MailFlows

Privacy Policy

1. What we collect

• Account info: your email address and password (stored securely, hashed, via our authentication provider), and your display name.
• Contacts you add or find: names, email addresses, company/website info you manually add, import, or discover using our email-scraping tool.
• Campaign and email data: subject lines, message content, send timestamps, and replies to emails you send through MailFlows.
• Payment info: handled entirely by our payment processor (Paystack) — we never see or store your card details.
• Basic usage data: which features you use, for the purpose of enforcing plan limits and improving the product.

2. How we use Google user data

When you connect your Gmail account, MailFlows requests the following Google OAuth scope:

Scope	What it's used for
gmail.send	Sending emails on your behalf, only when you click Send (Quick Send, Campaigns, or Reply) inside MailFlows. We never send anything without you initiating it.
userinfo.email, userinfo.profile	Identifying which Gmail account you've connected and displaying your name/email in the app.

MailFlows does not request permission to read your Gmail inbox. We do not use any Gmail read scope (gmail.readonly or gmail.metadata). Replies to emails you send through MailFlows are captured through a separate mechanism: outgoing emails carry a unique reply-tracking address on our own domain, and replies sent to that address are routed to us directly — your Gmail inbox itself is never accessed by MailFlows.

Limited Use disclosure: MailFlows' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the specific features described above, is never used for advertising, and is never sold or transferred to third parties except as necessary to provide the Service (see Section 4) or to comply with the law.

3. Data retention

• Sent emails and replies are kept for 90 days, then automatically and permanently deleted.
• Contacts and campaign data are kept until you delete them or close your account.
• If you disconnect your Gmail account, we stop accessing it immediately — no further sends or data access occur through that connection.

4. Who we share data with

We use the following third-party services to operate MailFlows. Each only receives the minimum data needed to perform its function:

• Supabase — database, authentication, file storage
• Railway — backend hosting
• Cloudflare — frontend hosting, DNS, and reply-capture routing
• Google — Gmail sending, on your explicit authorization
• Paystack — payment processing
• Tavily — web search used for the contact-finding/scraper feature
• Reoon / Hunter.io — email address verification
• Resend — transactional emails (welcome messages, account notifications)
• Google Gemini API — powers the optional AI email-writing assistant and FAQ chatbot

We do not sell your data or any Google user data to anyone, ever.

5. Your rights

• You can disconnect your Gmail account at any time from Settings — this immediately revokes MailFlows' access.
• You can permanently revoke MailFlows' access to your Google Account at any time via Google Account Permissions.
• You can request deletion of your MailFlows account and all associated data by contacting us (below).
• You can export your contacts at any time via the Contacts page.

6. Security

Passwords are never stored in plain text. Sensitive tokens (such as Gmail access tokens) are encrypted at rest. All traffic between your browser and MailFlows is encrypted via HTTPS.

7. Children's privacy

MailFlows is not directed at children under 16 and we do not knowingly collect data from them.

8. Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where required, notify you directly.

9. Contact

Questions about this policy or your data? Reach us through the in-app Support option, or email [email protected].

← Back to MailFlows