Privacy Policy
Last updated: August 2026
1. Introduction
MailAssist ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our mobile application and web service (the "Service"). We comply with the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.
2. Data Controller
The data controller for your personal information is:
CoreLogic AI Ltd
Company No. 16919694
5 Brayford Square, London E1 0SG, United Kingdom
Email: support@mailassist.eu
3. Information We Collect
3.1 Account Information
When you register, we collect your email address and a password (stored as a one-way hash). If you sign in with Google, we receive your name and email from Google. Your full name may be stored if you provide it.
3.2 Letter Images and Analysis Data
When you scan a letter, we collect and store the photograph you upload, the AI-generated analysis (what the letter is, what it means, what to do, the deadline, urgency level, key terms, detected language, country, sender, reference number, and category), and any follow-up questions you ask.
3.3 Reply Drafts
If you use the reply generation feature, we store the questionnaire answers you provide and the generated reply letter in both the original language and English.
3.4 Payment Information
Credit purchases are processed by Stripe. We do not store your card number, CVV, or full card details. We retain a record of your purchase (bundle size, amount, date, and Stripe session ID) for accounting and dispute resolution.
3.5 Usage Data
We collect technical data such as your device type, browser version, IP address, and interaction logs (pages visited, features used, timestamps) for security, debugging, and service improvement.
3.6 Feedback
If you submit feedback on a scan's accuracy, we store your rating and any optional comment, linked to the scan ID.
4. How We Use Your Information
- To provide the letter scanning, analysis, and reply generation features
- To maintain your scan history and letter series so you can revisit past correspondence
- To process credit purchases and manage your credit balance
- To send deadline reminder emails for scans with approaching deadlines
- To improve the accuracy and quality of our AI analysis through aggregated, anonymised feedback
- To detect and prevent fraud, abuse, and unauthorised access
- To provide customer support and respond to your enquiries
- To comply with legal obligations
5. Legal Basis for Processing (GDPR Article 6)
We process your personal data under the following legal bases:
- Consent: You consent to the scanning and AI analysis of your letter images when you upload them.
- Contract: Processing is necessary to provide the Service you requested, including account management, scan history, and credit purchases.
- Legal obligation: We retain certain records (e.g. payment records) to comply with tax and accounting laws.
- Legitimate interests: We use usage data for security, fraud prevention, and service improvement in our legitimate business interests.
6. AI Processing
Letter images and extracted text are sent to third-party AI providers (including Anthropic and Google) for analysis. These providers process your data on our behalf as data processors under their own enterprise agreements. Your letter content is sent to these providers for the sole purpose of generating your analysis and is not used by them for training their models.
7. Data Sharing and Recipients
We do not sell your personal data. We share data with the following categories of recipients:
- AI providers: Anthropic and Google receive letter images and text for analysis purposes.
- Payment processor: Stripe processes your payments under their own privacy policy.
- Cloud infrastructure: Hosting and database providers store your data.
- Email service: Used to send deadline reminders and account emails.
- Legal authorities: Where required by law, court order, or to protect our legal rights.
8. International Data Transfers
Your data may be transferred to and processed in countries outside the EU/EEA, including the United States (where our AI providers and cloud infrastructure are located). These transfers are made under appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, and we take measures to ensure your data receives the same level of protection as it does within the EU/EEA.
9. Data Retention
We retain your letter images and analysis data for as long as your account is active. You can configure automatic deletion of scans after 30, 60, or 90 days in Settings, or choose to retain them indefinitely. You can manually delete individual scans or your entire account at any time. Payment records are retained for 7 years to comply with UK tax law. Usage logs are retained for up to 12 months.
10. Data Security
We use industry-standard security measures including TLS encryption for data in transit, encrypted storage for data at rest, access controls limited to authorised personnel, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of access: Request a copy of your personal data.
- Right to rectification: Correct inaccurate or incomplete data.
- Right to erasure: Request deletion of your data ("right to be forgotten").
- Right to restrict processing: Limit how we use your data.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interests.
- Right to withdraw consent: Withdraw consent at any time without affecting prior processing.
- Right to lodge a complaint: Complain to your local data protection authority or the UK ICO (ico.org.uk).
To exercise any of these rights, contact us at support@mailassist.eu. We will respond within 30 days.
12. Cookies
We use essential cookies to maintain your login session and remember your preferences. We do not use advertising or third-party tracking cookies. You can control cookies through your browser settings, but disabling essential cookies may prevent you from using the Service.
13. Children's Privacy
The Service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the app. The "Last updated" date at the top of this page indicates when the policy was last revised.
15. Contact
If you have any questions about this Privacy Policy or your personal data, please contact us at support@mailassist.eu.
