Privacy Policy

Effective [EFFECTIVE DATE]. This policy explains what Emlio (operated by [COMPANY LEGAL NAME, e.g. Your Business, LLC], “we”) does with your information. In short: we read new email only to draft replies for you, we don't store the contents of your email, we never sell your data, and we never use your email to train AI.

What Emlio does with your email

When you connect a mailbox, our background service checks it for new mail. For each new message from a real person, it reads the message and recent messages in the same conversation, decides whether a reply is needed, and, if so, writes a draft reply that is saved in your own Drafts folder. If you turn on the optional features, it can also move handled messages into your folders, send routine replies you have allowed, and email you a daily summary from your own mailbox.

Email contents are processed in memory for that purpose and are not stored in our database. Drafts live in your mailbox, under your control.

Information we keep

• Account: your email address, name and time zone.
• Mailbox connection: the mailbox address and either an access token (Microsoft, Google) or an app password (other email services), encrypted with AES-256 before storage.
• Your settings: the business information, signature and preferences you enter.
• Activity log (kept 90 days): for each email handled, the sender, subject, what we did (drafted, skipped, filed, sent), the reason, the category, and how much AI processing it used. This powers your dashboard. It does not include the email body.
• Preview results (kept 24 hours): the draft text shown on the preview page.
• Processing markers (kept 30 days): message IDs, so the same email is never handled twice.
• Billing: handled by Stripe. We keep your subscription status and dates, never your card number.

Access we ask for

Microsoft (Outlook, Microsoft 365): read and write mail (to read new messages, create drafts, add categories and file messages), send mail (only for your daily summary and replies you allowed to be sent automatically), your basic profile, and offline access (so it keeps working when you're not signed in).

Other email services (IMAP): an app password you create, used only to sign in to your mailbox for the same purposes.

Google (Gmail), when available: Emlio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we never do

• Sell or rent your data, or use it for advertising.
• Use your email or business information to train AI models, ours or anyone else's.
• Let people read your email, except when you ask us to for support, or when required to investigate abuse, for security, or by law.

Service providers (subprocessors)

We use these companies to run Emlio. Each only processes data as needed to provide its service to us:

• Anthropic: AI that reads an email and writes the draft reply (United States).
• Supabase: Database and sign-in (United States).
• Vercel: Website hosting (United States).
• Render: Background worker that processes mailboxes (United States).
• Stripe: Payments and billing (United States).
• Resend: Account emails (for example “please reconnect your mailbox”) (United States).

Anthropic receives the email and conversation being answered, plus your business information, to write each draft. Under Anthropic's commercial terms, that content is not used to train its models.

Security

Data is encrypted in transit (TLS) and at rest. Mailbox passwords and tokens get an extra layer of encryption tied to your account. Each customer can only ever see their own records.

Deleting your data

You can disconnect your mailbox at any time in Settings, which deletes the stored token or password. You can delete your account in Settings; this deletes your account and everything listed above, stops our notifications from Microsoft, and cancels your subscription. Database backups are overwritten within 30 days. Stripe keeps billing records as the law requires. You can also revoke Emlio's access from your Microsoft or Google account settings.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it by emailing [SUPPORT EMAIL]. Depending on where you live you may have additional rights; we will honor them.

Children

Emlio is a business tool and isn't meant for anyone under 18.

Changes

If we make important changes, we'll email account holders before they take effect.

Contact

[COMPANY LEGAL NAME, e.g. Your Business, LLC], [COMPANY MAILING ADDRESS]. Email: [SUPPORT EMAIL].