Privacy Policy

Version 1.0 — 2026-07-27

We provide an email-assistant service for businesses ("the Service"). This page summarises how we process personal data; the full policy is available on request from privacy@mafmail.maffen.eu.

What we process

• Account data: your name, business email and billing details (processed by Stripe; card numbers never touch our servers).
• Message content: messages sent to the channels you connect — email, and Instagram direct messages if you enable that channel — including sender addresses or handles and message bodies, processed to draft replies on your behalf.
• Usage and audit data: actions taken in the Service, kept for security and accountability.

Where and how

• All storage and email routing stays in the EU (Hetzner, Germany/Finland; MailerSend, EU).
• AI drafting uses Mistral AI (France). No US model providers are used.
• Optional notification channels you may connect (WhatsApp/Meta, Slack, Microsoft Teams) carry only the assistant's own notification text, never full customer emails.
• The optional Instagram direct-message channel is different, and we state it plainly: if you enable it, the full text of those conversations is carried by Meta (Meta Platforms Ireland Ltd, part of a US group), because Meta operates the channel your customer chose to write on. Storage, knowledge and AI drafting still stay in the EU. The channel is off unless you connect it, and you can disconnect it at any time.
• Secrets and OAuth tokens are encrypted at rest; transport is TLS-only.
• No model training on your data. Your email is never used to train, fine-tune or evaluate a model — ours or a subprocessor's — and never shared with other customers. This is a term of the contract, not a checkbox you have to find.

Retention and your rights

• Message retention is configurable per inbox; contact records are deleted when no retained message references them.
• Export everything we hold about your account: GET /v1/tenant/export. Erase your account and all data: DELETE /v1/tenant.
• Data subjects can exercise GDPR rights (access, rectification, erasure, portability, objection) via privacy@mafmail.maffen.eu. We respond within 30 days.
• Supervisory authority: you may lodge a complaint with your local EU data protection authority.

Subprocessors: Hetzner Online GmbH (hosting, DE/FI), MailerSend (email delivery, EU), Stripe Payments Europe (billing, IE), Mistral AI (AI processing, FR); optionally per your configuration: Meta (WhatsApp notifications, and Instagram direct messages), Slack, Microsoft (Teams / Microsoft 365).