Privacy Policy

We do not intentionally collect sensitive information. Email content may nonetheless contain any information that correspondents choose to include.

People who email an address connected to the Service (for example a client's customers) will have their Personal Information processed when their messages are received, stored and answered.

Where we handle correspondence on behalf of a client organisation, that organisation decides how the correspondence is used and its own privacy notice may also apply. Correspondents can contact the relevant organisation, or us, about that information.

We use Personal Information to provide, operate, secure and improve the Service; authenticate users and verify their access to workspaces; send and receive email; sync threads, drafts and delivery events; send invitation, assignment and mention notifications; provide support; and meet our legal, accounting and security obligations.

We do not use email content for advertising, and we do not sell or rent Personal Information.

Where enabled for an inbox or used by a member, AI features send relevant thread content and inbox context to our AI provider to triage and label conversations, suggest or draft replies, and answer questions in the copilot.

AI outputs can be incomplete or inaccurate. Drafts are not sent without a person choosing to send them, and workspace administrators can turn automatic triage and drafting off for each inbox.

We rely on the following categories of providers to run the Service. They process Personal Information on our behalf and only as needed to provide their services:

We may also disclose information to an organisation you represent, a workspace administrator, a person you authorise, our professional advisers, or where required or authorised by law.

Our providers store and process data in Australia, the United States and other countries. Personal Information may therefore be held in jurisdictions whose privacy laws differ from yours. Where required by law, we take reasonable steps to ensure overseas recipients handle Personal Information consistently with applicable privacy requirements.

We use cookies and local storage that are necessary to keep you signed in, protect your account and remember preferences such as your theme. The Service does not use advertising cookies.

We use reasonable administrative, technical and physical safeguards, including encrypted connections and access controls scoped to each workspace. No method of transmission or storage is completely secure.

We keep workspace data and email content while the workspace remains active and as needed for the purposes in this policy. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to legal obligations and the normal operation of backups.

Subject to applicable law, you may request access to or correction of Personal Information we hold about you, withdraw consent where we rely on it, or complain about how we handle your information. We may need to verify your identity or authority before acting on a request.

We may update this policy to reflect changes to the Service, our practices or the law. The current version will be published on this page with a revised effective date, and we will give additional notice of material changes where required.