Privacy Policy

1. Overview

Innmail ("we", "our", or "us") gives AI agents their own email inboxes. People sign in with Google, create agents, and those agents send and receive email on @innmail.app or on a domain the workspace verifies. This policy explains what we store to make that work and how you can get it removed.

2. What we store

• Your account: the email address and name from Google sign-in, and when you joined.
• Your workspace: its name, members and roles, policies, API keys (stored as hashes; the secret is shown once), webhooks and their signing secrets, verified domains and their DNS state, and audit log entries describing who did what.
• Agent mail: every message an agent sends or receives (headers, bodies, attachments), drafts, threads, labels, calendar events and files, so you and your agents can read and act on them. Agent inboxes are separate from any personal mailbox.
• Interest list: if you ask to join the beta, your email address, the use case you describe and where you signed up from, until we approve or delete the entry.
• Events: delivery and webhook events are kept for 30 days.
• Chrome extension: the Innmail for Agents extension is a client of this site. It uses your existing innmail.app sign-in, keeps only your current view and an unsent draft in Chrome's session memory (cleared when Chrome closes), reads no web pages, and contacts no other site.

3. Who processes it

• Hosting and database: Vercel runs the application; Supabase (PostgreSQL and Storage) stores the data above. All traffic between your browser, our servers and the database uses TLS.
• Email delivery: Amazon Web Services (Amazon SES, S3 and SNS, us-east-1) sends agent mail and receives inbound mail on our behalf. Inbound messages are deleted from S3 within 7 days of delivery to the inbox.
• Mail content checks: inbound mail is checked on our servers for spoofing, lookalike domains, pressure language and prompt injection; outbound mail is checked for secrets and personal data according to your workspace policies. Nothing is sent to third-party AI providers for this.
• Website analytics: Google Analytics and Vercel Analytics measure visits, device type, approximate location and website performance. Our events exclude email content, email addresses, account data and private URL parameters. Advertising personalization and Google Signals are disabled.

We do not sell your data, use it for advertising, or use agent mail to train machine-learning models.

4. People your agents email

When an agent emails someone outside your workspace, we store that person’s address and the conversation as part of the agent’s inbox. You are responsible for having a lawful basis to contact them. Allow and block lists let you stop an agent from writing to, or receiving from, particular addresses or domains.

5. Deletion and your controls

• Delete an agent to remove its inbox from the interface; pause it to stop it sending. Revoke an API key at any time under Developers.
• Email us to delete your workspace and everything in it, including all agent mail, within 30 days.
• You can remove Innmail from your Google account at myaccount.google.com/permissions. Innmail holds no Google tokens, so this only affects future sign-ins.