Privacy Policy

Last updated 14 October 2026

MailBridge connects your email accounts to an AI assistant such as Claude. To do that it has to hold the keys to your mailboxes, so this page says exactly what it keeps, why, for how long and who else sees it. It follows the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller of your personal data is Martin Dvořáček, Czech Republic. Write to privacy@mailbridged.com with any question or request about your data.

2. What MailBridge stores

Your MailBridge account

Your email address and the time you accepted these terms.
Your password, only as a salted scrypt hash. Nobody, including us, can read it back.

Connected mailboxes

The mailbox address, server names and ports, login name, sender name and signature.
The mailbox password (IMAP and SMTP), encrypted with AES-256-GCM. The encryption key is kept apart from the database, so a copy of the database alone does not reveal it.

Mail

MailBridge reads mail directly from your mail server when you or your assistant ask for it, and does not keep a copy of your mailbox. A few things are stored because the features need them:

drafts written through MailBridge, including ones that were later sent;
the sender, subject and a newsletter flag of messages it has listed, kept for at most 90 days so lists load quickly;
copies of recent inbox messages, if inbox sync is used;
the mail rules you create.

Signing in and abuse protection

Session tokens, API keys and connector tokens, stored only as hashes. Your browser keeps one session cookie.
When you sign up, a keyed hash of your IP address, kept for 24 hours to limit how many accounts one address can create. The sign-up captcha runs in your browser and involves no third party.
After a failed sign-in, keyed hashes of the email address and IP address, kept for at most a day to stop password guessing.
Our hosting provider keeps technical request logs (IP address, time, address requested) for a short period to run and secure the service.

MailBridge has no advertising, no analytics and no tracking, and never sells or shares your data for marketing.

3. Why, and on what legal basis

To provide the service you signed up for: account, mailbox connections, the tools your assistant calls (GDPR Art. 6(1)(b), performance of a contract).
To keep the service secure and prevent abuse: captcha, sign-up limits, logs (Art. 6(1)(f), legitimate interest).
To meet legal obligations, if any apply (Art. 6(1)(c)).

4. Who else processes the data

Vercel Inc. hosts the application. Vercel is based in the USA; transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
Neon Inc. runs the database, located in the EU (Frankfurt, Germany).
Your mail provider (Gmail, Seznam, your company server, …), which MailBridge connects to on your behalf.

5. Your AI assistant

When you connect Claude or another AI assistant to MailBridge, the mail your assistant asks for is sent to that assistant's provider (for Claude, Anthropic) and handled under your own agreement with them. You decide which assistant to connect and what to ask it. MailBridge's own servers do not send your mail to any AI provider.

6. Other people in your mail

Your mail contains other people's personal data. MailBridge handles it only on your instructions, to provide the service to you. You remain responsible for how you and your assistant use it.

7. How long data is kept

Everything is kept while your account exists. Removing a mailbox deletes its credentials and the stored data that belongs to it. Deleting your account (Settings → Delete account) removes all of it at once. Deleted data can stay in the database provider's backups for up to 30 days before it is gone for good.

8. Security

All traffic is encrypted (HTTPS, and TLS to mail servers). Mailbox passwords are encrypted, and account passwords and tokens are hashed. No system is perfectly secure; if a breach affects your data, we will tell you and the supervisory authority as the GDPR requires.

9. Your rights

You can ask for access to your data, its correction or deletion, a restriction of its processing or a copy in a portable form, and you can object to processing based on legitimate interest. Most of it you can do yourself in Settings; for the rest, write to privacy@mailbridged.com. We answer within one month. You may also complain to the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or the authority in your country.

10. Cookies

MailBridge uses one cookie that keeps you signed in. It is strictly necessary, so it needs no consent. There are no other cookies.

11. Age

MailBridge is not meant for anyone under 16.

12. Changes

If this policy changes, the date at the top changes with it. A change that affects what we do with your data will be announced to you by email before it applies.