankfurt, Germany (EU). The database is in London, United Kingdom. Your mail server is wherever your provider keeps it; IMAP2AI connects out to it and does not move it.

Who else processes your data

• The AI client you connect — that is what reads your mail. Anything it retrieves through the connector goes to whoever operates it and is handled under your own agreement with them — Anthropic for Claude, OpenAI for ChatGPT, and whoever operates any other MCP client you point at this connector. We do not choose it, cannot see which one you connect, and have no agreement with them on your behalf. This is the point of the product, and it is the most important sentence on this page.
• Fly.io — hosting for the application server, in Frankfurt, Germany (EU).
• Supabase — the database and the sign-in system, in London, United Kingdom.
• Stripe — payments, only if you subscribe to a paid plan.

Transfers outside the EEA

Some of the processors above are established outside the European Economic Area, principally in the United States, and personal data reaches them in the course of providing the service. Where that happens the transfer relies on the European Commission’s standard contractual clauses, or on the EU–US Data Privacy Framework where the recipient is certified under it. You can ask us for a copy of the safeguard relied on for any particular processor. The database itself is in London, United Kingdom, which is covered by the Commission’s adequacy decision for the UK, so it needs no additional safeguard.

Cookies and tracking

This site has no analytics, no advertising and no tracking cookies, and loads nothing from a third-party domain — no fonts, no scripts, no images from anywhere but here. Signing in stores a session in your browser. Connecting Google also sets a temporary HttpOnly consent cookie lasting up to ten minutes. Neither is used for tracking.

How long it is kept

Mailbox settings and the encrypted password are kept until you delete the mailbox, which removes those settings and credentials from the active database. The shared AI connection remains available for your other accounts; revoke it separately in AI access. Email diagnostic usage-log rows are kept for as long as the mailbox they belong to exists, and are deleted with it — there is no separate expiry, and we would rather say so than quote a retention period nothing enforces. Asking us to close your account removes your mailboxes, their credentials, their connector URLs and their logs. Billing records are kept for as long as Slovenian tax law requires, which is currently ten years.

Combined-connector activity metadata is retained for 90 days. Send-attempt identifiers are retained until your customer account is deleted so an old retry cannot duplicate a message. Disconnecting WhatsApp schedules removal of its local session and cache; disconnected Google credentials are deleted from the active database. A Google grant can also be revoked in your Google account settings. Backups may retain earlier data until the operator’s backup retention period ends. Deletion is not retroactive in an AI assistant or another recipient that already received the data.

Your rights

Under the GDPR you may ask for a copy of your data, ask for it to be corrected or deleted, ask for it in a portable form, or object to how it is processed. Write to info@imap2ai.com. Deleting a mailbox in the dashboard erases its settings, its sealed password and its connector URLs immediately; closing the account entirely is done by writing to that address, and we do it by hand rather than pretending there is a button.

The lawful basis for your account, your mailbox settings and the usage log is the contract between us: this is the data that makes the service work, and none is collected that is not needed for it. For invoices and other accounting records it is a legal obligation under Slovenian tax law. Providing the data is a requirement of using the service rather than of any statute — without it there is nothing to connect. There is no automated decision-making and no profiling. If you think it is being handled wrongly you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana), or to the supervisory authority where you live.

Changes

If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and account holders are told by email before it takes effect.