Privacybeleid

1. Introduction

This Privacy Policy explains how Sefaja ("we", "our", "us"), operator of the Saymail product, collects, uses, and protects your personal information when you use our website (saymail.eu), the Saymail desktop application (Windows, macOS, Linux), and the Saymail mobile applications (Android and iOS). Our full company details are listed on theImprint page.

Sefaja is established in the European Union, so an Article 27 GDPR representative is not required.

2. Information We Collect

2.1 Account Information

When you purchase Saymail, we collect your email address and order information. Payment processing is handled by our Merchant of Record, Lemon Squeezy, which is also responsible for collecting and remitting applicable VAT / sales tax and issuing invoices. We do not store credit card details. Order receipts will name Lemon Squeezy as the seller of record.

Marketing identifiers at checkout. If you have accepted theMarketing cookie category (Section 2.9) and then proceed to our hosted checkout, a small set of advertising identifiers is passed to the Lemon Squeezy checkout as custom order fields so that a completed purchase can be attributed to the ad you clicked: the Google click identifier (gclid), the Meta browser and click identifiers (_fbp and _fbc), and a marketing-consent flag. These identifiers are used solely for advertising conversion measurement (see Section 2.9) and are notattached to checkout if you have not accepted marketing cookies.

2.2 License and Activation Data

We store your license key, activation status, and machine identifiers used to enforce per-machine activation limits. The machine identifier is a hardware-derived hash; where we additionally store a computer name, it is stored in a non-reversible (hashed) form.

• Legal basis: performance of the licensing contract between you and Sefaja (GDPR Art. 6(1)(b)) and our legitimate interest in preventing license abuse (GDPR Art. 6(1)(f)).
• Retention: for the lifetime of the license, plus up to 24 months thereafter for anti-abuse and accounting purposes. Upon a verified deletion request we replace identifying records with an anonymised license token so license validation continues to function.
• Revocation: you can deactivate a machine at any time from your customer dashboard or by emailing support@saymail.eu.

2.3 Mailbox Verification for Free Credits

New Saymail installations receive a one-time allocation of free Saymail Cloud credits. To make sure that allocation is granted once per person rather than once per reinstall, we verify that you control the first mailbox you connect, and record a one-way cryptographic hash of that email address. We do not store the email address itself - the hash is computed on our servers using a secret key, cannot be reversed back into an address, and is used for nothing except recognising that this mailbox has already received its free credits.

Verification happens automatically as part of connecting your account, and works one of two ways depending on the provider. For Google and Microsoft accounts, the app forwards the OAuth token you have already granted so our server can confirm the address with the provider. For other (IMAP) accounts, our server issues a one-time code and the app sends a single short message from your own account to our verification address; that message exists only to prove control of the mailbox and its contents are not read or retained.

• Legal basis: our legitimate interest in preventing abuse of a free allocation (GDPR Art. 6(1)(f)), and performance of the contract for the free tier (GDPR Art. 6(1)(b)).
• Retention: the hash is retained for as long as the associated Saymail account exists, and is deleted when the account is deleted.
• What is not collected: no plaintext email address, no mailbox contents, and no credentials are stored by this process.

2.4 Email Data

Your email data is stored on your device. When you connect an email account to Saymail, the desktop or mobile application communicates directly with your provider (Google, Microsoft, or any IMAP/SMTP server) from your device and stores the synchronised data in a local database on that device. Sefaja does not store your emails on our servers. The only cases in which email content leaves your device are described in Section 2.5 (AI processing: the automatic importance scoring of newly synced messages, which runs after each mailbox sync when an AI connection is enabled for the account, and the AI actions you trigger yourself) and Section 3 (Google API Services).

The local Saymail database may contain:

• Message headers (From, To, Cc, Bcc, Subject, Date, Message-Id, references)
• Message bodies in plain-text and HTML form
• Attachments, cached locally so they can be opened and re-attached when forwarding
• Folder and label structure, read/unread flags, stars, archive state
• Search indexes derived from your messages
• Drafts you have created in Saymail but not yet sent

The database lives under your operating-system user profile (or in the mobile application's own sandbox) and is protected by the same OS-level access controls as the rest of your user files. Account credentials - OAuth refresh tokens for Google and Microsoft, and IMAP/SMTP passwords for self-hosted accounts - arenot kept in the local database. They are stored in your operating system's secret store (Windows Credential Manager, Apple Keychain, the Secret Service / GNOME Keyring on Linux, or Android Keystore) and never transmitted to Sefaja's servers, with one exception you switch on yourself per account: the encrypted upload described in Section 2.4.1. Any third-party AI provider API keys you supply for BYOK use (Section 2.5.2) are kept in that same secret store and never in the database.

2.4.1 Instant notifications for IMAP accounts ("Canary mode")

If you switch on Instant notifications for an IMAP account in the mobile app, the app encrypts that account's server address, user name and password on your device with a public key whose private half exists only inside Saymail's notification watcher, and uploads the encrypted copy to our backend. The watcher decrypts it in memory to keep a connection to your mailbox's inbox and, when new mail arrives, sends your device an empty "new mail" push. It never downloads, reads, or stores message content, subjects, or senders. The encrypted copy is deleted immediately when you switch the feature off or remove the account, automatically after 30 days without the app being opened, when every device registered for it has gone, or when the mailbox rejects the password. This feature is off by default and never applies to Gmail or Outlook accounts.

• Legal basis: your consent, given per account when you switch the feature on (GDPR Art. 6(1)(a)). You can withdraw it at any time by switching the feature off, which deletes the encrypted copy.
• What our backend stores: the encrypted credential, the identifier of the encryption key it was sealed to, a random routing identifier generated on your device, and timestamps. The mail server address, your user name and your password are not readable by our backend, our database, our backups or our logs.
• Retention: as described above - on switch-off, on account removal, after 30 days without the app being opened, when no registered device remains, or on a rejected password. The watcher drops its in-memory copy at the same time.
• Sub-processor: the notification watcher runs on Fly.io(Fly.io, Inc.) in the Amsterdam, Netherlands region. It holds the decrypted credential in memory only, for as long as the connection to your mailbox is open.

2.4.2 Sender avatars (optional, desktop application)

The desktop application can show a picture next to a sender's name. This is off by default. If you switch on Show sender avatars in the settings, Saymail looks the picture up from public sources directly from your device: it sends a one-way hash of the sender's email address to Gravatar (Automattic Inc.) and the sender's domain name to Google's favicon service (Google LLC). No message content and none of your own account details are sent. Both services receive your IP address as part of the request and process it under their own privacy policies; they act as independent recipients, not as sub-processors on our behalf. Switching the setting off stops the lookups and a plain initials circle is shown instead.

2.5 AI Processing

Saymail offers three ways to use AI features. Each has different privacy implications.

2.5.1 Local model (e.g., Ollama). Email content is processed entirely on your device. No data leaves your device. We have no visibility into local model usage.

2.5.2 Bring Your Own Key (BYOK). If you supply an API key from a third-party AI provider - currently: Anthropic, OpenAI, Google, OpenRouter, or another OpenAI-compatible endpoint you configure - Saymail sends prompts and email content directly from your device to that provider. We do not relay, log, or store this content. Your use of the provider is governed by that provider's privacy policy and terms, not ours, including any data-retention or model-training behaviour the provider may apply to its API. We make no Zero Data Retention claim for BYOK traffic. Your API key is stored in your device's secret store as described in Section 2.4 and is never transmitted to our servers. Saymail transmits message content to the AI provider only for the AI features you use: actions you invoke from the Saymail interface (such as a summary, a suggested reply or a translation) and, for accounts on which you have enabled importance classification, the automatic scoring of newly synced messages, which runs after each mailbox sync - including scheduled syncs - without a per-message action. No other background processing of your mail takes place.

2.5.3 Saymail Cloud credits. When you choose Saymail Cloud, your prompts and email content are sent first to our routing service and then on to OpenRouter(OpenRouter, Inc.), which dispatches the request to an underlying language-model provider. This routing happens only for the AI features you use: actions you invoke from the Saymail interface and, for accounts on which you have enabled importance classification, the automatic scoring of newly synced messages after each mailbox sync (see Section 2.5.2). No other background processing of your mail takes place. For Saymail Cloud traffic, we exclusively configure OpenRouter with the Zero Data Retention (ZDR) options enabled, so OpenRouter and the downstream provider do not retain your content after the request and do not use it to train models. Our own routing service retains only the metadata needed to meter and bill credit usage (timestamp, license identifier, model used, token count, and HTTP status). It does not retain prompt or response content beyond the lifetime of the request, except for short-lived diagnostic logs (≤ 24 hours) used to investigate errors.

The ZDR claim in this section applies only to Saymail Cloud traffic, which we route exclusively through OpenRouter with ZDR options enabled. If you instead use BYOK (Section 2.5.2), the privacy and retention practices of the provider whose key you supply apply to your traffic, and we make no representation about them.

Sub-processor used for Saymail Cloud routing: OpenRouter, Inc. The current list of sub-processors is published atsaymail.eu/legal/sub-processors and is updated when it changes.

2.6 Saymail Cloud Credit Purchases

When you purchase Saymail Cloud credits, we store the transaction (amount, date, license identifier) and the running credit balance. Payment details are handled by our payment processor; we do not store credit card details.

2.6.1 Cloud Sync

If you enable Cloud Sync, the application uploads AI-derived data - importance scores and classifications, your classification prompts, and translations - so that your other devices can apply it. It does not upload your emails, your mail account credentials, or your contacts.

That data is encrypted end-to-end on your device with a key derived on the device itself and shared only with the devices you pair. We store the resulting ciphertext and cannot read it. Losing every paired device and the 24-word recovery phrase means the stored data cannot be recovered by us or by anyone else.

2.7 Desktop and Mobile Application Telemetry

The Saymail applications (desktop and mobile) contact our servers in the following narrowly scoped cases. Where a case applies only to the desktop application, that is noted.

• Update checks (desktop app only). The desktop app periodically requestshttps://saymail.eu/version.json to determine whether a newer version is available. The HTTP request transmits only the metadata that any HTTPS request transmits (your IP address at the moment of the request, an app User-Agent identifying Saymail and its version, and your operating system / architecture). We do not log update-check requests beyond standard short-lived web-server access logs. The Android and iOS applications do not contact this endpoint; updates for those apps are delivered through Google Play and the App Store.
• License validation and activation. The apps communicate with our licensing service (operated by us together with our Merchant of Record, Lemon Squeezy) to validate your license key, register and deactivate activations, and check entitlement to Saymail Cloud credits. The data exchanged is described in Sections 2.1–2.2.
• New-mail push notifications (Android and iOS apps). So that the mobile apps can learn that new mail has arrived without our servers ever holding your mailbox credentials, the apps can register a push route with our server for Gmail and Outlook accounts. Google then notifies our server through Google Cloud Pub/Sub when your Gmail mailbox changes, and Microsoft does the same through Microsoft Graph change notifications for Outlook accounts. Other IMAP accounts are not covered by this service unless you switch on Instant notifications for that account, which is described separately in Section 2.4.1. For each registered account our server stores a routing key, the platform (Android or iOS) and the device push token. For Gmail the routing key is a keyed hash (HMAC-SHA256) of your lower-cased mailbox address under a server-side secret, and the address itself is never stored; to compute it, the app presents your Google access token to our registration endpoint once, purely to read the address, and the token is not retained. For Outlook the routing key is a random identifier generated on your device, and no token is sent. Our server receives no message content, subject, sender or importance score. When a change signal arrives, our server sends a push through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). The Android message contains no text and only wakes the app, which then checks and scores your mail on the device. The iOS message shows a fixed "new email" notification with no message details.
• Crash and error reporting (Sentry, desktop app only). When enabled, the desktop app sends crash reports and unhandled-error events to Sentry (operated by Functional Software, Inc., d/b/a Sentry). Before transmission, every event passes through a redaction step that strips email addresses,Bearer tokens, password / secret / auth / cookie field values, operating-system usernames in file paths, and long opaque token-like strings. File attachments produced by the app are dropped entirely and never transmitted. Crash reports are used solely to diagnose and fix bugs. The Android and iOS applications do not send crash reports to Sentry.
• Crash and freeze reporting (PostHog, mobile apps). The Android and iOS applications send crash reports to PostHog (PostHog, Inc.), hosted in the EU (eu.i.posthog.com). Unlike usage analytics below, this ison by default, because a crash that is never reported cannot be fixed, and the people most affected by a crash are the least able to report it. You can turn it off at any time in Settings under Send crash reports. A report contains the stack trace or, for an unresponsive app ("freeze" / ANR), the thread dump the operating system recorded, together with the app version, device model, operating system version, and the same random per-installation identifier used for usage analytics. It also carries the device licensing identifier so we can connect a crash to a support request. Reports never contain email content, subject lines, email addresses, folder or attachment names, or credentials: error causes are recorded as a fixed set of category codes rather than as free text, and this is enforced by an automated test. Crash reports are used solely to diagnose and fix defects.Legal basis: our legitimate interest in the security, stability, and correct functioning of the applications (GDPR Art. 6(1)(f)).Retention: up to 7 years (84 months).
• Usage analytics (PostHog). When you enable Send usage data (off unless you opt in), the desktop and mobile apps send pseudonymous product-usage events - for example that a feature was used or a screen was opened - to PostHog (PostHog, Inc.), hosted in the EU (eu.i.posthog.com). These events are keyed to a random per-installation identifier that is not linked to your name, email address, or account, and never include email content, contact lists, or credentials. You can turn this off at any time in Settings; turning it off stops all further events.Legal basis: your consent (GDPR Art. 6(1)(a)), given by your affirmative in-app opt-in to Send usage data, which is off by default. You can withdraw it at any time in Settings.Retention: up to 7 years (84 months).
• Server-side product events (PostHog). Up to five events are sent from our backend rather than from the apps. Two are gated on the same Send usage data opt-in:trial started (when a trial is created) and llm call completed(when a Saymail Cloud AI request finishes). Each is keyed to a pseudonymous account identifier (a random UUID), not your name or email. Their properties are limited to non-content metadata - for trial started, the trial length and included credits; forllm call completed, the model used, a coarse purpose category drawn from a fixed list, and your remaining credit balance. They never include email content, prompts, or AI output.
  The third, purchase completed, is sent whenever a Lemon Squeezy order is processed (license purchase or credit pack), and is not gated on theSend usage data opt-in. It is keyed to a pseudonymous identifier - the Supabase account UUID when we already know one for you, otherwise a Lemon-Squeezy-derived id (a customer or order reference) - never your name or email. Its properties are a fixed allow-list of order metadata: the amount paid and currency, the product type, name and variant, the Lemon Squeezy order id, whether it is the first order seen for that identity, and a test-order flag; never email content, prompts, or free text.
  When a purchase made through Google Play or the App Store is verified by our backend, two further events may be sent, purchase completed and purchase failed. Unlike the Lemon Squeezy event above, these are gated on theSend usage data opt-in. They are keyed to the same pseudonymous profile identifier and carry only the store name, the product identifier, the product kind, the number of credits granted, and for a failure a short reason code; never a receipt, purchase token, amount, or any personal data. All of them are sent to PostHog, hosted in the EU.Legal basis (trial started, llm call completed):your consent (GDPR Art. 6(1)(a)), given by your affirmative in-app opt-in toSend usage data, which is off by default. You can withdraw it at any time in Settings.Legal basis (purchase completed): performance of the purchase contract and our legitimate interest in measuring sales (GDPR Art. 6(1)(b) / 6(1)(f)); this event is not consent-gated because it records the transaction itself rather than product usage.Retention: up to 7 years (84 months).

Aside from the pseudonymous usage analytics and product events described above - most of which are sent only if you opt in to Send usage data, except purchase completedwhich is tied to processing your order rather than to app usage - neither the desktop nor the mobile applications transmit your email content, account credentials, or contact lists.

2.8 Website Analytics

Our website may use PostHog (PostHog, Inc.) for privacy-friendly product analytics - page views, feature usage, and aggregated funnel metrics. For visitors from the EU, EEA and United Kingdom, PostHog is loaded only after you accept analytics cookies via the cookie banner; if you reject or ignore the banner, no analytics script is loaded and no analytics cookie is set. For visitors from elsewhere, analytics is enabled by default and the banner is shown as a notice in which you can decline it (Section 8). The site otherwise uses only cookies strictly necessary for essential functionality (language preference, theme, and - if you arrive through an affiliate link - the referral code). This section covers analytics on our website only; the separate, opt-in product analytics sent from the desktop and mobile applications is described in Section 2.7.Retention: website analytics events are stored in the same PostHog project as our product analytics and are retained for up to 7 years (84 months).

2.9 Advertising and Conversion Measurement

With your consent (the Marketing cookie category), our website uses theMeta Pixel (Meta Platforms Ireland Limited) to measure the effectiveness of our advertising and to reach relevant audiences. The pixel loads only after you accept marketing cookies in the cookie banner; if you reject or ignore the banner, no Meta script is loaded and no Meta cookie is set. When active it may set the _fbp first-party cookie and, if you arrived from a Meta ad, record the associated click identifier (_fbc).

With the same consent, our website also uses the Google Ads tag (Google Ireland Limited) for the same purposes. It likewise loads only after you accept marketing cookies; when active it may set the _gcl_aw first-party cookie, which records the Google click identifier (gclid) if you arrived from a Google ad. When you click a download link we record an anonymous "trial download" conversion with Meta and Google so we can measure which ads lead to installs.

If you complete a purchase after consenting to marketing cookies, we additionally send a server-side Purchase event to Meta through the Meta Conversions API and to Google through the Google Ads API. The Meta event contains the purchase value and currency, a one-way hashed (SHA-256) form of your email address, and the _fbp / _fbc identifiers above; the Google upload contains the purchase value, currency, order reference, and thegclid identifier above. Meta and Google use these to attribute the conversion. We do not send these events, and do not attach these identifiers to checkout, unless you have accepted marketing cookies. Legal basis: your consent (GDPR Art. 6(1)(a), and the ePrivacy Directive for the cookie access). You can withdraw consent at any time via the "Cookie preferences" link in the footer.

3. Google API Services and Limited Use

Saymail connects to Gmail using Google's OAuth 2.0 flow and the Google Gmail API. This section describes which Google APIs we access, what data we receive, and how that data is used, transferred, and protected. It is the public statement required by Google'sAPI Services User Data Policy for applications that use restricted Gmail scopes.

Limited Use commitment.Saymail's use of raw or derived user data received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

3.1 Scopes requested

When you connect a Gmail account, Saymail requests the following OAuth scopes, displayed on Google's consent screen at the moment you connect:

• https://mail.google.com/ - restricted Gmail scope. Required to read, organise, compose, send, and permanently delete messages on your behalf. This is the core function of a full email client; Gmail's narrower scopes do not collectively cover all operations Saymail performs (such as expunging messages via IMAP).
• https://www.googleapis.com/auth/contacts.readonly - read-only access to your Google Contacts so Saymail can offer name and address auto-complete when you compose mail, and display sender names for incoming messages.
• email - your Google account's primary email address, used only to identify the connected account in the Saymail account list.

Saymail does not request any scopes that are not used. The scopes shown on Google's consent screen are the complete list.

3.2 What Google data Saymail receives

• Mailbox content: message headers, bodies, and attachments
• Labels, folders, read/unread state, stars, and other Gmail metadata
• Contact names and addresses (read-only)
• Your Google account's primary email address

All of this data is fetched directly from Google's servers to your device. No Sefaja-operated server is interposed in the Gmail data path.

3.3 OAuth token storage

The OAuth refresh token and short-lived access tokens issued by Google are stored in your operating system's secret store - Windows Credential Manager on Windows, Apple Keychain on macOS, and the Secret Service (GNOME Keyring / KWallet) on Linux. They are notwritten to Saymail's SQLite database in plaintext and are never transmitted to Sefaja's servers. You can revoke Saymail's access to your Google account at any time fromyour Google Account permissions page or by removing the account from Saymail.

3.4 Limited Use commitments in detail

Concretely, the Limited Use requirements mean the following for Saymail:

1. Use is limited to user-facing features. Google user data is used only to provide and improve the email-client, search, organisation, classification, drafting, and AI-assistance features the user invokes inside the Saymail application.
2. No advertising use. Saymail does not use Google user data, including any data derived from it, for advertising of any kind. The application contains no ads and Sefaja does not run an advertising business.
3. No human reading. Because Saymail is a local-first application (desktop and mobile) and Sefaja operates no server that holds a copy of your mailbox, Sefaja personnel have no ordinary means of reading your Gmail content. The narrow exceptions permitted by the Limited Use policy apply: (a) with your specific consent - for example, if you choose to attach a redacted message to a support request; (b) where necessary for security purposes such as investigating abuse; (c) where required to comply with applicable law; or (d) for internal operations and only after the data has been aggregated and anonymised so it can no longer identify a user.
4. No use for training generalised AI/ML models. Google user data - and any data derived from it - is not used to develop, improve, or train generalised AI or machine-learning models. In-app AI features call either a local model on your device (Section 2.5.1), a third-party provider whose key you supply (Section 2.5.2, where the provider's own data-use terms apply to your traffic), or our Saymail Cloud routing under a Zero Data Retention configuration that contractually prohibits the downstream provider from retaining or training on your content (Section 2.5.3).
5. No data transfer except as necessary. Saymail does not sell, rent, or share Google user data. Google user data is transferred off your device only when (a) you initiate a network operation against Google (sync, send, delete) which is the entire purpose of the application; (b) an AI feature that uses BYOK or Saymail Cloud processes a message - an action you invoke, or the automatic importance classification you have enabled for the account (Section 2.5); (c) transfer is required to comply with applicable law; or (d) it is necessary to investigate a specific security incident.

3.5 Telemetry and Google user data

Saymail's optional crash- and error-reporting transport (Sentry, described in Section 2.7) runs every event through a redaction step before transmission that strips email addresses, bearer tokens, password / secret / auth / cookie field values, operating-system usernames in file paths, and long opaque token-like strings. Attachments and message bodies produced by the application are dropped entirely. This redaction is a Limited Use safeguard: it prevents Google user data from being transmitted to Sentry as a side-effect of diagnosing a crash.

3.6 Retention and deletion

Because Sefaja does not store a server-side copy of your Gmail data, we have no Gmail data to delete when you uninstall Saymail or disconnect a Google account. Locally, removing the account from Saymail deletes the synchronised mailbox content and tokens from your device, and uninstalling Saymail removes the local database. You can additionally revoke Saymail's access to your Google account frommyaccount.google.com/permissions at any time, with immediate effect.

4. How We Use Your Information

• To provide and manage your Saymail license
• To send purchase confirmations and important product updates
• To process affiliate commissions and payouts
• To respond to support requests

5. Data Sharing

We do not sell, rent, or share your personal information with third parties, except:

• Lemon Squeezy, our Merchant of Record, to process payments, collect and remit VAT / sales tax, deliver license keys, manage machine activations, and issue invoices and refunds.
• OpenRouter, when you use Saymail Cloud, strictly to fulfill AI requests you initiate (Section 2.5.3).
• Sentry, when crash and error reporting is enabled, to receive redacted diagnostic events from the desktop application (Section 2.7).
• PostHog (hosted in the EU), to receive pseudonymous product-analytics events - from our website after you accept analytics cookies (Section 2.8), and from the desktop and mobile applications when you enable Send usage data (Section 2.7).
• Meta (Meta Platforms Ireland Limited), only on the website and only after you accept marketing cookies, to receive Meta Pixel and Conversions API events for advertising measurement (Section 2.9).
• Google (Google Ireland Limited), only on the website and only after you accept marketing cookies, to receive Google Ads tag and Google Ads API conversion events for advertising measurement (Section 2.9).
• Supabase (Supabase, Inc., data stored in the EU), our backend edge-function and database provider for the website and mobile applications, to process license/order registration, the Lemon Squeezy purchase webhook, trial validation, server-side advertising conversion uploads, and cookie-consent logging.
• Fly.io, Inc. (Amsterdam, Netherlands region) - hosts the notification watcher for accounts that opted into instant notifications; it holds the decrypted credential in memory only (Section 2.4.1).
• As required by law or legal process

A complete list of sub-processors is available on oursub-processors page.

6. Data Security

We apply layered technical and organisational measures appropriate to the data we hold and to the data that lives only on your device.

• Encryption in transit. All communication between Saymail and Sefaja's services, between Saymail and Google's APIs, and between Saymail and the AI providers described in Section 2.5 uses TLS 1.2 or higher.
• Encryption at rest. The Saymail local database is stored under your operating-system user account and is protected by OS-level access controls. Account credentials - OAuth refresh tokens for Google and Microsoft, and IMAP/SMTP passwords - are stored in the OS secret store (Windows Credential Manager, Apple Keychain, or the Secret Service / GNOME Keyring on Linux), not in the Saymail database. Any third-party AI provider API keys you supply are additionally encrypted at the application layer.
• Access control. Sefaja staff have no access to the contents of your local Saymail database. Server-side systems we operate (the licensing service, the Saymail Cloud routing service, and website analytics) are accessible only by authorised Sefaja personnel using multi-factor authentication, with role-based access scoped to what each task requires.
• Diagnostic data minimisation. Crash reports, license traffic, and AI-routing metadata are minimised, redacted, and short-lived as described in Sections 2.5.3, 2.6, and 3.5.
• Vulnerability disclosure. Suspected vulnerabilities can be reported tosecurity@saymail.eu. We acknowledge reports within three business days, keep researchers informed during investigation, and do not pursue legal action against good-faith research conducted in accordance with our disclosure policy.
• Incident response. In the event of a personal-data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the Dutch Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, and we will notify affected users without undue delay where required under Article 34 GDPR.

No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

You have the right to access, correct, or delete your personal data. Contact us atprivacy@saymail.eu to exercise these rights.

8. Cookies and Consent

Our website distinguishes three categories of cookies:

• Strictly necessary. Always set: language / locale preference and theme preference. If you arrive through an affiliate link (a ?ref= parameter in the address), a first-party ref cookie stores that referral code for 30 days so that a purchase can be attributed to the affiliate; it identifies the affiliate, not you. These cannot be disabled and do not require consent under the ePrivacy Directive.
• Analytics (optional). For visitors from the EU, EEA and United Kingdom (determined from your browser's time zone; when in doubt we treat you as an EU visitor), PostHog cookies are set only after you click Accept in the cookie banner: we default tonot loading the analytics script, and ignoring or rejecting the banner means no analytics cookie is set and no analytics request is made. For visitors from elsewhere, analytics is enabled by default and the banner is shown as a notice in which you can decline it. Your choice is stored locally in your browser and you can change it at any time via the "Cookie preferences" link in the page footer. This cookie choice governs analytics on the website only: the desktop and mobile applications use no cookies, and their usage analytics is governed instead by the in-app Send usage data opt-in described in Section 2.7.
• Marketing (optional). Meta Pixel cookies (_fbp, and_fbc if you arrived from a Meta ad) and the Google Ads cookie (_gcl_aw, if you arrived from a Google ad) are, for visitors from the EU, EEA and United Kingdom, set only after you click Accept for the Marketing category in the cookie banner: we default tonot loading the Meta or Google scripts, and ignoring or rejecting the banner means no Meta or Google cookie is set and no Meta or Google request is made (see Section 2.9). For visitors from elsewhere, the Marketing category is enabled by default and the banner is shown as a notice in which you can decline it. Your choice is stored locally and can be changed at any time via the "Cookie preferences" link in the page footer.

To meet our obligation to demonstrate consent (GDPR Art. 7(1)), each banner decision (accept, reject, or a later change) is recorded with a timestamp under a random identifier that is also stored in your browser. This identifier is not linked to your name, email address, IP address, or any other personal data. If you ask us to, we will delete the records associated with your identifier; contactprivacy@saymail.eu.

Advertising cookies are used only with your consent for the Marketing category (Section 2.9): prior, explicit consent for visitors from the EU, EEA and United Kingdom, and a default you can decline at any time for visitors from elsewhere; they are never set once you decline them. We do not sell your personal data.

9. International Data Transfers

Several of our sub-processors are established in, or may process personal data in, the United States. These include Lemon Squeezy (payments) and the AI providers listed in Section 2.5.3; Sentry (Functional Software, Inc.), which receives redacted crash and error reports only when you enable them (Section 2.7); Netlify (Netlify, Inc.), which hosts our website and processes request and server logs, including IP addresses; and our website advertising and conversion-measurement recipients Meta (Meta Platforms Ireland Limited / Meta Platforms, Inc.) and Google (Google Ireland Limited / Google LLC), which receive Pixel / Conversions API and Google Ads tag / Ads API events only after you accept marketing cookies (Section 2.9); and, for the mobile apps' new-mail push service (Section 2.7), Apple (Apple Inc., Apple Push Notification service) andGoogle (Google LLC, Firebase Cloud Messaging and Google Cloud Pub/Sub), which receive the device push token and, for Gmail, the mailbox-change signal, never message content.

PostHog (PostHog, Inc.) is a special case: the usage and product-analytics data described in Sections 2.7 and 5 is sent to and stored on PostHog's EU infrastructure (eu.i.posthog.com), so it stays within the EU/EEA. To the extent PostHog, Inc. (US) may access that data for support or maintenance, such access relies on the safeguards described below.

Where personal data is transferred to the United States, we rely on the EU–US Data Privacy Framework adequacy decision (Commission Decision (EU) 2023/1795) for sub-processors that are DPF-certified and, where applicable or as a fallback, on the European Commission's Standard Contractual Clauses, in each case supplemented by the technical and organisational measures described in this Privacy Policy and in each sub-processor's own documentation. A complete and current list of sub-processors, their locations, and the applicable transfer mechanism is published on our sub-processors page.

10. Children

Saymail is a productivity tool for professional and personal email use. It is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us atprivacy@saymail.eu and we will delete the information.

11. Business Customers (DPA)

If you use Saymail in the course of your business and act as a controller for personal data processed through Saymail Cloud, you can request a Data Processing Agreement (DPA) by emailingprivacy@saymail.eu.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email where we have your address on file, and via a notice on our website. TheLast updated date at the top of this page always reflects the date of the most recent revision.

13. Contact

If you have questions about this Privacy Policy, contact us atprivacy@saymail.eu. Our full company details are listed on the Imprint page.