Privacy policy
Last updated: 20 October 2026
Who Airmailer is
Airmailer is a service that drafts replies to the emails customers send to businesses and other organisations. It is provided by Airmailer B.V., a private limited company registered in the Netherlands.
- Postal address: TBC
- Chamber of Commerce (KvK) number: TBC
- Email: support@airmailer.app
In this policy, "Airmailer" means Airmailer B.V. "You" means whoever is reading it: a person who uses Airmailer for a business, or a customer who emailed such a business.
Airmailer's two roles
Airmailer handles personal data in two different roles, and which one applies decides who you should contact.
- Controller, for account and billing data. When you sign up and use Airmailer for your business, Airmailer decides how your account data is used. This policy covers that.
- Processor, for the emails a business forwards. When a customer emails a business that uses Airmailer, the business decides what happens to that email. Airmailer handles it only on the business's instructions, under the Data Processing Agreement that forms part of the Terms of Service. The business is the controller.
If you emailed a business that uses Airmailer, that business is responsible for your data. Its own privacy policy applies, and it is the one to ask about access or deletion. Airmailer helps the business answer you. If you write to Airmailer directly, Airmailer passes your request on to the business.
What personal data Airmailer handles, and why
Airmailer collects only what the service needs to work.
| Data | Whose | Why | Legal basis | Role |
|---|---|---|---|---|
| Name, email address and profile photo, if one is added | People who use Airmailer for a business | To sign in with a one-time code, to show who did what, and to send notices about the business's inbox | Contract | Controller |
| Business name, support address, logo, email design, writing rules | The business, which may include a person's name | To draft replies in the business's voice and send them from its address | Contract | Controller |
| Plan, usage this month, Polar customer and subscription ids | The business | To bill the right plan and show usage. Card details stay with Polar and never reach Airmailer. | Contract | Controller |
| Security and audit records: sign-ins with the IP address and browser used, who sent or approved a reply, and error reports with email addresses and database values removed | People who use Airmailer | To keep accounts and data safe and to fix faults | Legitimate interest | Controller |
| Customer emails: sender name and address, subject, message, attachments, and the conversation that follows | The business's customers | To draft, check and send replies, as the business has asked | Processing on the business's instructions | Processor |
| Customer records: name, email address and the team's notes about the customer | The business's customers | To show the team who it is writing to, across conversations | Processing on the business's instructions | Processor |
| Documents the business adds to Knowledge | The business, which may include staff names | To answer customers from the business's own information | Processing on the business's instructions | Processor |
| Customer ratings of replies (helpful or not) | The business's customers | To show the business how its replies are received | Processing on the business's instructions | Processor |
Airmailer does not sell personal data, and does not use it for advertising.
How Pip uses AI
Pip is the part of Airmailer that drafts replies. It uses these AI models, reached through Vercel's AI Gateway:
| Model | What it does |
|---|---|
| Claude Sonnet 5.5 (Anthropic) | Writes replies and rewrites them when someone on the team asks, unless Airmailer has set GPT-6.1 Sol as the business's writer. Answers the team's questions in Ask Pip. Checks a reply GPT-6.1 Sol wrote when Jev can't. |
| Jev (TypeSafe) | Checks each reply before it is sent or held: whether it answers what was asked, sticks to the business's documents, promises nothing they don't allow and is courteous, and whether the email is one a person must handle. Before Pip drafts a reply to a short follow-up, such as a thank-you, it decides whether a reply is needed. It receives the reply, the business's documents and rules, and the email, with every email address and phone number removed. |
| GPT-6.1 Sol (OpenAI) | Checks a reply Claude Sonnet 5.5 wrote when Jev can't. Airmailer can set it as a business's writer instead of Claude Sonnet 5.5. |
| Claude Haiku 5.5 (Anthropic) | Names the topic of a question the business's documents don't answer, for the list of things to add |
| text-embedding-3-small (OpenAI) | Finds the parts of the business's documents that match an email |
The model that writes a business's replies also reads the changes the team makes to drafts, to suggest new writing rules.
What the models receive: to draft and check a reply, the business's documents and writing rules, the customer's name, the subject, the email, the text of any text file or PDF attached to it, and the earlier emails in the conversation. Not the customer's email address. An address or phone number the customer writes in the email itself is part of the email. Ask Pip answers the team's questions about their own inbox, so it can see a customer's name and address when a team member asks about that customer.
No training: every request asks the provider not to train on it, and the AI Gateway only sends it to a provider that has agreed not to.
No copies kept: every request asks for zero data retention, so the provider doesn't store the request or the reply after answering. The exception is content a provider's safety systems flag as abuse, which the provider may keep to investigate it, for up to 2 years at Anthropic. The AI Gateway keeps no content, only what each request cost and how it was routed.
No automated decisions about people: Pip drafts answers to questions. Each business chooses whether replies are sent automatically or held for a person to approve, and anything Pip isn't sure of is held. A short follow-up that Jev finds needs no reply, such as a thank-you, is resolved without a draft; it stays in the Inbox, where the team can still write a reply.
Who else processes the data
Airmailer uses these subprocessors. Each one has signed a data processing agreement, and every transfer outside the European Economic Area is covered by the EU-US Data Privacy Framework, the EU's Standard Contractual Clauses, or both. For each AI request, the AI Gateway picks a provider of that model that has agreed to keep no data and not to train on it, so one request can go to a different provider than the next.
| Subprocessor | What it does | Where the data is | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Runs the app and Pip's workflow, stores logos and profile photos, and runs the AI Gateway | EU (Frankfurt), and the US for the AI Gateway | Data Privacy Framework and Standard Contractual Clauses |
| Anthropic, Amazon Web Services (Bedrock) or Google Cloud (Vertex AI), through Vercel | Run the Claude models: write and rewrite replies, Ask Pip, name topics the documents don't cover | Mostly the US; a request can go to the provider's EU, Australian or Japanese region | Standard Contractual Clauses, under Vercel's agreement |
| OpenAI or Microsoft (Azure), through Vercel | Run GPT-6.1 Sol: check replies when Jev can't, or write them for a business Airmailer has set it for | Mostly the US, or the EU | Standard Contractual Clauses, under Vercel's agreement |
| Microsoft (Azure), through Vercel | Runs document search | Mostly the US | Standard Contractual Clauses, under Vercel's agreement |
| TypeSafe, through Vercel | Runs Jev: checks replies and decides whether a short follow-up needs one, without email addresses or phone numbers | US | Vercel's agreement, with zero data retention |
| Neon (Databricks Inc.) | The database | EU (Frankfurt) | Data Privacy Framework and Standard Contractual Clauses, for support access |
| Resend (Plus Five Five, Inc.) | Receives and sends email | US | Data Privacy Framework and Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error reports, with email addresses and database values removed | EU (Frankfurt) | Data Privacy Framework and Standard Contractual Clauses |
Polar (Polar Software Inc.) sells Airmailer subscriptions as the merchant of record. It handles the billing name, address, email address, VAT number and payment details of whoever pays, under its own privacy policy. Airmailer receives the name, email address, billing address and VAT number.
Airmailer tells the owners of every business at least 30 days before it adds or replaces a subprocessor.
How long data is kept
The business decides how long its customers' conversations are kept, and Airmailer deletes the rest when the account closes.
| Data | Kept for |
|---|---|
| Customer conversations, drafts, replies and attachments | Until the business deletes them. In Settings, an owner can have conversations deleted 6 months, 1 year or 2 years after they go quiet; by default they are kept. An owner can also delete everything about one customer at once. |
| What Pip's workflow holds while it writes a reply (the email, the documents used and the draft), at Vercel | Deleted as soon as Pip's run ends, once the reply has been sent or held. A record that the run happened, with its times and steps but no content, stays at Vercel. |
| Documents in Knowledge | Until the business removes them. The last 10 versions of each document are kept. |
| Sign-in records, with the IP address and browser used | As long as the person's Airmailer account exists |
| Account and business data, including security and audit records | As long as the account is open. An owner closes it in Settings, and everything is deleted 30 days later; until then an owner can reopen it. |
| Usage records (the cost of each AI call, without its content) | Up to 2 years, and deleted with the account when it is closed |
| Database backups | Up to 7 days, then overwritten |
| Emails sent and received, and their delivery logs, at Resend | 30 days |
| Error reports at Sentry | Up to 90 days, with email addresses and database values removed |
Payment records are kept by Polar, which sells the subscription, for as long as tax law requires.
Security
Airmailer protects personal data with measures that fit how sensitive customer emails are:
- In transit and at rest: connections use TLS, and the database and file storage are encrypted at rest.
- Each business's data apart: every request is limited to the signed-in person's own business, and for most requests the database's row-level security enforces this.
- Sign-in without passwords: people sign in with a one-time code sent to their email address. Only owners can change settings, billing and the team.
- Verified messages: incoming email and payment notifications are accepted only with a valid signature from Resend and Polar.
- Error reports without content: errors are reported to Sentry without request data, email text, prompts or user details, and with database values and email addresses removed.
- Few people, little access: only the people who run Airmailer can reach production systems, and only to keep the service working or to help when a business asks.
Your rights
Under the GDPR you can ask to see, correct, delete or receive a copy of your personal data, to restrict its use, and to object to it. Airmailer answers within one month.
- For your account data, email support@airmailer.app. Airmailer may ask you to confirm the request from the address on the account.
- For an email you sent to a business, ask that business, since it is the controller. Businesses can download or delete everything about one customer in Airmailer themselves. If you write to Airmailer instead, Airmailer passes the request to the business and helps it answer.
- To complain, you can contact the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority where you live. Airmailer would appreciate the chance to put things right first.
Cookies and browser storage
Airmailer uses no analytics or advertising cookies, so it asks for no cookie consent.
| What | Where | Why | How long |
|---|---|---|---|
| Sign-in session | A cookie | Keeps you signed in | Until you sign out or the session ends |
| Time zone | A cookie | Shows dates and times in this browser's time zone | 1 year |
| Sidebar open or closed | A cookie | Remembers whether the sidebar is open | 7 days |
| Notification and sound choices | This browser's local storage | Remembers whether this browser shows notifications and plays the attention sound | Until you change them |
| When the attention sound last played | This browser's local storage | Plays the sound in one tab, not in every open tab | Until it plays again |
| Setup steps marked done | This browser's local storage | Remembers which optional Setup steps are marked done | Until the browser's storage is cleared |
| A reply you are writing | This tab's session storage | Brings an unsent reply back after a reload. It is cleared when the reply is sent or discarded, and when you sign out. | Until the tab closes |
| Ask Pip open or closed | This tab's session storage | Keeps the Ask Pip panel open after a reload | Until the tab closes |
All of these are set only once you sign in. The public website sets no cookies and stores nothing in the browser.
Changes to this policy
When this policy changes in a way that matters, Airmailer emails the owners of every business at least 30 days before the change takes effect. The date at the top shows the current version.