Privacy policy
Effective from 2 September 2026 — last updated: 14 October 2026
This policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR») and describes how personal data is processed for users of themailamber.app website, the Mailamber account and theMailamber applications for Windows and for Android (distributed through Google Play). It is written to be read, not merely published: if anything is unclear, write toprivacy@mailamber.app.
1. Data controller
The data controller (the «Controller») is:
- Antonio Maraucci — sole proprietorship
- VAT number: IT09286091211
- Registered address: Via Raffaele Gasparri 16, 81100 Caserta (CE), Italy
- Privacy contact: privacy@mailamber.app
- Support: support@mailamber.app
No data protection officer (DPO) has been appointed, as the conditions of Article 37 GDPR do not apply to the scale and nature of the processing carried out. For any matter concerning personal data, the point of contact isprivacy@mailamber.app.
2. Your emails stay on your device
Mailamber is built on a local-first architecture. This is not a marketing slogan but a technical constraint we imposed on ourselves, and it is the most important part of this policy:
- The contents of your emails — messages, subjects, bodies, attachments, contacts and your address book with its notes and tags — stay on your device: they are synced, stored and indexed only there and are never copied to or archived on the Controller's servers. The only exceptions are optional features you turn on, described below: the artificial intelligence features, only after your explicit consent (section 10); for the emails you choose to track only, the subject, the recipients' addresses (never Bcc ones) and the message identifier, plus the address of the links tracked with Tracking Pro (section 10-ter); the cryptographic fingerprint of attachments, if you enable their reputation check (section 10-quater); the contacts you save in your address book, if you use the settings shared across your devices (section 10-quinquies).
- Your email account credentials (IMAP/SMTP) and access tokens are encrypted locally — with Windows DPAPI on PC and the Android Keystore on your phone — andnever leave your device: sign-ins with Google or Microsoft are also exchanged directly between your device and the provider.
- The application communicates directly with your mail provider's servers (IMAP/SMTP), with no intermediary operated by the Controller.
Outside the optional exceptions listed above, for this data the Controller is neither controller nor processor: it simply never receives it and cannot access it. It is under your exclusive control, and you can delete it at any time by uninstalling the application or removing its data.
The applications include optional diagnostics (off until you enable them in the settings): if enabled, when a technical error occurs only the error data (type, message, app and OS version) is sent to the Controller — never email content — to a self-hosted service on EU servers. App notifications (new mail, reminders, snoozes) are generated locally on the device: no content passes through any notification service operated by the Controller. The only exception, if you enable them: real-time notifications for sent email tracking, delivered via Google Firebase Cloud Messaging as described in section 10-ter.
Automatic mailbox setup. When you add a mailbox, to find the mail servers on its own the device may query, using only the domain name of your address (e.g. «example.com», never the full address or the password), your provider's server, the public Mozilla Thunderbird configuration database (autoconfig.thunderbird.net) and, in the Android app, Cloudflare's public DNS service (cloudflare-dns.com) to read the domain's MX records. These requests go directly from your device, without passing through the Controller's servers, and are handled by those parties under their own policies.
Remote images. To protect you from tracking pixels, remote images in emails are blocked by default. If you choose to load them — for a single message or always for a sender or domain you trust — your device downloads them directly from the servers named in the message, which can thereby see, as with any email client, your IP address and the time of opening. The list of trusted senders and domains is synchronised across your devices as described in section 10-quinquies.
3. Data processed, purposes and legal bases
The Controller's servers (api.mailamber.app, hosted by Hetzner in Germany, European Union) process only the minimum data needed to manage your Mailamber account:
- the email address of your Mailamber account;
- a hash of your password (argon2id algorithm — never the password in clear text);
- your display name and preferred language;
- your subscription status (plan, billing cycle, renewal dates);
- identifiers of the devices linked to your license, in hashed form, with the device name, platform, app version and date of last use;
- support tickets you submit voluntarily, and their replies;
- requests sent through the website contact form (name, email, subject, message and the sending IP address);
- records of your acceptance of the legal documents and of the AI notice (document, version, date, method, IP address and a pseudonymised fingerprint of your email address);
- settings shared across your devices, stored encrypted (section 10-quinquies);
- technical audit logs (security events, successful and failed sign-ins, IP addresses);
- a security and abuse-prevention log (failed sign-ins, two-step verification lockouts, password reset requests, sign-ups with temporary addresses, exceeded request limits, failed anti-bot checks, attempts beyond the device limit, refunds and payment disputes), where the IP address is not stored in clear but only as a keyed cryptographic fingerprint (HMAC) and as a truncated network (/24 for IPv4, /48 for IPv6), with no email address in clear; any measures taken on the account (suspension, deactivation) with the reason category;
- if you turn on two-step verification (optional): the TOTP secret key, encrypted at rest (AES-256-GCM); recovery codes, stored only as a keyed cryptographic fingerprint (HMAC) and never in clear; the last time step used, to prevent the same code from being reused; short-lived sign-in challenges, valid for 5 minutes; for the “Remember this browser” option, a random token stored only as a hash, the browser’s user-agent string and its creation, last-use and expiry dates (30 days); the related security events (enabling, disabling, wrong codes with IP address) in the audit logs. The data export includes only the verification status and dates, never the secret key or the codes;
- AI usage metadata (feature, model, token counts, cost, outcome — never the content), if you use AI features;
- if you enable sent email tracking (section 10-ter), for each tracked email: message identifier, sending mailbox, subject, addresses of the "To" and "Cc" recipients (never "Bcc"), sending device, times, open and click events with their classification and a pseudonym of the IP address they come from, addresses of tracked links;
- only if you use sent email tracking, a pseudonym of the IP addresses from which you use the Mailamber apps or the account area, kept for 7 days, so that your own views are not counted as opens (section 10-ter).
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating and managing your account, authentication, email verification | Email, password hash, name, language | Performance of a contract — Art. 6(1)(b) |
| Managing licenses and linked devices | Active plan, hashed device identifier | Performance of a contract — Art. 6(1)(b) |
| Subscription management, tax and accounting obligations | Subscription status; billing data processed by Paddle | Performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Assistance and support | Support tickets and their content | Performance of a contract — Art. 6(1)(b) |
| Answering requests sent through the contact form | Name, email, subject, message, IP address | Pre-contractual steps and performance of a contract — Art. 6(1)(b); legitimate interest in preventing abuse for the IP address — Art. 6(1)(f) |
| Proof of acceptance of the legal documents and of consents given | Document, version, date, method, IP address, pseudonymised email fingerprint | Legal obligation to demonstrate consent (Art. 7(1) GDPR) — Art. 6(1)(c); legitimate interest in establishing and defending legal claims — Art. 6(1)(f) |
| System security, fraud and abuse prevention | Technical audit logs, IP addresses; security log with pseudonymised IPs (keyed fingerprint and truncated network) and automatic detection of abuse patterns (no automated decisions: every measure on an account is taken by a person). The anti-bot security check on sign-up, forgotten password and the contact form is a small calculation done by your browser or app and checked by our servers: no third-party service, no cookies; the IP address is used only in memory, for a few minutes, to adjust its difficulty | Legitimate interest — Art. 6(1)(f) |
| Account protection with two-step verification, when you turn it on | TOTP secret key (encrypted), recovery code fingerprints, last time step used, short-lived sign-in challenges, token hash, user-agent and dates of remembered browsers, security events with IP address | Performance of a contract — Art. 6(1)(b); legitimate interest in the security of the account and systems — Art. 6(1)(f) |
| Promotional emails and product news (marketing) | Email, name, language | Consent — Art. 6(1)(a), withdrawable at any time |
| Newsletter (section 8-bis), including the measurement of opens and clicks of each send | Email, language, sign-up source, date, version and fingerprint of the consent text, a pseudonym of the sign-up IP, status and send history, bounces and complaints reported by the provider; for each send whether it was delivered, opened or clicked (yes/no); date of the last open and last click; the account name only for the greeting, if the subscription is linked to your account | Consent — Art. 6(1)(a), with double opt-in, withdrawable at any time (it covers the measurement of opens and clicks); legitimate interest in honouring the unsubscription (pseudonym kept) — Art. 6(1)(f) |
| Artificial intelligence features (section 10) | Text needed by the feature (in transit only, never stored); usage metadata | Explicit consent — Art. 6(1)(a), withdrawable at any time; for features you invoke, also performance of a contract — Art. 6(1)(b) |
| Sent email tracking (section 10-ter) | Message identifier, sending mailbox, subject, "To" and "Cc" recipients, sending device, times, classified open and click events with an IP pseudonym, addresses of tracked links | For your data: performance of a contract — Art. 6(1)(b), when you enable it. For recipients' data the Controller acts on your behalf, as a processor (Art. 28 GDPR): you are the controller (section 10-ter) |
| Recognising your own views of tracked emails, so they are not counted as opens (section 10-ter) | Pseudonym of the IP addresses from which you use the apps or the account area, only if you use tracking (at least one tracked email in the last 12 months) | Performance of a contract — Art. 6(1)(b); legitimate interest in providing reliable read receipts — Art. 6(1)(f) |
| Attachment reputation check (section 10-quater) | SHA-256 fingerprint of attachments (not stored) | Performance of a contract — Art. 6(1)(b), when you enable it |
| Settings shared across devices (section 10-quinquies) | Rules, templates, signatures, sender lists, contacts saved in your address book, smart space names, preferences (encrypted) | Performance of a contract — Art. 6(1)(b) |
| Android app usage statistics (section 10-sexies) | Usage events from a closed list, random installation identifier, plan, app version and language; if active, masked interface interactions (Microsoft Clarity) | Consent — Art. 6(1)(a), withdrawable at any time in the app settings |
Providing the contractual data is necessary to create and use your account: without it, the service cannot be provided. Marketing consent is always optional and refusing it does not limit the service in any way.
4. Payments through Paddle
Subscriptions are sold through Paddle.com Market Ltd («Paddle»), acting asmerchant of record: Paddle sells, collects payment, issues receipts and handles VAT. For payment data (card details, billing address, tax data) Paddle acts as anindependent data controller: the Controller never receives or stores full payment details — only your subscription status. Paddle's processing is described in thePaddle privacy policy.
5. Recipients and processors
Account data is never sold or shared with third parties for commercial purposes. It is processed, on behalf of the Controller or as independent controllers, exclusively by the following parties:
| Party | Role | Activity and place of processing |
|---|---|---|
| Hetzner Online GmbH | Processor (Art. 28 GDPR) | Server and backup hosting — Germany, EU |
| Cloudflare, Inc. | Processor (Art. 28 GDPR) | Storage of the off-site backup copy (Cloudflare R2, EU jurisdiction): backups are encrypted on our servers before upload and Cloudflare does not have the key to read them |
| Paddle.com Market Ltd | Independent controller | Payments, invoicing and VAT as merchant of record |
| Brevo | Processor (Art. 28 GDPR) | Delivery of transactional email and, with consent, of the newsletter and promotional email, with the measurement of delivery, opens and clicks (pixel and links rewritten on the r.em.mailamber.app domain) — EU |
| GitHub, Inc. | Processor (Art. 28 GDPR) | Distribution of application updates — United States, under Standard Contractual Clauses (SCCs) |
| AI model providers (currently OpenRouter, Inc.; OpenAI, L.L.C.; Anthropic, PBC; the list may include other providers) | Processors (Art. 28 GDPR) | Processing solely of the text needed by the AI features you turn on, with your consent (see section 10), with no retention or training — United States, under Standard Contractual Clauses (SCCs) |
| abuse.ch (MalwareBazaar), Bern University of Applied Sciences | Independent controller | Matching the SHA-256 fingerprint of attachments against a public malware archive, only if you enable the reputation check (see section 10-quater) — Switzerland, a country with an adequacy decision |
| Google Ireland Ltd | Independent controller | Distribution of the Android app through Google Play; Google Analytics 4 and Google Tag Manager only with your consent in the cookie banner (see section 9); Google Analytics 4 for the Android app statistics, through our servers,only with your consent in the app (see section 10-sexies) |
| Microsoft Ireland Operations Ltd | Processor (Art. 28 GDPR) | Microsoft Clarity (usability statistics for the website and, if active, the Android app) only with your consent in the cookie banner (see section 9) or in the app (see section 10-sexies) |
| Google LLC (Firebase Cloud Messaging) | Processor (Art. 28 GDPR) | Delivery of push notifications to the Android app (first open and first click of a tracked email), only if you turn these notifications on: device token and minimal notification content (email subject, first recipient, domain of the clicked link) — including the United States, under the EU-US Data Privacy Framework and with Standard Contractual Clauses (SCC) (see section 10-ter) |
Data may also be disclosed to public authorities where required by law.
6. Transfers outside the EU
Account data resides on servers within the European Union. Transfers to third countries are limited to the following cases, all covered by the safeguards of Chapter V of the GDPR (Standard Contractual Clauses under Art. 46(2)(c), or the EU-US Data Privacy Framework adequacy decision):
- distribution of the Windows app updates through GitHub, Inc. (United States), which may process technical connection data such as the IP address;
- processing of the text needed by the AI features you turn on, with your consent, by the model providers listed in section 5 (United States);
- if you enable the attachment reputation check, sending only the SHA-256 fingerprint to abuse.ch (Switzerland, a country with a European Commission adequacy decision);
- the off-site backup copy entrusted to Cloudflare, Inc. (United States), stored in the EU jurisdiction of Cloudflare R2 and encrypted before upload, so Cloudflare cannot read it: access from the United States remains theoretical and is covered by Cloudflare's participation in the EU-US Data Privacy Framework;
- if you turn on tracking notifications in the Android app, the delivery of push notifications through Google Firebase Cloud Messaging (the device token and the minimal notification content may pass through Google servers in the United States, under the Data Privacy Framework and Standard Contractual Clauses);
- only with your consent in the website cookie banner or in the Android app settings, the measurement tools Google Analytics 4, Google Tag Manager and Microsoft Clarity (whose groups may transfer data to the United States under the Data Privacy Framework).
The Controller carries out no other transfers outside the EU.
7. Retention periods
| Category | Retention |
|---|---|
| Account data (email, name, language, password hash, plan, devices) | Until you delete your account, which you can do yourself from the account area; accounts never verified are deleted automatically 7 days after sign-up, unless a purchase was made |
| Settings shared across devices (encrypted) | Until account deletion, or earlier on your request; an item you delete in the app is erased from the servers, which keep only a technical placeholder with no content to propagate the deletion to your other devices |
| Contact form requests | For as long as needed to follow up on the request |
| Records of acceptance of legal documents and consents | 10 years (ordinary limitation period), also after account deletion, in pseudonymised form: the email address is replaced by an irreversible fingerprint |
| Support tickets | Until account deletion |
| Technical audit logs | 12 months |
| Security and abuse-prevention log (pseudonymised IPs) | 90 days, then automatically deleted |
| Two-step verification data (encrypted secret key, recovery code fingerprints, last time step used, remembered browsers) | Until you turn verification off or delete your account, when they are deleted; sign-in challenges expire after 5 minutes and are erased within the following day; remembered browsers expire after 30 days and are forgotten whenever you change or reset your password; security events follow the retention of technical audit logs (12 months) |
| Texts sent to AI features | Never stored on the Controller's servers' disks, databases or logs (in transit only, to generate the response; summary, translation and classification responses may stay for at most 24 hours in an in-memory-only cache reserved to your account); kept by providers for a limited time, solely for abuse prevention and never for training |
| AI usage metadata | 12 months |
| Email tracking data (tracked emails with subject and recipients, open and click events, IP pseudonyms of events, tracked links) | 12 months from the registration of the email or from the event, then automatic deletion; deleted immediately when the account is deleted |
| Pseudonyms of the IP addresses from which you use the apps or the account area (only if you use tracking) | 7 days from last use, then automatic deletion; also deleted when you no longer have tracked emails in the last 12 months; deleted immediately when the account is deleted |
| Device data for push notifications (device token, language, time zone, app version, notification preferences) | Until you sign out of the app, turn tracking notifications off or uninstall the app; in any case deleted 90 days after the last update; deleted immediately when the account is deleted. At Google the notification stays queued for at most 24 hours if the phone cannot be reached |
| SHA-256 fingerprints of attachments (reputation check) | Not stored: at most 24 hours in an in-memory cache |
| Android app usage statistics (only with consent) | Not stored on the Controller's servers (only forwarded); Google Analytics 4: event-level data 2 months; Microsoft Clarity: recordings 30 days, aggregated data up to 13 months; on the phone, pending events at most 72 hours. On withdrawal the random identifier is deleted from the phone |
| Newsletter | Unconfirmed sign-ups: 30 days. Subscribers: until they unsubscribe. After unsubscribing, the data is deleted within 30 days and only a pseudonym of the address is kept, so we never write to you again. Send history (with the delivered, opened and clicked yes/no) and provider events: 12 months. Date of the last open and last click: as long as you stay subscribed. Issue statistics (opens, clicks per link): aggregate only, with no personal data. After 12 months without opens or clicks we ask whether you want to stay; without a reply within 30 days the subscription ends |
| Encrypted backups | 30 days: deleted data leaves the backups permanently within that period |
| Tax and billing records | Kept by Paddle for the periods required by applicable tax law |
8. Transactional and marketing email
Transactional emails — account verification, password reset, account security alerts, receipts and subscription notices — are necessary to provide the service and are sent on a contractual basis (Art. 6(1)(b) GDPR).
Technical measurement in service emails. We send emails through Brevo (processor, EU), which automatically adds a small image to every message and rewrites links on the r.em.mailamber.app domain to measure delivery, opens and clicks. For service emails we only use this information in aggregate, to check that emails arrive (deliveries, bounces, spam filters) and for the security of the service, never to profile you or for promotional purposes. Legal basis: legitimate interest in reliable and secure communications (Art. 6(1)(f) GDPR). Opens and clicks of service emails stay in Brevo's logs, for the provider's retention periods, and are not stored in our databases. If your email app blocks remote images (as Mailamber does) the open is not recorded; you can object by writing toprivacy@mailamber.app.
Promotional emails (product news, offers) are sentonly with your explicit consent, collected separately and never a condition for using the service. You can withdraw consent at any time, with a single click: via the unsubscribe link in every email or the toggle in your account area. Withdrawal does not affect the lawfulness of processing carried out beforehand.
New-version notices. With each release we send registered users a short email about what's new in that version: the legal basis is our legitimate interest in keeping you informed about the software you use (Art. 6(1)(f) GDPR). You can turn these off at any time, with a single click, via the link at the bottom of every notice; security-related notices remain service communications sent on a contractual basis.
In-app promotional suggestions. Inside the application, suggestions may occasionally appear promoting exclusively Mailamber products and services: the features of higher plans (Free and Plus plans), the add-ons that can be purchased and the other Mailamber apps (all plans, Premium included). Legal basis: the Provider's legitimate interest in promoting its own services (Art. 6(1)(f) GDPR). To select them the app usesonly account data already processed to deliver the service: the active plan (Free/Plus/Premium), the active add-ons and the types of device linked.No email content is ever read or analysed for promotional purposes, no additional data is collected or sent to our servers, no profiling takes place, and there is no third-party advertising. The suggestion for an add-on disappears once the add-on is active; the Premium plan shows no invitations to change plan.
Presenting the other Mailamber apps (all plans). Regardless of the plan, the PC app may present the Android app (with a QR code to Google Play) and the Android app may present the Windows app. To decide whether to show it, the app uses only the list of devices already linked to your account (already processed to manage licences) and, on the device, whether you dismissed it: if a device of that type is already linked, the presentation does not appear. No email content is used and no additional data is collected. Legal basis: legitimate interest in making the apps included in the service known (Art. 6(1)(f) GDPR).
8-bis. Newsletter
The Mailamber newsletter is optional and separate from promotional email: usually every two weeks it tells you about new blog articles, new versions of the Windows and Android apps, a feature worth knowing and a few email tips. Only people who subscribe receive it.
Legal basis and double opt-in. Processing is based on yourconsent (Art. 6(1)(a) GDPR), given with a checkbox that is never pre-ticked. Sign-ups from the website forms only take effect after you click the confirmation link we send you (valid for 7 days, single use). If you subscribe while creating an account, confirmation happens when you verify the account's address, with no second email; from the account area, with an already verified address, the subscription takes effect immediately. For each subscription we record the date, source, version and fingerprint of the consent text and a pseudonym of the IP address computed with a secret key, as proof of consent.
Opens and clicks. Like most newsletters, ours go through the sending provider Brevo, which adds a small image to every email to measure opens and rewrites links (domain r.em.mailamber.app) to measure clicks. This measurement is part of the newsletter consent. Brevo sends us the events by webhook and we keep only: the aggregate totals of each issue (deliveries, opens, automatic proxy opens such as Apple Mail Privacy Protection, clicks and clicks per link); for each send whether it was delivered, opened or clicked (yes/no), to compute unique figures; for each subscriber the date of the last open and last click. We don't keep a list of your opens or of which links you clicked, we do no profiling and we don't sell or share this data. We use it to understand which content is of interest and to keep the list clean. If your email app blocks remote images (as Mailamber does), the open is not recorded.
List hygiene. If for 12 months you don't open or click any newsletter (automatic proxy opens don't count), we write to you once to ask whether you want to keep receiving it. Opening that email, clicking a link or pressing "Yes, keep me subscribed" is enough; without a reply within 30 days the subscription ends, just like an unsubscription.
Recipients. Emails are sent through Brevo (processor, EU), which measures deliveries, opens and clicks and reports bounces, complaints and unsubscriptions to us. People who subscribed to our Brevo list with double opt-in may be moved to the newsletter keeping the date and source of their original consent.
Retention. Unconfirmed sign-ups are deleted after 30 days. Subscriber data is kept until you unsubscribe; after that it is deleted within 30 days and only a pseudonym of the address remains, to honour your choice and never write to you again (legitimate interest, Art. 6(1)(f)). Send history (with the delivered, opened and clicked yes/no) and provider events are deleted after 12 months; the dates of the last open and last click are kept while you are subscribed. Aggregate issue statistics contain no personal data.
How to unsubscribe. With one click from the link at the bottom of every issue (and from your email app's "Unsubscribe" button), from the preferences page linked in every email, from the account area, or by writing toprivacy@mailamber.app. Unsubscribing also withdraws consent to the measurement of opens and clicks. Withdrawal does not affect the lawfulness of earlier sends. The data export in the account area includes the newsletter (with the last open and last click); deleting your account also deletes the subscription.
9. Cookies and measurement tools
By default the website uses only technical cookies (the session cookies of the account area) and the browser's localStorage for the language and your consent choice. We may activate anonymous measurement tools (Google Analytics 4, Microsoft Clarity, also via Google Tag Manager): in that case a banner appears and the tools load only after your explicit consent, which you can withdraw at any time; without consent no non-technical cookie is set. The demo video on the home page is hosted on our servers and contacts no third party. No advertising profiling, in any case. Full details, including the cookie table and the withdrawal button, are in the cookie policy.
10. Artificial intelligence features (optional)
Mailamber includes some artificial intelligence features. They are alloptional: the app remains fully usable without ever turning them on, andno content from your mailbox is sent to AI until you turn a feature on and accept the AI notice shown in the app. You can withdraw your consent at any time in the settings: from then on nothing is sent. The local-first architecture described in this policy applies to all core functions (sync, reading, search, organisation): AI features are the one exception, and only within the limits described here.
On-demand features (Plus and Premium plans). When you press an assistant command — «Generate», «Revise», «Summarise», «Translate», a quick reply, subject or HTML template generation — only the text that command needs is sent: the description of the email to write, your draft, the text of the email to summarise or translate or, when you reply or forward, the message you are referring to.
Automatic features (all plans, off until you turn them on). Some features work automatically on new messages, but only after you have turned them on and accepted the AI notice:
- AI Smart Priority: for new incoming messages, the sender, subject and a short excerpt (at most 140 characters) are sent in small batches to suggest a priority label (e.g. «reply now», «deadline»). Learned rules stay on your device.
- Smart Spaces with AI assistance: for senders the local classifier does not recognise, the sender's address and name and up to two subjects are sent to suggest a category (e.g. «finance», «travel»).
Without activation these features only use local rules, on your device. The rest of your mailbox, your archive and your attachments are never transmitted.
Model providers. The text is sent to the Controller's servers and forwarded to one of the AI model providers, selected and updated over time for quality and reliability: currently OpenRouter, Inc. (which routes requests to models by various producers), OpenAI, L.L.C. and Anthropic, PBC. Providers are based or run servers mainly in the United States: transfers rely on Standard Contractual Clauses (SCC) and, where applicable, the EU-U.S. Data Privacy Framework.
No training, no retention. Your content is never used to train AI models: on OpenRouter, requests are routed exclusively to providers that neither retain the data nor use it for training; OpenAI and Anthropic contractually do not use data received through their APIs to train their models. On the Controller's servers the content is in transit only for the time needed to generate the response and is never logged to disk, database or logs: only metadata (feature, model, tokens, cost, outcome) is kept, for 12 months. To avoid repeating identical requests, summary, translation and classification responses may be kept for at most 24 hours in anin-memory-only cache, reserved to your account and never shared with other users. Providers may temporarily retain requests, under their own policies, solely to prevent abuse.
Security. Email text is treated as untrusted data: requests are built so that instructions contained in an email are not executed by the model (protection againstprompt injection), and structured responses are revalidated by the server before they reach the app.
Legal basis. Your explicit consent (Art. 6(1)(a) GDPR), collected with the AI notice in the app and withdrawable at any time without affecting the lawfulness of earlier processing; for features you invoke, also performance of a contract (Art. 6(1)(b)).
Transparency, limits and human control. In all cases:
- AI features are clearly labelled in the app, in line with the transparency obligations of Article 50 of Regulation (EU) 2024/1689 (the «AI Act»): the assistant's proposals carry the label "Generated with AI" before you decide to use them and, next to every AI input or result, a notice reminds you that the text is generated by AI;
- results are generated automatically and may be inaccurate or incomplete: always check them before use; they are not professional advice;
- AI-generated content is a suggestion: you always decide whether to insert, edit or discard it, and the AI never sends an email on your behalf; priority labels and categories only help organise your mail and are not used to evaluate people, for profiling or for advertising;
- no automated decision-making producing legal or similarly significant effects on you (Art. 22 GDPR);
- like the account, AI features are reserved for people with legal capacity to enter into contracts (Terms, section 3) and are not intended for minors.
Features, providers, limits and how to turn AI off are explained in plain words on the pageAI in Mailamber.
10-bis. Google services (Gmail access) and Sign in with Microsoft
If you connect a Gmail or Google Workspace mailbox with "Sign in with Google", Mailamber accesses it exclusively through the IMAP and SMTP protocols with OAuth authorization (scopehttps://mail.google.com/, the only one that allows IMAP/SMTP access), to show you and manage your mail in the app: reading, searching, organising and sending messages. Access tokens are exchanged directly between your device and Google, are encrypted (Windows DPAPI on PC, Android Keystore on your phone) and stay on your device only; if you remove the account from Mailamber, the authorization is also revoked with Google. Messages are downloaded and stored solely in the local database on your device, like any other account.
Mailamber's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. In particular:
- Gmail data is transferred to third parties only when you turn on an AI feature (section 10), limited to the text needed and solely to provide that feature to you, or where required by law;
- Gmail data is never sold and is not used or transferred for advertising, profiling, credit-worthiness assessment or any purpose unrelated to the app's features;
- Gmail data is not read by humans, except with your explicit consent for specific messages (for example if you send them to us in a support ticket), for security purposes (investigating abuse) or where required by law;
- Mailamber does not use data obtained through Google Workspace APIs, including Gmail data, to develop, improve or train generalized artificial intelligence or machine learning models, and does not allow AI providers to do so.
Sign in with Microsoft. If you connect an Outlook.com, Hotmail or Microsoft 365 mailbox with "Sign in with Microsoft", Mailamber accesses it in the same way, through IMAP and SMTP with OAuth authorization (scopes IMAP.AccessAsUser.All,SMTP.Send and offline_access, plus the identity scopesopenid and email, used only to learn the mailbox address). Here too, tokens are exchanged directly between your device and Microsoft, are encrypted (Windows DPAPI on PC, Android Keystore on your phone), stay on your device only and are deleted when you remove the account from Mailamber; you can also revoke the authorization at any time from your Microsoft account settings. Mailbox data is handled with the same safeguards described above for Gmail: no sale, no advertising use, no AI model training.
10-ter. Sent email tracking (optional)
Tracking is off by default: you turn it on, for a single email while you write it or, from the app's Settings, for all new messages. Tracked emails include a transparent 1×1 pixel image hosted on our servers. With the optional Tracking Pro add-on, the links you insert are also rewritten to a redirect address on our servers, which records the click and takes the reader straight to the original page; links contained in messages you quote when replying or forwarding are not tracked.
What data we keep. To show you read receipts on all your devices (PC and phone) and to tell real reads from automatic opens, for each tracked email our servers keep:
- the message identifier (Message-ID), the address of your mailbox it is sent from, the subject (up to 300 characters) and the addresses of the "To" and "Cc" recipients (up to 50;never "Bcc" recipients);
- the device you sent it from (PC or phone), the registration and sending times, the time of the first signal received from the recipient's side, the random code of the message and, with Tracking Pro, the original address of tracked links;
- for each request to the pixel or to a tracked link: date and time, type (open or click), the link clicked, a generic class of the program that made the request (for example "Gmail proxy" or "browser") and the classification of the event: counted open, or excluded because it came from an automated system (bot or security scanner), from an automatic Apple Mail open (Mail Privacy Protection), from your own view or from a duplicate;
- a pseudonym of the IP address the request comes from, computed with a secret server key (HMAC-SHA256): the address cannot be derived from the pseudonym without that key, which stays on the server. It is used only to recognise your own views, duplicates and the bursts of clicks typical of scanners.
We do not keep the IP address in clear, the user-agent string, the location or other information about the recipient's device, nor the body or attachments of the email, which stay only on your device and with your email provider.
Your own views do not count. To recognise them, the server keeps the pseudonym (computed the same way) of the IP addresses from which you use the Mailamber apps or the account area: an open or click coming from a network from which you used Mailamber in the last 24 hours is treated as yours and is not counted. These pseudonyms are recorded only if you use tracking, that is if you have at least one tracked email in the last 12 months: the first one is recorded when you track your first email, the following ones whenever you use the service with your account. If you do not use tracking, we keep no pseudonym of your IP addresses. They are deleted 7 days after last use and in any case when you no longer have tracked emails in the last 12 months. As a consequence, opens by people who share your Internet connection (for example colleagues on the same office network) are not counted either.
You can turn this off with the "Exclude opens and clicks from my network"option in the app settings (on by default). If you turn it off, opens and clicks from your network are counted like those of any other recipient, the pseudonyms of your IP addresses aredeleted immediately and we record no new ones until you turn it back on; opens from the last 7 days that were already recorded are recounted. Turning it off therefore reduces the data we keep.
Real-time notifications. If you turn them on, the apps alert you at the first open and the first click of a tracked email. On the PC, and on the phone while the app is open, the alert comes through the direct connection with our servers. To alert you even when the Android app is closed, the phone registers a device token with our servers (a random identifier of the app installation, issued by Google), together with language, time zone, app version and notification preferences (sound, quiet hours); our servers send the notification through Google Firebase Cloud Messaging, which delivers it to the phone. The notification contains only what is needed to show it: email subject, first recipient, domain of the clicked link and the random code of the message. The token is deleted when you sign out of the app, turn these notifications off or uninstall the app, and in any case after 90 days without updates. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for the feature you turn on.
Roles and legal basis. For your recipients' data you are the data controller: you decide whether and which emails to track. Mailamber processes this data on your behalf, as a processor (Art. 28 GDPR), only to provide the feature to you, and does not use it for any other purpose: no profiling, advertising or disclosure to third parties. The terms of this processing (instructions, confidentiality, security measures, sub-processors, assistance, deletion and breach notification) are set out in the data processing clause of the Terms of Service (section 10-bis), pursuant to Art. 28(3) GDPR. You determine the legal basis for using tracking; usually it is your legitimate interest in knowing whether and when your emails are read (Art. 6(1)(f) GDPR). Consider whether and how to inform your recipients and, where the applicable rules require it (for example for marketing communications or under the rules on the confidentiality of electronic communications), obtain their consent.
If you receive a tracked email. You can avoid tracking by turning off the automatic loading of images in your email program (as Mailamber does by default for the mail you receive) and by not opening tracked links. To exercise your rights you can contact the sender, who is the controller; if you write toprivacy@mailamber.app, we assist the sender in handling your request.
Retention and deletion. Tracked email data and the related events are deleted automatically 12 months after the registration of the email or of the event; the pseudonyms of the IP addresses from which you use Mailamber 7 days after last use. If you delete your Mailamber account, all tracking data is deleted immediately (and from encrypted backups within 30 days). The data export from the account area also includes tracking data: tracked emails with status, counters and links, and open and click events with time and classification; it does not include IP pseudonyms, which are technical values usable only on the server and, for events, relate to recipients (your right of access is unaffected: you can ask us for those relating to you at privacy@mailamber.app). On the Free plan, tracked emails include a "Sent with Mailamber" signature linking to this site.
10-quater. Attachment security checks
The app checks attachments on your device, before you open them, with local analysis rules and, on Windows, with Microsoft Defender. Defender is a Windows component: depending on your Windows Security settings it may send samples to Microsoft, and you can manage this there.
If you enable the reputation check (off by default), the app sends our servers only the SHA-256 fingerprint of attachments received in the last 30 days, which is matched against abuse.ch's public MalwareBazaar malware archive. The file cannot be reconstructed from its fingerprint; we do not store it (it stays at most 24 hours in an in-memory cache, to avoid repeated requests) and no other data about the attachment or the message leaves your device.
10-quinquies. Settings shared between PC and phone
To keep your settings aligned across the devices linked to your Mailamber account, the app sends our servers:
- rules, templates and signatures;
- blocked senders;
- the trusted senders and domains whose remote images you have chosen to always load;
- the list of senders and domains marked as spam, which the app learns when you use «Mark as spam» to move their future messages to the junk folder (the move happens on the device);
- the contacts saved in your address book (name, email addresses, phone, company, postal address, notes, groups, favourite) and their changes or deletions. The history of the people you exchange emails with, which the app derives from your mail to suggest recipients and sort your contacts, stays only on the device and is never sent;
- custom smart space names;
- preferences (theme, interface colour and density, language, notification sounds and volume, quiet hours, default tracking, Smart Priority).
Rules, signatures, lists and saved contacts contain personal data of third parties (names, email addresses and any other details you enter, e.g. a blocked sender or a client's card): you process them for your own purposes, and we store them encrypted solely to synchronize them across your devices. Email contents, passwords, access tokens for your mailboxes and device-specific settings are never sent.
This data is stored on the Controller's servers in the European Union (Hetzner, Germany),encrypted at rest (AES-256-GCM, with a separate key for each user derived from a key held on the server: this is not end-to-end encryption, because your devices must be able to recover your settings even after a password reset). It is used only for synchronization and deleted together with your account; it is included in your data export. You can turn synchronization off on each device in the app Settings: from then on that device sends and receives nothing, while the copy already on the servers remains until you delete your account; you can ask for its earlier deletion by writing toprivacy@mailamber.app. Legal basis: performance of the contract (a feature of the service).
10-sexies. Android app usage statistics (optional)
To understand which features are used, where the app gets stuck and how to improve it, the Android app can collect usage statistics. They are off until you turn them on: after you set up your first mailbox the app asks you with a non-blocking notice ("Allow" / "No, thanks", given equal prominence) and you can change your mind at any time inSettings → Privacy and statistics. Before consent nothing is recorded or sent and no identifier exists. Legal basis: consent (Art. 6(1)(a) GDPR; Art. 122 of the Italian Privacy Code and Art. 5(3) of the ePrivacy Directive for storage on the device).
What is collected.
- usage events from a closed list defined in the app's code: app opening and session duration, screens visited, first-run steps, mailbox added (only the type: IMAP, Gmail, Microsoft or PEC), error categories for sync and sending (e.g. "authentication", "network"), compose opened and message sent (message type, tracking on/off, number of recipients), type of AI feature used, template use, tracking toggled, views and taps of plan and add-on suggestions, settings changed (only which one and the new state), help and support opened, crash-free session flag;
- general properties: plan (Free, Plus, Premium), app version and language, platform;
- a random identifier generated on the phone when you consent: it is not derived from your account, your email address, the device identifier or the Android ID, and it is not linked to your Mailamber account.
Never collected: email content, subjects, addresses (yours or your correspondents'), contact names, text you write or generate, folder names, passwords or tokens. The app only accepts predefined values (no free-text field) and our servers discard any event or value outside the list.
Google Analytics 4. Events do not go to Google directly: the app sends them to our servers (EU), which check them again and forward them to Google Analytics 4 (Google Ireland Ltd) with the Measurement Protocol, to the European collection endpoint. Google does not receive your IP address or information about your device; advertising signals are always denied (no ad personalisation, no use for advertising). Our servers do not store the events. The app contains no Google Analytics or Firebase SDK.
Microsoft Clarity (if active). If we have activated it, under the same consent the app also uses the Microsoft Clarity SDK (Microsoft Ireland Operations Ltd), which reconstructs your interaction with the interface (taps, scrolls, screens) to find usability problems. The project is configured with strict masking (text and fields are masked before leaving the phone) and, in addition, recording is paused on every screen that shows personal data: message list, reading, writing, contacts, account, mailbox setup, sender lists, tracking, follow-ups, templates, signatures, rules, devices, support tickets, newsletter unsubscribes, sign-in (including two-step verification) and sign-up. Clarity also receives technical device information (model, OS version, screen size) and the IP address needed for the connection; the only tags we attach are the plan and the app version, never an account identifier.
Retention. In Google Analytics 4 event-level data is kept for 2 months, after which only aggregated reports remain; in Microsoft Clarity recordings are kept for 30 days and aggregated data (e.g. heatmaps) for up to 13 months. On the phone, events waiting to be sent are kept for at most 72 hours.
Withdrawal. Turning the switch off in Settings → Privacy and statistics stops sending immediately and the app deletes the random identifier, pending events and session data from the phone; Clarity is paused at once and does not start again on later launches. Since the identifier was random and has been deleted, data already sent can no longer be traced back to your phone; if you turn statistics back on a new one is generated. Uninstalling the app also deletes the identifier. Withdrawal does not affect the lawfulness of earlier processing. Google and Microsoft may transfer data to the United States under the EU-US Data Privacy Framework (section 6).
11. Your rights and how to exercise them
We apply the protections described in this notice to all users, wherever they live; if the law of your country grants you additional rights, you can exercise them via the same contacts listed below.
Under Articles 15-22 GDPR you have the right to obtain from the Controller access to your personal data, rectification, erasure (the «right to be forgotten»), restriction of processing, data portability in a structured, machine-readable format, as well as to object to processing based on legitimate interest and to withdraw any consent at any time.
You can exercise your rights in two ways:
- self-service, from your account area: data export, profile changes, marketing consent management and permanent account deletion;
- by email, writing toprivacy@mailamber.app: we reply without undue delay and in any event within one month (Art. 12 GDPR).
If you believe the processing infringes the GDPR, you also have the right to lodge a complaint with the Italian supervisory authority, theGarante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome —www.garanteprivacy.it) under Article 77 GDPR, or with the supervisory authority of your Member State of residence, without prejudice to any other administrative or judicial remedy.
12. Changes to this policy
This policy is effective from 2 September 2026, last updated on 14 October 2026. We may update it to reflect changes in the service or in the law: material changes will be communicated by email to registered users with reasonable notice, together with a notice in the account area and in the apps summarising the changes, and every version published on this page will state its effective date.
This policy is informational (Articles 13 and 14 GDPR): it is not a contract and does not require your consent. In the notice we only ask you to take note of it; your confirmation of reading, or your continued use of the service after the date stated in the notice, is recorded only as proof that you were informed. Processing based on consent (for example promotional communications or measurement cookies) remains subject to your specific consent, which you can give or withdraw separately; an update to this policy never introduces new consent-based processing without asking you.