Privacy Statement

1. Who we are

MailPigeon (getmailpigeon.com) is an email-triage service operated by cvForge, Lamstraat 73, 3523 RV Utrecht, the Netherlands (KvK: 84783427, VAT: NL004013187B19) ("MailPigeon", "we", "us", "our"). We are the data controller for the personal data described in this statement. You can reach us at hello@getmailpigeon.com for any privacy question, support request, or to exercise the rights described below.

2. Scope of this statement

This statement explains what data MailPigeon collects when you connect a mailbox (including mailboxes hosted on Microsoft 365 / Microsoft Entra ID) and a messaging channel, why we collect it, how long we keep it, and the choices and rights you have. It applies to all users of the MailPigeon service. If you connect a mailbox provided by your employer or another organization (for example, a mailbox in a Microsoft Entra ID tenant), it also applies to the data processed through that connection.

3. Data we collect

To provide the Service, MailPigeon collects and processes:

• Account and authentication data — your name, email address, and organizational/tenant identifier, obtained via sign-in with your mailbox provider.
• Mailbox data, via Microsoft Graph — when you connect a Microsoft 365 / Microsoft Entra ID mailbox, MailPigeon requests the following delegated Microsoft Graph permissions:
  • User.Read — to read your basic profile (name, email address) so we can identify your account.
  • Mail.Read — to read the content and metadata of incoming email so we can generate a one-sentence summary and classify each message.
  • offline_access — to maintain a connection to your mailbox and continue triaging new mail without requiring you to sign in every time.
  We request the minimum permissions necessary to provide the Service and do not request write, send, or delete access to your mailbox unless you separately enable and authorize a specific feature that requires it, in which case the additional permission and its purpose will be disclosed to you before you grant it.
• Messaging channel data — the identifier and access token for the messaging channel (for example, a Slack or Microsoft Teams workspace) you connect, so MailPigeon can deliver your digest there.
• Usage and diagnostic data — information about how you use the Service (for example, delivery mode selected, digest delivery times, and error logs) used to operate and improve the Service.

4. How we use your data

We use the data described above to:

• Generate a one-sentence summary of each incoming email and classify it as requires action, important, or status/noise;
• Compile and deliver your ranked digest through your chosen messaging channel, on the schedule you configure;
• Maintain your account, authenticate you, and keep your mailbox and channel connections active;
• Provide customer support and respond to your requests;
• Monitor, secure, and improve the reliability of the Service.

The legal bases for this processing are: performance of the contract between you and MailPigeon (to provide the Service you signed up for — generating summaries, delivering digests, maintaining your account, and providing support); our legitimate interest in monitoring, securing, and improving the reliability of the Service (for usage and diagnostic data); and, where applicable, your consent granted at the time you authorize MailPigeon to access your mailbox, which you can withdraw at any time by revoking that access.

5. AI-assisted processing

Generating email summaries and classifications involves automated, AI-assisted processing of email content. This processing may be performed using third-party AI/language-model providers acting as our processors under a data processing agreement. Email content is sent to these providers solely to generate the summary and classification for your digest; it is not used by us or our processors to train shared or general-purpose models.

6. Sharing and subprocessors

We do not sell your personal data. We share data only with subprocessors who help us operate the Service — for example, cloud hosting providers, the AI/language-model providers described above, and the messaging platform you choose to receive your digest through — each bound by contractual obligations to protect your data and process it only on our instructions. We may also disclose data where required by law or to protect the rights, safety, or property of MailPigeon or others.

7. International data transfers

Where a subprocessor is located outside the European Economic Area, we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses, to ensure your data continues to receive an equivalent level of protection.

8. Data retention and deletion

We retain mailbox content only for as long as necessary to generate and deliver your digest, and do not permanently store the full text of your emails beyond what is required for that purpose. Account, configuration, and digest metadata are retained for as long as your account is active. If you disconnect a mailbox, revoke MailPigeon's access (including via the Microsoft Entra ID "My Apps" page), or close your account, we will delete or anonymize the associated personal data within a reasonable period, except where we are required to retain it to comply with a legal obligation, resolve disputes, or enforce our agreements.

9. Security

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and least-privilege permission scopes — to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

If the GDPR applies to you, you have the right to access, correct, delete, or restrict the processing of your personal data, to object to certain processing, and to receive a copy of your data in a portable format. You can exercise most of these rights directly by disconnecting a mailbox or channel in your account settings, or by revoking MailPigeon's access through your identity provider (for example, Microsoft Entra ID's "My Apps" / enterprise applications page). For any other request, contact us at hello@getmailpigeon.com. You also have the right to lodge a complaint with a supervisory authority, such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Children's privacy

The Service is intended for personal use by adults and is not directed at children. In line with the Dutch implementation of the GDPR (UAVG), we do not knowingly process personal data of children under the age of 16 without the consent of a parent or guardian. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.

12. Changes to this statement

We may update this statement from time to time. If we make material changes, we will provide notice (for example, by email or an in-product notice) before the changes take effect.

13. Contact

Questions about this statement or your data can be sent to hello@getmailpigeon.com.