Privacy Policy

Last updated: 3 July 2026 · Version 2026-07-03

1. Introduction

Evermail is a service operated by Ludoitte Oy ("we", "us", or "our"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Evermail service (www.evermail.ai and app.evermail.ai).

Ludoitte Oy is the data controller, established in the European Union (Finland). All processing complies with the General Data Protection Regulation (GDPR) (EU) 2016/679.

2. Data We Collect

Account information

When you create an account, we collect your email address, name (if provided), and authentication credentials (hashed password or OAuth token from Google/Microsoft).

Email archive data

When you upload mailbox files (.mbox, PST, EML, etc.), we process and store the contents including email headers, body text, and attachments. This is the primary data you entrust to us and is treated with the highest level of protection.

Mailbox data from connected Google and Microsoft accounts

If you choose to connect a Gmail or Outlook / Microsoft 365 account to migrate your mailbox into Evermail, you grant us read-only access to that mailbox via Google's Gmail API (scope gmail.readonly) or Microsoft's Graph API (scope Mail.Read). We use this access for exactly one purpose: to copy your messages (headers, body text, and attachments) into your Evermail archive, where they are protected in the same way as uploaded email archive data. We never send, modify, or delete mail in your connected account.

The OAuth access and refresh tokens for connected accounts are encrypted at rest with keys scoped to your organisation, and are permanently deleted when you disconnect the account. You can revoke access at any time from Evermail (Migration → Connected accounts), from your Google Account permissions, or from your Microsoft account consent settings.

Google API Services — Limited Use disclosure: Evermail's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We only use Gmail data to provide and improve the mailbox migration and archiving features you asked for — never for advertising, and never to train generalised AI or machine-learning models.
  • We do not transfer Gmail data to third parties except as necessary to provide the service (our EU-region Azure hosting), to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
  • No human reads your Gmail data unless you give us explicit permission (e.g. a support request), it is necessary for security or abuse investigation, or we are required to by law.
  • We never sell Gmail data.

The same commitments apply to mailbox data received from Microsoft Graph.

Usage data

We collect anonymised usage logs (search queries, page views, feature usage) to improve the service. We do not link these to individual email content.

Billing information

Payment processing is handled by Stripe. We store only a Stripe customer reference. We never see or store your full card number.

3. How We Use Your Data

  • Provide the service: Index and search your uploaded email archives.
  • AI features: Generate AI-assisted email summaries (Pro plans and above). We never use your email content to train AI models.
  • Account management: Send transactional emails (account confirmation, billing receipts, security alerts).
  • Service improvement: Analyse anonymised usage patterns to improve performance and features.
  • Legal compliance: Meet our obligations under GDPR and applicable EU law.

4. Data Storage and Security

EU data residency

All data is stored on Azure infrastructure in EU regions (West Europe / North Europe). Your data never leaves the European Economic Area.

Encryption

All data is encrypted at rest and in transit. You may choose Full Service, Confidential, or Zero-Access per archive. Zero-Access uses client-side keys so Evermail only ever stores ciphertext.

Access controls

Access to production data is restricted to a minimal set of authorised personnel. All access is logged and audited. We use Azure Key Vault for secrets management.

5. Data Retention

  • Free plan: Email data is automatically deleted 30 days after upload.
  • Paid plans: Email data is retained for as long as your subscription is active. After cancellation, a 30-day export grace period applies, after which data is permanently deleted.
  • Account data: Retained until account deletion is requested, then anonymized while background deletion jobs finish.

6. Your Rights Under GDPR

As an EU data subject, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate data.
  • Right to erasure: Request deletion of your data ("right to be forgotten").
  • Right to data portability: Export personal data as a GDPR bundle, selected emails as EML/MBOX on supported plans, and tenant data as an Exit Package for admins. Zero-Access archives require your recovery key to decrypt.
  • Right to object: Object to processing of your data in certain circumstances.
  • Right to restrict processing: Request we limit how we use your data.

To exercise any of these rights, email privacy@evermail.ai. We will respond within 30 days.

7. Third-Party Services

  • Stripe: Payment processing. Subject to Stripe's privacy policy.
  • Azure (Microsoft): Cloud infrastructure for storage and compute. All services are provisioned in EU regions under our EU Data Processing Agreement with Microsoft.
  • Application Insights: Anonymised application performance monitoring (no email content).
  • Google Analytics 4: Website usage analytics. Loaded only after you grant cookie consent, and you can withdraw consent at any time. Not used to access email content.
  • Google Gmail API / Microsoft Graph API: Used only if you connect a Gmail or Outlook account for mailbox migration, with read-only scopes and subject to the Limited Use commitments in Section 2.

We do not sell your personal data to any third party.

8. Cookies

We use strictly necessary cookies for authentication and session management, which do not require consent. With your consent, we also use Google Analytics 4 to understand how the site is used. Analytics cookies are set only after you grant consent through our cookie banner, and you can withdraw that consent at any time. We do not use advertising cookies and we do not sell your data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before significant changes take effect. The latest version is always available at www.evermail.ai/privacy.

10. Contact

Data Controller: Ludoitte Oy (operating Evermail)
Contact: privacy@evermail.ai
EU Representative: Available upon request.

You have the right to lodge a complaint with your national data protection authority. In Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu).