Data processing agreement

We process Customer personal data only on the Customer's documented instructions. Those instructions are the Terms, this agreement, the settings the Customer's users choose in Mailbridge, and the requests their authorised users and AI clients make through it. If we believe an instruction breaks data protection law, we'll say so. If the law requires us to process data otherwise, we'll tell the Customer first unless the law forbids it.

Everyone we authorise to process Customer personal data is bound by a duty of confidentiality.

We apply the technical and organisational measures in Annex 2, and keep them appropriate to the risk.

The Customer authorises the sub-processors listed in Annex 3. We will give at least 30 days' notice by email before adding or replacing one, and the Customer may object on reasonable data protection grounds; if we can't resolve the objection, the Customer may end the service. Each sub-processor is bound by data protection terms no less protective than these, and we remain responsible for its performance.

• Data subject requests: users can export or delete their data themselves under Your data. We'll help with any other request within a reasonable time.
• Impact assessments: we'll provide the information the Customer reasonably needs for a data protection impact assessment or consultation with a regulator.
• Breaches: we'll notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with the information we have and updates as we learn more.

When an account is deleted, its stored data is deleted straight away (see Annex 1 for what that covers). Copies in database backups roll off within 14 days. The Customer can download its data before deleting the account.

We'll make available the information needed to show we meet this agreement. Once a year, or after a breach, the Customer may audit our compliance through an independent auditor bound by confidentiality, with 30 days' notice, at its own cost, and without access to other customers' data.

Where Customer personal data is transferred outside the UK (or the EEA, for EU data), we rely on adequacy regulations or decisions, or on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, as applicable.

Subject matter

Providing Mailbridge: connecting the Customer's mailboxes and calendars to AI clients chosen by its users.

Duration

For as long as the Customer has an account, then until deletion is complete.

Nature and purpose

Reading, searching, drafting, sending, organising and scheduling email and calendar items on the instructions of the Customer's users; storing mailbox credentials and an activity log; sending sign-in and reconnect emails.

Personal data

Names, email addresses, message content and attachments, calendar entries, and any other data contained in email, which may include special category data the Customer receives.

Data subjects

The Customer's users, the people they correspond with, and meeting participants.

Stored data

Account and session details, mailbox connection details, encrypted credentials, the activity log (no message bodies) and short-lived working data. Mail and calendar content is read on request, not kept.

• HTTPS for all traffic; verified TLS to IMAP and SMTP servers; refusal of private and internal network addresses.
• AES-256-GCM encryption of credentials, activity log and working data; session and AI tokens stored only as hashes; the encryption key held in the hosting platform's secret store, never in the database or code.
• Strict per-user isolation: every stored record and every request is bound to one user.
• OAuth 2.1 with PKCE for AI clients; single-use, rotating refresh tokens, with reuse revoking the whole connection.
• Least privilege: delegated Microsoft permissions only (no app-wide access), writes off by default, per-mailbox permission levels and recipient-domain limits, no permanent delete.
• Rate limits on sign-in and on the MCP endpoint; CSRF and same-origin checks on the console.
• An activity log of every write and send, without message bodies; logs that exclude tokens, credentials and message content.

Replit, Inc. (USA)

Application hosting and database, on Google Cloud in the EU.

SMTP2GO

Delivery of sign-in codes and reconnect alerts (user email addresses only, no mailbox content).

Stripe

Payment processing for paid plans (billing details only, no mailbox content).

Microsoft and IMAP providers are not our sub-processors: they are the Customer's own mail providers, which Mailbridge contacts on the Customer's instructions. The same applies to the AI clients its users connect.

Questions about this agreement: privacy@mailbridge.ai.