Privacy Policy

Effective May 23, 2026

At NextEmail.ai, operated by CalMax Systems ("we," "us," or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your information when you use our service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address (required)
• Name (provided via social login or entered manually)
• Password (securely hashed; not stored if you sign in exclusively via Google, Microsoft, or Apple)
• Referral code (if you were invited by another user)

1.2 Email Data

When you connect your email account (Gmail or Microsoft 365), we download and persistently store the following on our servers:

• Email metadata: sender, recipient, subject line, date, message ID, folder/label assignments
• Email body content: plain text and HTML content of your email messages
• Attachment metadata: file names, content types, and sizes (we do not download attachment file content)
• Email headers: authentication results (SPF, DKIM, DMARC) used for threat detection
• Folder and label structure: your mailbox organization as reported by your email provider

Why we store your email data: Persistent storage is required for continuous security scanning (threat detection runs approximately every 60 seconds), AI-powered search, and email organization. Without stored data, we could not provide real-time protection or search functionality.

No human reads your emails. All email processing is performed by our automated AI systems running on our own servers. Your email content is never sent to third-party AI services.

1.3 Billing Information

When you subscribe to a paid plan, payment information (credit card number, billing address) is collected and processed by Stripe. We store only your Stripe customer ID and subscription status — we never see or store your full credit card number.

1.4 Usage Data

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Device information (operating system, app version for mobile users)
• Feature usage patterns (e.g., search queries, dashboard views) to improve our service

1.5 Device Tokens (Mobile App)

If you use our iOS app, we collect your Apple Push Notification service (APNs) device token to send you push notifications. You can disable notifications in your device settings at any time.

2. How We Use Your Information

We use collected information to:

• Provide security protection: Scan emails for phishing, spam, and other threats using our AI models
• Organize your email: When enabled, classify and label emails by sender and topic
• Enable search: Power natural language search across your stored emails
• Auto-unsubscribe: Send RFC 8058 unsubscribe requests for detected spam
• Process payments: Manage your subscription through Stripe
• Send service communications: Billing notifications, security alerts, trial expiry warnings
• Improve our service: Analyze aggregate usage patterns (not individual email content) to improve AI accuracy and features
• Detect abuse: Prevent unauthorized access and enforce our Terms of Service

We do not use your email content to train our AI models. Our AI models are trained on separate datasets and deployed on our servers. Your email data is only used for providing the service to you.

3. Data Storage and Security

Your data security is our priority:

• All data is encrypted in transit using TLS 1.3
• OAuth tokens (used to access your email provider) are encrypted at rest using Fernet symmetric encryption
• We never store your email provider password — access is granted through OAuth 2.0 tokens that you can revoke at any time
• Email data for all users is stored in a single PostgreSQL database, secured with row-level security (RLS) policies that restrict each application process to accessing only authorized data
• Our servers are located in the United States
• AI processing runs on dedicated GPU servers on our own infrastructure — no cloud AI APIs are used

4. Data Sharing

We do not sell your personal information. We may share data only:

• With your consent: When you explicitly authorize sharing
• To comply with legal obligations: In response to valid legal process (subpoena, court order, government request)
• To protect rights and safety: When necessary to enforce our Terms, protect our users, or address fraud
• With service providers: See Section 8 (Sub-processors) for details

5. Automated Decision-Making

NextEmail.ai uses fully automated AI systems to make decisions that directly affect your email. Under GDPR Article 22 and similar regulations, you have the right to understand these decisions:

5.1 Threat Classification

Our AI analyzes each incoming email and classifies it as safe, spam, or phishing. Emails classified as threats are automatically moved to a filtered folder ("AI Filtered Spam") in your email provider. This happens without human review.

Logic: Our AI model (a large language model running locally on our servers) analyzes the email's sender, subject, body content, attachment metadata, and authentication headers to produce a classification. Post-model heuristics check for known threat patterns (brand impersonation, sender spoofing, attachment-based scams).

Significance: Emails classified as threats are moved out of your inbox. You may miss a legitimate email if it is incorrectly classified (false positive).

Your rights: You can review all classified emails in your dashboard. Moving a misclassified email back to your inbox in your email provider overrides our classification. You can contact us to request human review of any classification decision.

5.2 Email Organization

When AI Organize is enabled, our AI assigns category labels (e.g., "AI/Amazon," "AI/Bank of America") to safe emails. This is optional and disabled by default for new accounts.

5.3 Auto-Unsubscribe

For spam emails that include RFC 8058 one-click unsubscribe headers, our system automatically sends an unsubscribe POST request. This only applies to spam categories — never to emails classified as phishing (to avoid interacting with attacker infrastructure).

6. Your Rights

Regardless of your location, you have the right to:

• Access your personal data stored by NextEmail.ai
• Correct inaccurate account information
• Delete your account and all associated data
• Disconnect your email account and stop all processing
• Object to automated decision-making (see Section 5)
• Opt out of marketing communications

To exercise any of these rights, contact us at privacy@nextemail.ai or use the account management features in your settings.

7. Data Retention

We retain your data as follows:

• Active accounts: Email data is retained as long as your account is active and your mailbox is connected
• Disconnected mailboxes: When you disconnect a mailbox, your OAuth tokens are revoked and AI processing stops immediately. Your stored email data is preserved so you can reconnect later. To permanently delete email data, use the "Delete mailbox" option in settings
• Deleted mailboxes: When you delete a mailbox (not just disconnect), all email data for that mailbox is permanently deleted from our database immediately
• Deleted accounts: When you delete your account, all data (account information, email data, subscription records) is permanently deleted immediately
• Lapsed subscriptions: Email data is retained for 30 days after your subscription lapses to allow reactivation, then permanently deleted
• Server logs: Access logs are retained for up to 90 days for security and debugging purposes

8. Sub-Processors (Third-Party Service Providers)

We use the following third-party services to operate NextEmail.ai. These providers process data on our behalf under contractual obligations to protect your information:

Provider	Purpose	Data Shared
Stripe	Payment processing	Email address, payment method (collected directly by Stripe)
Cloudflare	DNS, CDN, DDoS protection (marketing site)	IP address, page requests (marketing site only)
Google reCAPTCHA	Bot prevention on referral invitations	Browser fingerprint, IP address
Microsoft Graph API	Office 365 email access (at your request)	OAuth tokens (encrypted), email data (downloaded to our servers)
Google Gmail API	Gmail email access (at your request)	OAuth tokens (encrypted), email data (downloaded to our servers)

No third-party AI services. Our AI models (for security scanning, email organization, and search) run entirely on our own GPU servers. Your email content is never sent to OpenAI, Google AI, Anthropic, or any external AI provider.

9. Google API Services Disclosure

NextEmail.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use Disclosure

NextEmail.ai's use of information received from Gmail APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Gmail data to provide the email security scanning and threat detection services described to you, and optionally, AI-powered email organization and search
• We do not transfer Gmail data to third parties except as necessary to provide our service, with your consent, or as required by law
• We do not use Gmail data for serving advertisements
• Human review of Gmail data is limited to investigating security issues, abuse, or when required by law, or with your explicit consent

Gmail Permissions We Request

When you connect your Gmail account, we request the following permissions:

• gmail.readonly — To download and analyze your email messages for AI-powered security scanning and threat detection
• gmail.modify — To apply labels to classified emails and move detected threats to a filtered folder
• gmail.labels — To create and manage labels used for AI security classification and optional email organization
• userinfo.email — To verify your email address during OAuth authentication

How We Use Gmail Data

We use your Gmail data exclusively to:

• Detect threats: Analyze email content, headers, and sender information to identify phishing, spam, and email-borne attacks
• Protect your inbox: Automatically move detected threats to a filtered folder and send unsubscribe requests for spam
• Organize email (optional): When AI Organize is enabled, classify and label emails by sender and topic
• Enable search: Power natural language search across your connected Gmail account

What We Do NOT Do With Gmail Data

• We do NOT use Gmail data for advertising or marketing purposes
• We do NOT sell, rent, or share Gmail data with third parties
• We do NOT use Gmail data to build user profiles for advertising
• We do NOT allow humans to read your emails — only our automated AI systems process them
• We do NOT use your Gmail data to train our AI models
• We do NOT send your Gmail data to any external AI service

Revoking Access

You can revoke NextEmail.ai's access to your Gmail data at any time by:

• Disconnecting your Gmail account in NextEmail.ai Settings
• Visiting Google Account Permissions and removing NextEmail.ai

When you revoke access, we will permanently delete your Gmail data from our servers. If you disconnect via NextEmail.ai settings, deletion occurs when you delete the mailbox. If you revoke via Google, deletion occurs within 30 days.

10. Cookies

We use the following cookies:

• Session cookie (essential): Maintains your login session. Required for the service to function.
• CSRF cookie (essential): Protects against cross-site request forgery attacks. Required for security.

We do not use advertising cookies or third-party tracking cookies on our application.

11. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal information, contact us at privacy@nextemail.ai and we will delete it.

12. Data Breach Notification

In the event of a data breach that compromises your personal information:

• We will notify affected users via email within 72 hours of becoming aware of the breach
• We will notify relevant supervisory authorities as required by applicable law
• Our notification will include: the nature of the breach, the data affected, steps we are taking, and recommended actions for you

13. International Data Transfers

Our servers are located in the United States. If you access our service from outside the United States, your data will be transferred to and processed in the United States. By using our service, you consent to this transfer.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on your explicit consent (provided when you connect your email account) as the legal basis for this transfer under GDPR Article 49(1)(a).

14. For Residents of the European Economic Area (GDPR)

If you are located in the EEA, UK, or Switzerland, the following additional terms apply:

14.1 Legal Basis for Processing

• Contract performance (Art. 6(1)(b)): Processing your email data to provide the security scanning, organization, and search services you signed up for
• Legitimate interest (Art. 6(1)(f)): Improving our service, preventing abuse, and maintaining security
• Consent (Art. 6(1)(a)): Sending marketing communications (you can withdraw consent at any time)
• Legal obligation (Art. 6(1)(c)): Complying with applicable laws and regulations

14.2 Your GDPR Rights

In addition to the rights listed in Section 6, you have the right to:

• Data portability: Receive your personal data in a structured, machine-readable format
• Restriction of processing: Request that we limit how we use your data
• Object to automated decision-making: Request human review of any automated classification decision (see Section 5)
• Lodge a complaint: File a complaint with your local data protection authority

14.3 Data Protection Contact

For GDPR-related inquiries, contact our data protection point of contact at privacy@nextemail.ai.

15. For Residents of California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: Request what personal information we collect, use, disclose, and sell
• Right to delete: Request deletion of your personal information
• Right to opt out of sale: We do not sell your personal information
• Right to non-discrimination: We will not discriminate against you for exercising your rights
• Right to correct: Request correction of inaccurate personal information

To exercise these rights, contact us at privacy@nextemail.ai or use the account management features in your settings. We will respond within 45 days.

16. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via email at least 14 days before they take effect. The "Effective" date at the top of this page indicates when this version was last updated.

17. Contact Us