Last updated: October 12, 2026
1. Scope, controller and contact
MailRoutine Team provides mailroutine.net and the free MailRoutine Cloud beta at app.mailroutine.net. The legal controller is [Operator confirmation pending], at [Operator confirmation pending], [Operator confirmation pending]. These identity details are still undecided and must be supplied before this policy is finalized. Contact privacy@mailroutine.net for privacy matters and support@mailroutine.net for support.
This policy covers website visitors, Cloud users and people who contact us. The marketing website does not sign you into Cloud or access Gmail. Self-hosted deployments are operated by their deployers, who are responsible for their own data practices.
2. Notice at collection: categories, sources and purposes
We process technical request information needed to serve and secure the website, such as IP addresses and device/browser details. This marketing website has no analytics or advertising trackers. Cloud application/API analytics uses PostHog; the exact events, identifiers, settings and retention need separate verification. Requests sent to our email mailboxes or a configured contact API include the information you provide, used to handle the request. The current demo form keeps entered fields only in browser memory and does not transmit or store submissions.
Cloud processes account information, authorization credentials and routine configuration to deliver Gmail automation. The exact stored fields still need verification: [Operator confirmation pending]. Information comes from you, your browser, Google authorization and service operations. Email content and message IDs are not stored. Routine names and search text may themselves contain personal information. Do not send passwords, tokens or unnecessary Gmail content to support.
We do not sell information or share it for cross-context behavioral advertising. This marketing site has no advertising networks or payment checkout. The retention and recipient information below is part of this notice at collection.
3. No stored email content or message IDs
MailRoutine does not save email content or message IDs in its database. They are processed only at runtime to preview matches and apply the Gmail actions you request. Your emails remain in Gmail; MailRoutine does not create a stored mailbox copy.
Temporary processing is still processing of personal information. This statement does not mean account details, authorization credentials, routine settings and operational data are never stored. It also does not govern Google's retention of your mailbox or messages you voluntarily send to support.
4. Gmail authorization and Google Limited Use
Connecting Gmail requires separate authorization through Google's consent screen. Access is used to provide the Gmail automation you configure. Exact scopes, credential storage, protection and revocation behavior must be verified: [Operator confirmation pending]. Review the consent screen before granting access.
MailRoutine's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used for the disclosed user-facing functionality, not advertising, unrelated profiling or training general-purpose AI models. Human access and onward transfers are restricted to the exceptions permitted by that policy, including explicit permission, necessary security investigation or legal obligations.
5. EU/EEA and UK lawful bases
Where GDPR or UK GDPR applies, necessary account and routine processing is based on providing the requested service under a contract. Security, abuse prevention and ordinary support may rely on legitimate interests in operating and protecting the service, subject to an appropriate balancing assessment and your rights. Binding legal duties are processed on the basis of legal obligation.
The marketing website has no optional analytics. Any consent required for application/API analytics must be obtained there, with an available withdrawal mechanism and no unnecessary loss of service. OAuth permission permits API access; it is not a blanket lawful basis for all processing. Required account information is necessary to run connected routines. Marketing analytics is not used for automated decisions producing legal or similarly significant effects.
6. Cookies, local storage and PostHog
The marketing website uses no analytics or advertising cookies and does not load PostHog. It stores only acknowledgement of this notice under mailroutine.consent.v1 in local storage for up to 180 days, after which the notice is shown again. This necessary preference avoids showing the notice on every visit. If storage is blocked, dismissal lasts only for the current visit. Fonts are served locally.
Use Cookie information in the footer to reopen the notice. You can remove its acknowledgement using your browser storage controls; the website will still work. There are no optional marketing-site trackers to enable or reject, including when GPC or Do Not Track is enabled.
PostHog analytics is limited to the Cloud application and API. That integration must disclose its actual events, identifiers, storage/cookies, lawful basis, region, recipients and retention, and provide any legally required consent and opt-out controls in the application. Those implementation details are not established by this marketing repository. Authentication cookies/browser storage in app.mailroutine.net are also separate; the verified application inventory is still pending.
7. Recipients and disclosures
Recipients can include hosting, authentication, database, Google API, application/API PostHog analytics and support providers, as needed for their stated functions. The verified provider inventory is [Operator confirmation pending]. Google separately processes information under its own policies when you use Google sign-in or Gmail. A configured contact receiving service processes submissions; otherwise the contact form returns a dummy empty success response, clears its fields and sends or stores nothing. Use the email links for an actual request.
Disclosures may also occur to meet legal duties, protect security or rights, or complete a lawful business transfer with appropriate protections and notice. Processors must be subject to suitable contractual and confidentiality obligations. Gmail information is not disclosed for advertising. Linked external services have their own privacy policies.
8. United States storage and international transfers
The Cloud database stores data in the United States. If you use the service from another country, your information may travel outside your country, including to the US, where privacy laws and government access rules may differ. Hosting edges and other processors may process information in additional countries. PostHog's actual project region must be configured and disclosed separately; the US database region does not establish the analytics region.
Transfers covered by GDPR or UK GDPR require a valid legal mechanism and any necessary assessments or supplementary safeguards, such as an applicable adequacy arrangement or approved standard contractual clauses. We do not claim a provider certification or contractual safeguard without verification. Confirmed safeguards and how to obtain copies: [Operator confirmation pending]. Accepting terms or continuing to use the website does not replace these requirements.
9. Retention, deletion and backups
Email content and message IDs are not retained beyond runtime processing. Stored account and routine information is kept only as needed to provide an active service, address support and security needs, and comply with applicable law; the exact category-by-category retention criteria still require confirmation: [Operator confirmation pending].
On a verified deletion request, your personal data will be deleted within 30 days, except information that applicable law requires or permits us to retain for a narrowly defined purpose. We will explain any applicable exception. This commitment must include providers and any retained backup copies; no additional backup extension is promised. The implementation and handling of requests are [Operator confirmation pending]. Website cookie-notice acknowledgements expire after 180 days. The actual PostHog project retention must be configured consistently with this policy.
10. Controls, security and incident response
You can disable routines, disconnect Gmail in Cloud and revoke Google authorization through your Google account permissions. Revocation prevents future authorized Gmail access but does not reverse earlier actions or automatically remove separate account records. Request account deletion at privacy@mailroutine.net.
The operator must maintain access controls and credential protection appropriate to the data. Verified OAuth and security protections: [Operator confirmation pending]. No system is perfectly secure. The operator must notify authorities and affected people when a breach triggers applicable notification duties. Avoid putting credentials or private Gmail data in public GitHub issues.
11. EU/EEA and UK privacy rights
Subject to applicable conditions and exemptions, you may request access and a copy, correction, deletion, restriction, portability of information processed by consent or contract, and objection to legitimate-interest processing. You may withdraw consent without affecting the lawfulness of earlier processing. You may complain to your local data-protection authority or the UK Information Commissioner's Office and pursue applicable judicial remedies.
Send requests to privacy@mailroutine.net. We may need proportionate verification and information to locate your records; never send your password or OAuth token. GDPR requests generally receive a response within one month. A permitted extension of up to two further months for complexity or volume requires notice and an explanation. Any EU/UK representative or verified reason none is required must be confirmed: [Operator confirmation pending].
12. California collection notice and rights
The categories described above are identifiers/contact information, internet or electronic activity, and service configuration or operational information. Google credentials may qualify as sensitive personal information; they are used only to provide and secure your requested service, not for additional purposes requiring a right to limit. This marketing site does not intentionally collect precise geolocation, biometric identifiers, protected-class characteristics or advertising profiles.
Where CCPA/CPRA applies, California residents may request the categories and specific pieces collected, sources, purposes and recipient categories; correction; deletion subject to exceptions; and access/portability. They may opt out of sale or sharing and limit qualifying uses of sensitive information where applicable. We do not sell information or share it for cross-context behavioral advertising, including information of users we know to be under 16. We do not discriminate for exercising rights. This marketing site has no optional trackers; the application must implement applicable opt-out signal handling for its own processing.
Submit requests to privacy@mailroutine.net or select Privacy and data requests on the contact page. Authorized agents may request on your behalf with proof of authority; proportionate verification may be required. Where required, requests are acknowledged within 10 business days and answered within 45 calendar days, with a permitted extension and notice. The categories above describe intended practices; the operator must verify the actual categories collected and disclosed during the preceding 12 months before publication. California applicability depends on statutory criteria; these rights are described without claiming those criteria have been assessed.
13. Other US states and Do Not Track
Depending on your state's law and its applicability, you may request confirmation, access, correction, deletion and a portable copy, or opt out of targeted advertising, sale or qualifying profiling. The marketing site does not engage in those advertising or profiling activities. The marketing site does not track activity regardless of Do Not Track; the Cloud application/API must disclose their own signal handling.
Contact privacy@mailroutine.net. Requests are handled within applicable deadlines. If denied, we will explain the reason and available appeal process. Appeal to the same address with Privacy appeal in the subject and identify the decision. If an appeal is denied, you may contact your state attorney general or other competent regulator as applicable. No unlawful discrimination applies for exercising rights.
14. Children and data about other people
The service is intended for adults aged 18 or older and is not directed to children. We do not knowingly solicit children's personal information. If you believe a child provided information, contact privacy@mailroutine.net so the operator can investigate and take appropriate steps. Connect only accounts you are authorized to manage and avoid unnecessary information about others in routine settings or support messages.
15. Changes and contact
We will update this notice when practices or legal requirements change and update the revision date. Material changes affecting existing users will be communicated appropriately, and additional consent requested when required. Effective date: [Operator confirmation pending]. Questions, privacy requests and requests for transfer-safeguard copies can be sent to privacy@mailroutine.net or [Operator confirmation pending]. Until pending facts are verified, this notice remains a draft.