Privacy Policy

1. Data Controller

Kolmira UG (haftungsbeschränkt)
Represented by: Frank Baisch
Address: Weißenfelser Ring 8, 70806 Kornwestheim, Germany
Email: support@mail2action.com

2. Overview

Mail2Action is a Chrome extension that extracts and processes email content using AI. We are committed to protecting your privacy. This policy explains how your data is handled.

3. Email Content

You choose how an email is processed in the extension settings:

• Mail2Action AI (included in every plan): when you run a feature, the text of the open email is sent to our Cloudflare Worker, which forwards it to OpenAI to generate the result and returns the result to your browser. We ask you to confirm before the first run. We do not store or log email content or results; they exist only in memory while the request runs. OpenAI processes the text as our processor, does not use it to train models, and may retain it for up to 30 days to detect abuse. Legal basis: Art. 6(1)(b) GDPR (providing the service you request); for personal data of other people in the email, Art. 6(1)(f) GDPR (our and your legitimate interest in processing your correspondence).
• Your own API key (BYOK): email text is sent directly from your browser to the AI provider you chose (OpenAI, Google Gemini, Anthropic, or xAI) using your personal API key. It never touches our servers.

4. Data We Store Locally

The following data is stored in your browser's local extension storage. Legal basis: § 25 para. 2 no. 2 TDDDG — strictly necessary for app functionality.

• The email you last opened: its text and subject and the results generated from it (summary, action items, diagrams). They stay until you open another email and regenerate, or uninstall the extension, and are never sent anywhere except as described in section 3.
• Your AI provider API key, if you use one (never sent to our servers)
• Your preferences (AI provider, model, date format) and whether you confirmed the use of Mail2Action AI
• Your Mail2Action AI usage this month (runs used and left)
• A random installation ID, and after a purchase your email and a signed license token with your plan

5. Our Backend Services

Our Cloudflare Worker backend handles only the following. Legal basis: Art. 6(1)(b) GDPR for purchase checks, restore codes and Mail2Action AI (providing what you requested); Art. 6(1)(f) GDPR for the rest (legitimate interest in operating and securing the service).

• Checking your Pro purchase with Stripe (by the email used at checkout). We store no customer database; a signed token with your email is kept locally in the extension.
• Sending one-time codes to restore a purchase on a new device
• Serving configuration (system prompts, date formats)
• Running Mail2Action AI requests (see section 3) and counting runs against your monthly allowance. Runs are counted per installation (random installation ID) or, with Pro, per purchase email. To prevent abuse we also count free runs per IP address. All of these are stored only as keyed hashes (no plain email or IP address), together with the run count.
• Forwarding feedback you send from the extension settings to our support inbox: your message, an optional reply email, the extension version, selected AI provider and model, browser version and a random installation ID (used only to limit spam). No email content or API keys are included.
• Anonymized usage analytics, stored on Cloudflare Analytics Engine: which feature ran, AI provider and model, error type, extension version, and checkout or limit events. No email content, no installation ID, no IP address. You can switch this off in the extension settings (“Share anonymous usage stats”)

6. Third-Party Services

We use selected service providers to operate our business. All providers are bound by Data Processing Agreements (DPA) where applicable.

7. Permissions

Mail2Action requests the following Chrome extension permissions:

• storage: To save your preferences and API key locally
• scripting: To read the open email in Gmail or Outlook
• sidePanel: To display the side panel UI
• alarms: To re-check your Pro license once a day
• Host permissions for Gmail and Outlook, and for the AI provider APIs used with your own key (OpenAI, Google Gemini, Anthropic, xAI)

8. Your Rights

Under the GDPR, you have the right to access, rectify, or erase your personal data, restrict processing, object to processing, and data portability. You may withdraw consent at any time without affecting the lawfulness of prior processing.

For inquiries, contact support@mail2action.com. You also have the right to lodge a complaint with the data protection authority responsible for us, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

9. Data Retention

• Local extension data is deleted when you uninstall the extension.
• Purchase data is held by Stripe under its own terms. We keep only a hashed identifier, your plan and a run counter.
• Mail2Action AI requests: email content and results are not stored by us. OpenAI may retain them for up to 30 days for abuse monitoring.
• Run counters are deleted automatically when the month (or, for the per-IP limit, the day) ends.
• Error logs of our backend contain only status and error codes, never email content.

10. Website Visits

When you visit mail2action.com, our hosting provider Cloudflare processes your IP address and technical request data (server logs) to deliver and secure the site. Legal basis: Art. 6(1)(f) GDPR. The home page shows a demo video: its preview image is loaded from YouTube (Google) when the page opens, which transmits your IP address to Google; the video itself loads from youtube-nocookie.com only when you press play. The website uses no analytics or advertising cookies.

11. Contact

Kolmira UG (haftungsbeschränkt)
Weißenfelser Ring 8, 70806 Kornwestheim, Germany
Email: support@mail2action.com