Privacy Policy

1. General provisions

1.1. This Privacy Policy (the "Policy") describes how personal data is processed when you use Mailtalk and visit the website at https://www.mailtalk.ru/. It is issued in accordance with the applicable laws of the Russian Federation, including Federal Law No. 152-FZ of 27 July 2006 on Personal Data.

1.2. The controller of your personal data is individual entrepreneur Ruslan Khuvazhievich Krylov (OGRNIP 322774600593457, INN 772373909220), address: 127015, Moscow, Novodmitrovskaya Street 2, building 6, apartment 470, Russian Federation, email for all enquiries: hello@mailtalk.ru (the "Operator", "we", "us").

1.3. The same operator provides Mailtalk in every language. The Russian version of this Policy is available at https://www.mailtalk.ru/policy/privacy.

1.4. This Policy covers all processing of personal data by the Operator, whether automated or not.

1.5. The current version of this Policy is publicly available. By signing in to Mailtalk and by using Mailtalk or the Website you accept this Policy and the terms of processing it describes. If you do not accept them, please do not use Mailtalk or the Website and do not provide your personal data.

1.6. Mailtalk and the Website may link to third-party websites, products and services, including those of email providers and Sign-in providers. This Policy applies only to Mailtalk and the Website. We are not responsible for the content or the privacy practices of third parties.

2. Definitions

• Personal data - any information relating to an identified or identifiable natural person.
• Mailtalk - the Mailtalk software, an email client that uses a language model to read and sort mail, including the web client at https://admin.mailtalk.ru/ and the programming interface at https://api.mailtalk.ru/.
• Website - the website at https://www.mailtalk.ru/ and all its subdomains.
• Mailbox - an email address of yours at an email provider that you have connected to Mailtalk by entering the address, the login and an app password.
• App password - a separate password you create at your email provider so that Mailtalk can reach the Mailbox over IMAP and SMTP; you can revoke it at the provider at any time.
• Correspondent - a natural person whose personal data appears in the messages of a Mailbox: a sender, a recipient or another person mentioned in a message.
• Language model - a third-party software service that, at Mailtalk's request, reads the text of messages and returns its analysis, and computes vector representations of text for search.
• Processing - any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure and destruction.
• Sign-in provider - GitHub, Yandex ID, VK ID or Google, whose account you may choose to sign in to Mailtalk with.
• User, you - a person who signs up or signs in to Mailtalk and connects Mailboxes to it, and a visitor of the Website.
• Cookie - a small piece of data sent by a web server, stored in your browser and sent back to the server when you visit the Website.
• Browser storage - an area of your browser where the Website and Mailtalk keep settings on your device without sending them to the server with every request.

3. Personal data we process

3.1. We process personal data when you:

3.1.1. sign up to Mailtalk with an email address and a password, confirm the address, reset your password, or sign in to Mailtalk through a Sign-in provider;

3.1.2. connect a Mailbox to Mailtalk;

3.1.3. use the features of Mailtalk: reading and sorting mail, searching it and asking questions about it, writing and sending messages, keeping tasks;

3.1.4. create a personal API token;

3.1.5. visit the Website;

3.1.6. write to us by email.

3.2. Depending on the purposes set out in section 5, we process the following personal data:

3.2.1. account data:

3.2.1.1. your email address and whether it is confirmed; your username in Mailtalk, made from a login, the part of an email address before the @, or the name in a Sign-in provider's profile; a link to your profile picture; if you signed up with an email address, a hash of your password (argon2) - the password itself is not stored;

3.2.1.2. if you sign in through a Sign-in provider, the data it passes within the permissions requested. We keep only your account ID at the Sign-in provider, your email address if the Sign-in provider vouches for it (GitHub - the primary verified address; Google - an address marked as verified; Yandex ID - the default address; VK ID - the address, if VK ID passes one), your GitHub login and a link to your profile picture. The name in the profile and an unverified address are not kept as such and may only be used to make your username in Mailtalk. Access tokens issued by Sign-in providers are used once to obtain this data and are not stored. If a Sign-in provider vouches for an email address that an Mailtalk account already has, signing in through it is linked to that account; accounts are not joined on an unverified address;

3.2.1.3. to confirm an email address and reset a password - an HMAC hash of a six-digit code (the code itself is not stored), its expiry and the number of attempts to enter it. A code is valid for 30 minutes and stops working after 5 wrong attempts; the record is replaced when a new code is issued to the same address for the same purpose;

3.2.2. session data: a hash of the session token (the token itself is not stored in the database), the IP address and browser information (user agent) at sign-in, the session expiry and the time of your last sign-in;

3.2.3. personal API token data: the name you gave the token, its hash and its first characters, and the dates it was created, last used and revoked;

3.2.4. Mailbox data: the email address, display name, login, email provider, IMAP and SMTP server addresses and ports, the App password - stored encrypted - the sync status and the text of connection errors;

3.2.5. mail content: a copy of the messages in the Inbox and Sent folders of the Mailbox from the 90 days before it was connected and of every message that arrives in those folders after that - subject, date, technical headers and message IDs, names and addresses of the sender and the recipients, including copy recipients, the plain text and HTML of the message, the read status and attachments of up to 40 MB each (larger attachments stay only with your email provider); files you attach to messages in Mailtalk; messages you send through Mailtalk;

3.2.6. derived data that Mailtalk and the Language model produce from your mail: thread summaries, tasks and due dates, priority and its components (urgency, importance, time waiting for a reply, number of messages and participants), categories, the goal of a reply, whether a reply is needed, suggested replies, and fragments of message text with their vector representations for search by meaning;

3.2.7. your requests: search queries, questions about your mail and instructions for a reply. They are sent to the Language model when you make them; the Mailtalk database keeps only their size - the length of the query and the number of messages found;

3.2.8. usage data: usage events - the name of the action, the date and technical parameters (thread ID, number of results, length of a query, size of a file, text of a technical error), the amount of data sent to and received from the Language model, and a daily activity mark;

3.2.9. technical data of the Website and Mailtalk: the IP address and browser information your browser sends with every request, a cookie with your chosen language, and settings in Browser storage (section 6);

3.2.10. your enquiries to us and the email address they were sent from;

3.2.11. consent records: the version of the consent text, its language, and the time and IP address the consent was given from.

4. Correspondents' data and sensitive data

4.1. The messages in a Mailbox contain personal data of Correspondents: names, email addresses, and the content of messages and attachments. We process it only as part of your mail and only to provide Mailtalk's features to you: to show your messages, sort threads, find a message and prepare a reply. We do not use Correspondents' data for any other purpose, do not combine data from different Users' mail, do not contact Correspondents and do not send them anything except the messages you send yourself. We do not notify Correspondents individually of this processing: doing so would disclose the fact and content of your correspondence to third parties. This Policy, which is publicly available, is the information about that processing. A Correspondent may contact us at hello@mailtalk.ru.

4.2. We do not aim to process sensitive personal data, such as data on racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life, or biometric data. Such data may appear in messages you receive or send; Mailtalk does not single it out, and it is processed as part of the messages in the same way as the rest of their content, including by the Language model. If you do not want this, do not connect the Mailbox concerned, or remove it from Mailtalk.

4.3. We process personal data that you provide, that a Sign-in provider passes to us at your choice when you sign in, and that Mailtalk retrieves from your email provider's servers for a Mailbox you connected. By connecting a Mailbox you confirm that you are entitled to use it.

5. Purposes and legal grounds

5.1. We process personal data for the purposes in the table below, by automated means and manually. The processing for each purpose may include collection, recording, organisation, storage, adaptation, retrieval, use, disclosure to the persons listed in section 8, restriction, erasure and destruction.

5.2. We may use your email address and username to check compliance with this Policy. In case of serious violations, including using Mailtalk to send unsolicited messages or to access other people's Mailboxes, we may suspend your access to Mailtalk.

5.3. How consent is given. The sign-in screen states that by signing in you accept this Policy; signing up and signing in is your consent to the processing of your account data and session data and to receiving the service emails in clause 5.4. Before you connect your first Mailbox, you give your consent to processing in the scope of the Consent to Personal Data Processing, published at https://www.mailtalk.ru/en/policy/consent, by ticking a box next to a link to its text. We record the version of the consent text, its language, and the time and IP address the consent was given from.

5.4. Emails we send. Mailtalk sends you only service emails, from no-reply@mailtalk.ru through the Resend service: the code to confirm your email address, a notice that an account with this address already exists, and the code to reset your password. We send no newsletters or marketing emails.

6. Cookies and browser storage

6.1. The Website sets a cookie named preferredLanguage holding the language you chose, for 1 year, and keeps your chosen language and colour theme in Browser storage.

6.2. Mailtalk keeps in Browser storage your session token, language and colour theme, the Mailbox you selected, display settings and whether demo mode is on.

6.3. No third-party web analytics services are used on the Website or in Mailtalk. The usage data in clause 3.2.8 is recorded by Mailtalk in its own database.

6.4. You can block cookies and clear Browser storage in your browser settings. Without Browser storage, Mailtalk cannot keep you signed in between visits.

7. Automated processing

7.1. Priority, category, summary, tasks, due dates and suggested replies are produced automatically, including by the Language model, and serve as suggestions to you. You can change the priority, the goal of a reply and the due date by hand.

7.2. No decision producing legal effects concerning you or a Correspondent, or otherwise significantly affecting you or them, is made solely by automated means. A message is sent only on your command.

8. Who receives personal data

8.1. To achieve the purposes of processing, the Operator entrusts the storage and processing of personal data to the following service providers:

8.2. The provider of the Language model may change. The current provider is named in the table in clause 8.1; when it changes, we publish a new version of this Policy.

8.3. Your email providers. Mailtalk connects to your email provider's servers over IMAP and SMTP with the login and App password you entered. Mailtalk retrieves messages, sends messages on your command, puts a copy of a sent message into the Sent folder where the provider does not do so itself, and changes the read status when you do. Mailtalk does not delete messages at your provider. Your email provider processes your data under its own terms; we do not entrust it with processing on our behalf.

8.4. We may also disclose personal data:

8.4.1. with your consent;

8.4.2. where necessary for you to use the features of Mailtalk or the Website, including to the providers in clause 8.1 and to your email provider when you send a message;

8.4.3. where required by applicable law, a court order or a lawful request of a competent authority;

8.4.4. in connection with a transfer of Mailtalk or part of it in a reorganisation or sale of the business; aggregated information about the use of Mailtalk that does not identify any User may be disclosed in that case.

8.5. We do not sell personal data and do not use or disclose the content of your mail for advertising.

9. Where data is stored and international transfers

9.1. The Mailtalk and Website servers, the database and the Redis storage are located in Germany, in Frankfurt am Main. Attachment files are kept in the object storage of Tigris Data, Inc. The text of messages is processed by the Language model, and vector representations are computed, in the Russian Federation by Yandex.Cloud LLC.

9.2. Personal data is therefore transferred outside the Russian Federation and outside the country you live in: to Germany, to the Russian Federation, and to service providers incorporated in the United States, including Resend, which receives your email address and the text of service emails. When you sign in with GitHub or Google, you sign in on the side of these companies (United States), and they pass us the data in clause 3.2.1.2. We make these transfers to the extent needed to host and run Mailtalk and in accordance with applicable Russian law. By giving your consent you agree to these transfers.

10. Retention and deletion

10.1. Account, session and API token data and usage data are kept for as long as your account exists and for 1 (one) year after you stop using Mailtalk. A session lasts 60 days from sign-in; when you sign out, the session record is deleted, and when you reset your password, all your earlier sessions are deleted. Mailbox data, mail content and derived data are kept while the Mailbox is connected to Mailtalk.

10.2. Removing a Mailbox. You can remove a Mailbox in Mailtalk yourself. The Mailbox settings, including the encrypted App password, and its messages, threads, summaries, tasks, attachment records and vector representations are deleted from the Mailtalk database at once, and the attachment files are deleted from the object storage right after. Your messages at the email provider are not deleted. You can also revoke the App password at your email provider; Mailtalk then loses access to the Mailbox.

10.3. Deleting your account. Mailtalk does not offer deletion of the whole account in its interface; it is done on request to hello@mailtalk.ru. Personal data is deleted within 30 days after we receive the request. It is deleted from database backups when those backups expire, and no later than 90 days after we receive the request. Data of a removed Mailbox is deleted from backups within the same period, counted from the removal of the Mailbox.

10.4. When the purpose of processing has been achieved, or you withdraw your consent and there is no other lawful ground, we stop the processing and delete or anonymise the data within 30 days, unless applicable law requires us to keep it.

11. Security

11.1. We take legal, organisational and technical measures to protect personal data against unauthorised or accidental access, destruction, alteration, blocking, copying, disclosure and other unlawful actions, including:

• encryption in transit: the Website, the web client and the programming interface are served over HTTPS only, and connections to mail servers use TLS;
• App passwords are stored only in encrypted form, with the encryption key kept separately from the database;
• passwords are stored only as argon2 hashes, confirmation codes only as HMAC hashes, session tokens and personal API tokens only as hashes;
• resetting a password ends all earlier sessions of the account;
• access separation: every record is tied to one User's account and is returned only to that User;
• rate limits on sending messages, on calls to the Language model and on recording usage events;
• limits on service emails - at most one email a minute to an address and 10 emails an hour from one IP address; on password sign-in attempts - at most 5 per address and 30 per IP address in 5 minutes; on code attempts - at most 10 per address and 30 per IP address in 5 minutes.

11.2. You are responsible for keeping secure your Mailtalk password, access to the email address your account is registered to, your Sign-in provider accounts and your App passwords, and for connecting to Mailtalk only Mailboxes you are entitled to use.

12. Your rights

12.1. Subject to applicable law, you have the right to:

12.1.1. obtain information about the processing of your personal data and a copy of it;

12.1.2. have inaccurate or incomplete personal data corrected;

12.1.3. have your personal data erased, or its processing restricted or stopped;

12.1.4. withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal; withdrawing consent means you stop using Mailtalk, and your data is deleted as described in section 10;

12.1.5. object to decisions based solely on automated processing;

12.1.6. lodge a complaint with the competent data protection authority.

12.2. To exercise your rights, write to hello@mailtalk.ru. We may ask you to confirm that the request comes from you, for example from the email address linked to your account. Correspondents may exercise the same rights regarding their data in Users' mail.

13. Changes to this Policy

13.1. We may change this Policy. A new version takes effect when it is published on the Website.

13.2. Please review the Policy from time to time. Continuing to use Mailtalk or the Website after a change means you accept the new version.

14. Governing law, liability and contact

14.1. This Policy and the relations between the Operator and data subjects under it are governed by the laws of the Russian Federation.

14.2. The Operator is responsible for the processing of personal data in accordance with applicable law. The Operator is not liable for losses caused by the unavailability of Mailtalk or the Website, by unauthorised access to your Mailtalk account, Sign-in provider account or Mailbox through your fault or the fault of your Sign-in provider or email provider, or by statements or conduct of third parties.

14.3. If you believe we process your personal data unlawfully or otherwise infringe your rights, you may write to us at hello@mailtalk.ru, and we will try to resolve the matter. You may also lodge a complaint with the competent data protection authority or apply to a court.

14.4. For any question about this Policy or the processing of your personal data, contact us at hello@mailtalk.ru.

14.5. The current version of this Policy is publicly available at https://www.mailtalk.ru/en/policy/privacy.