Your mail.
What we do with it.

Nextmail runs the service at nextmail.sh. For data about you as a customer, such as your account, your payments and your visits to this site, we are the controller.

What a workspace keeps about other people, such as the mail its members receive and send and the contacts, audiences and form sign-ups it builds, is the workspace’s to decide. The workspace is the controller of that data and we process it on its behalf, as the Terms of Service set out under Processing data for you.

This policy covers the web app, the apps for iOS and Android, the API, the SDKs, the command line tool, the MCP server, and this website with its free tools.

Your account

• Your email address, the name you give, your username and, if you add one, a profile photo.
• Your password, stored only as a salted hash, and, if you turn on two-factor sign-in, its secret and backup codes, stored encrypted.
• If you add a passkey, its public key, the name you give it, the kind of authenticator that made it, whether it is synced between your devices and when it was last used. The private key never leaves your device.
• Your settings, such as time zone and date format. The app takes the time zone and formats from your browser when you first sign in.
• Your sessions, which the app shows as signed-in devices. For each browser or phone signed in to your account we keep the browser and system it reports, the country and city the connection came from, how it signed in, such as with a password, an authenticator code or a passkey, when it signed in and when it was last active. We never store its IP address. You can see the list in Account → Devices and sign any of them out.
• If you use the mobile app, its push token and the device’s name, so we can send you notifications.

Your workspace

Its name and branding, its members, roles and invitations, its domains and their DNS records, its addresses and their settings and signatures, its API keys, stored as a hash, its webhooks and the apps connected to it.

If a company connects its staff directory to a workspace, the directory sends us each person’s name, user name, job title and email addresses, whether they are active and the groups they are in. We keep this for as long as directory sync is on. Turning it off deletes it, and the people it added to the workspace stay members.

Your mail

• Every message sent to your addresses and every message you send: headers, body, attachments and the results of the checks run on it, such as authentication, spam score, phishing risk and whether it looks machine-written. Drafts and scheduled messages too.
• For mail sent through the API, the assistant, rules, broadcasts or scheduled send, the full request, including the body, as part of the workspace’s sending history.
• Everyone you write to from the app is added to the workspace’s contacts and to its All contacts audience. Once the workspace owner deletes someone from the contacts, they are not added again.

What you create

Contacts, audiences, broadcasts, sign-up forms and their submissions, calendar events, files and share links, templates, notes, labels, mail rules and the record of when they ran, and your conversations with the assistant.

Billing

The plan, the usage counted against it, the billing name and address if you add them, and the workspace’s customer record at Polar. Card details are entered on Polar’s checkout and never reach us.

Records the service keeps

• For each request made with an API key: the time, the endpoint, the result, and the IP address and client that made it. The workspace sees these in its request log.
• Delivery events for sent mail, such as delivered, bounced or marked as spam, the history of webhook deliveries, and counts of AI actions by feature and model, without the text.
• Keyed hashes of IP addresses and email addresses to slow repeated sign-in attempts, kept for 15 minutes, and keyed hashes of IP addresses to limit abuse of public forms and the docs assistant.
• A security log for your account: sign-ins, devices signed out, password changes and resets, two-factor sign-in turned on or off, and passkeys added or removed. Each entry holds the time, the kind of event, the browser and system, the country and city, and the name of the device or passkey involved. A sign-in entry also holds how you signed in and a hash of the identifier in that browser’s device cookie.
• A security log for each workspace: changes to its members, roles and invitations, to its two-factor requirement, to the passwords of its addresses and to directory sync. Each entry holds the time, the kind of event, and the names and email addresses of the people involved, including who made the change.
• Crash reports from the web and phone apps: the error and where in the code it happened, the page or screen, and the app version and system, with email addresses and the query part of web addresses removed. A report is tied to your account when you are signed in, kept for 30 days to fix the fault, and never stored with your IP address.

About people who are not our users

• People who write to you, or whom you write to: their addresses and what their messages contain.
• Recipients of tracked mail, when a workspace tracks it: when they opened it or clicked, their approximate location, device and mail client, as set out under Tracking, images and pictures.
• People who sign up through a workspace’s form: what they entered, the page they came from and a keyed hash of their IP address.

Visitors to this site

• What you send through the contact form, and the questions you ask the docs assistant, which are answered and not stored.
• Mail that arrives at a temporary inbox.

We use personal data only for the purposes below. Each comes with the legal basis that data protection law asks us to name.

We do not sell personal data, use it for advertising, or make decisions about people by automated means that have legal or similar effects on them.

AI features send a model the text they need. Some run because you asked, and some run by themselves. Both are listed here.

Without being asked

• When mail arrives and the spam checks find it borderline, a model checks it for phishing, using the sender, the subject, the authentication results and up to 4,000 characters of the body.
• When personal mail of 40 words or more arrives and our own checks suspect a machine wrote it, a model looks at up to 4,000 characters of the sender’s own text to decide. Hiding the AI-written label does not stop the check.
• When anyone in a workspace opens a thread, its last ten messages, up to 4,000 characters each, are summarised.
• When anyone in a workspace opens a thread whose latest message needs a reply, its last eight messages, up to 12,000 characters in all, go to a model to suggest short replies, together with what is known about the sender’s organisation, up to three of your earlier replies to that person, the workspace’s writing-style profile and the busy times on your calendar for the next seven days, without their titles. Newsletters, automated notices, spam and sealed messages are left out. Turning off “Suggested replies” in the workspace’s privacy settings stops this and deletes what was stored.
• When a workspace owner opens mail from a domain nobody has looked up before, the domain name, and nothing else from the message, goes to a web search model to describe the sender. The description is shared by every workspace and looked up again after 30 days, and personal mailbox providers such as Gmail are never looked up.
• When you send from the app, the body may update the workspace’s writing-style profile: every send until it has 50 samples, then one send in ten.
• Once you have sent a translated message in a thread, replies in that thread are translated when you open them, unless you turn off “Read replies to translated mail in your language”.
• When mail arrives or you send it, its subject, the people on it and the text of the conversation, newest messages first and up to 12,000 characters, go to an embedding model, so that search by meaning can find it. Drafts, temporary inboxes and conversations holding a sealed message are left out. Turning off Search by meaning in the workspace's privacy settings stops this and deletes what was stored.
• When mail arrives in a workspace where a label has “Apply to new mail automatically” turned on, the sender, the subject and up to 3,000 characters of the message go to a model, together with the name and description of each such label, and the labels that fit are added to the conversation. Spam, mail filed in the bin, muted conversations and sealed messages are left out. Turning the setting off on a label stops this for that label.
• When an automation reaches an AI check or a reply the AI writes, the email it is handling and that step’s instruction go to a model. A reply it writes is sent the way the automation is set up to send it, without a person reading it first.
• When mail arrives for a task that starts on new mail, the message, its conversation and the task’s instructions go to a model, which acts on the mail as far as the task allows and replies only when the task is set to reply.
• When somebody replies in a conversation, the reply and the message it answers, up to 4,000 characters of text, go to a model that suggests notes for the knowledge base. Nothing is added until a person accepts it, and turning off “Learn from mail” in the workspace’s privacy settings stops this.

Knowledge base

• Files added to a workspace's knowledge base, images included, are turned into text by Cloudflare. Web pages added as links are fetched by our server, so the site sees a visit from us. Notes and plain text skip conversion.
• The text of every item goes, in short passages with its title, to an embedding model through OpenRouter, which returns the search vectors that let the AI find the right passage. A search, whether you test one or the AI runs it while writing, sends its words to the same model.
• The title, text, web address and file name of every item, the uploaded file and the passages cut from it are stored encrypted with the workspace. The search vectors, lists of numbers, are stored unencrypted so that search can compare them, and are deleted with the item. The level an item applies to, a domain or an address, stays readable so it can be looked up.

When you ask

• The assistant, drafting, rewriting, translation and the template and form designers send what the request needs: your instruction, the thread in view, attached files, and the results of the tools the assistant used, such as search results or contacts.
• The assistant and compose can search the web, sending a query the model wrote to a search model. The assistant can also open a public web page linked in your mail or chat: our server fetches it, so the site sees a visit from us.
• Questions to the docs assistant on this site go to a model together with excerpts of the documentation, and are not stored.
• Searching by meaning sends the words you typed to the same embedding model.
• Trying a label on recent mail sends a model the label’s name and description with the newest message of up to 20 recent inbox conversations: its sender, its subject and up to 3,000 characters of its text. Sealed messages are left out.
• Connectors are off until somebody connects an app. When the assistant looks something up in a connected app or changes something there, what it sends, which can include words from your mail when the request calls for them, and what the app answers pass through Composio, which keeps a record of both for up to a year, and reach the app itself under that app's own terms. In chat and in tasks every change in a connected app waits for a person to approve it.

Who runs the models

Every request goes through OpenRouter, which passes it to the model’s provider: OpenAI, Anthropic, Perplexity, or the host of an open-weight model. Each request tells OpenRouter to use only providers that do not keep or train on what they receive. Thread summaries and the conversion of knowledge base files are the exceptions: they run on Cloudflare Workers AI, inside Cloudflare, where Nextmail itself runs.

That instruction is a routing rule our provider applies. It is the mechanism we have, not a promise we can make on behalf of every upstream provider.

What is kept

• We never use your mail, your prompts or the results to train models.
• Thread summaries, suggested replies, the results of the arrival checks and the writing-style profile are stored, encrypted, with the workspace. Sender descriptions are stored, encrypted, once for every workspace, because they describe a domain rather than your mail. The style profile blends the writing of everyone who sends from the workspace and keeps common greetings and sign-offs word for word.
• What the embedding model returns for a conversation, a list of numbers, is stored with it, unencrypted so that search can compare it, and deleted with it.
• Assistant conversations are kept, encrypted, so they are there when you come back. Clearing one removes its messages and keeps its title. Deleting it removes both.
• Other output is not stored unless you save it. When a model request fails, its text can appear in our server logs, which age out on Cloudflare’s schedule.

When a workspace tracks the mail it sends

• Open and click tracking is off by default for mail sent from an address, and on by default for broadcasts. A workspace can change both.
• For each tracked recipient we record when they opened the message or clicked a link, which link, their approximate location (country, region, city and time zone, from our network provider), their mail client, device and operating system, and their browser’s user agent. We do not store their IP address with these records, only a fingerprint that changes every day.
• If the workspace has a webhook for opens, clicks or downloads, the reader’s IP address is included in the event sent to the workspace’s own server, and in the event history of messages sent through the API.
• When you open mail from another Nextmail workspace that tracks it, with pictures loading, your open is recorded for that workspace in the same way.

Mail you receive

• Before a message is shown, we remove one-pixel images, hidden text, remote fonts and imported style sheets, the most common trackers. Other trackers are detected and pointed out, not removed.
• Pictures hosted elsewhere load straight from the sender’s servers, which tells the sender when you opened the message and roughly where you were. They load by default. Turn off “Load pictures in mail automatically” under Settings → Privacy, where you can also trust particular senders.
• When someone downloads a file you shared by link, we record the time, their approximate location, device and network.

Pictures of people

• To show a picture for someone who has none in your contacts, our server can ask Gravatar using a hash of their address, look up a brand logo in their domain’s DNS through Google Public DNS, and fetch a logo or icon from their website. Turn off “Look up pictures for people you email” under Account → Pictures of people.
• Your own profile photo is stored on our public image host and shown to Nextmail users you exchange mail with, unless you turn off “Show my photo to people I email” there.

These providers process personal data for us to run the service. Each one gets only what its job needs.

Our secrets, including the keys that encrypt stored data, are held with Envless, a secrets manager.

People you share with see what you share: your workspace’s members according to their roles, the recipients of your mail, anyone with a link you publish, and the servers you send webhooks to. Apps you connect receive what you authorise.

We disclose data when the law requires it and the request is valid, and we tell the customer affected first unless the law forbids it.

If the service passes to a company set up to run it, or to a new owner, your data goes with it under this policy, and we will tell you.

We add a provider to this list at least 30 days before it starts processing workspace data.

Mail travels through Amazon Web Services in Northern Virginia. Our application runs on Cloudflare servers placed near Northern Virginia, and our database runs in Cloudflare’s data centre in Ashburn, Virginia. Message bodies, attachments and files are stored in Cloudflare’s Eastern Europe storage region. Cloudflare handles each request at the data centre nearest to you, and the AI, payment and notification providers above work mainly in the United States.

Personal data from the European Union, the United Kingdom, North Macedonia and elsewhere is therefore transferred to the United States. Where the law requires a safeguard for such a transfer, we rely on the one in each provider’s data processing terms, such as the European Commission’s standard contractual clauses.

We do not delete things on a timer to save space. Most data stays until you delete it, or until the workspace or account it belongs to is deleted. Where something is kept for a fixed time, it is listed here.

Deleting a thread removes its messages, attachments and summary. Deleting a workspace removes its mail and everything else in it straight away, including its logs and history. A few internal records are kept: markers that stop the same message being processed twice, and the history of DNS changes we made to your domains. They hold addresses and domain names, not message bodies.

To delete your account, use Account → Danger zone. We email you a link that works for 24 hours. Open it, sign in if asked and confirm: your account, every workspace you own and its mail are then deleted at once. There is no grace period and no undo.

Connections to our apps, our API and our providers are encrypted with TLS. Mail exchanged with other mail servers uses TLS whenever the other server supports it, as most do, but neither side can guarantee it for every message.

Stored mail, attachments, files and most of what you create are encrypted by our application with AES-256-GCM, on top of the encryption our storage providers apply. We hold the keys, so the service can read this data, which is what lets it search, filter and summarise your mail. It is not end-to-end encryption.

Some data stays readable in the database because the service looks it up directly: account details, the browser, country and city recorded for your signed-in devices and security log, the names and addresses on mail and contacts, contact notes, the titles of assistant conversations, tracking locations, and a search excerpt of the newest message in each thread, its first 4,000 characters.

Passwords are stored as salted scrypt hashes. Two-factor sign-in uses an authenticator app or a passkey, and sensitive changes, such as deleting a workspace or creating an API key, ask for a fresh code or a passkey.

When someone signs in to your account from a browser it has not used before, we email you.

You can create an OpenPGP key in the app. Its private half is made on your device, locked with your passphrase and never sent to us, so there is no way to recover it if you lose it. Mail sealed to your key is stored as ciphertext we cannot read, and the features that read mail leave its body alone.

A sealed message still shows us its subject, sender, recipients and date, and drafts are saved unsealed while you write. Your published public key can be looked up by other Nextmail users and API keys that are allowed to send. A message to someone with no published key is sent unencrypted.

Only the people who run the service can access stored data, and they use that access to operate, secure and support it. We do not keep a log of each such access.

If a breach puts your personal data at risk, we tell you, and the authorities where the law requires it, without undue delay.

Report a vulnerability to support@openemail.uk. There is no bug bounty.

Most of what this page describes can be changed in the app:

• Settings → Privacy: whether pictures load automatically, and blocked and trusted senders.
• Account → Pictures of people: picture lookups for the people you email, and whether they see your photo.
• Each address’s settings: open and click tracking, and the “Sent via Nextmail” line.
• Account → Notifications: message previews in push notifications, and activity and product news emails.
• Settings → Export: download a workspace’s mail, contacts, calendar and settings.
• Account → Danger zone: delete your account.
• Product news: the unsubscribe link at the bottom of each one.

Wherever you live, you can ask us to show you the personal data we hold about you, to correct it, to delete it or to give it to you in a portable format. You can object to processing based on our legitimate interests, and withdraw consent you gave. In the EU, the UK and North Macedonia these are your rights under the GDPR, the UK GDPR and the Law on Personal Data Protection.

Most of this you can do yourself in the app. For the rest, write to support@openemail.uk. We answer within 30 days, may ask you to confirm it is you, and do not charge.

If the data sits in a workspace you belong to but do not own, we may refer you to its owner, who decides what it keeps.

You can complain to the Personal Data Protection Agency of North Macedonia, or to the data protection authority where you live or work. We would rather you gave us the chance to put it right first.

We use only the cookies the service needs to work. This site sets no analytics or advertising cookies.

The web app also keeps data in your browser: recent lists and contacts for up to a day so it opens quickly, your interface preferences, your OpenPGP keyring if you made one, a draft during the undo-send window, and your conversation with the docs assistant for a week. Signing out clears the cached mail data.

The mobile app keeps your session in the device’s secure storage and recent thread lists for a week, and clears both when you sign out.

If you write to someone who uses Nextmail, or they write to you, sign you up through a form or send you tracked mail, their workspace decides what to keep and we process it for them. Ask that workspace first. If you cannot reach it, write to support@openemail.uk and we will pass your request on or act on it where we can.

To stop a workspace’s broadcasts, use the unsubscribe link in any of them. It takes effect straight away.

The service is not for children. You must be at least 16 years old to create an account, and we delete an account when we learn it belongs to someone younger.

We may change this policy. The date at the top of this page shows the version in force.

Send privacy questions and requests, and security issues, to support@openemail.uk or through the contact page. Nextmail runs the service at nextmail.sh.