Privacy Policy

Contents of this policy. This policy describes how we process the personal data of the people listed in chapter 2: what personal data we process, why and on what basis, who receives it and what rights you have. All processing follows Regulation (EU) 2016/679, usually known as the GDPR.

Who we are. The processing described here is carried out, as controller, by instanceof s.r.o., Company ID 03007260, with its registered office at Čápkova 28/21, Veveří, 602 00 Brno, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, file no. C 83229. This means that we set the purposes for which we collect your personal data, decide how it is processed and are responsible for doing so properly. You can reach us at support@librato.ai.

Email and other content in a workspace. MailGiraffe holds the mail of its customers’ connected mailboxes. For that content, and everything else in a workspace, the customer running the workspace is the controller and we act as its processor under chapter 7 of the Application Terms. If your personal data appears in such mail, please contact that customer first. We will help them deal with your request.

What personal data we process. The personal data we process ourselves is:

1. identification data, such as your name;
2. contact data, such as your email address;
3. account data, such as your password in hashed form, the workspaces you belong to and your role in them;
4. billing data, such as your plan and the state of your subscription (card details go directly to our payment partner, not to us);
5. data about our communication, in particular its content and other data connected with it;
6. data about your use of our services and website, in particular your IP address and data about your device.

Concluding and performing contracts. We process your personal data to conclude and perform the contracts between you and us, which includes running your account and billing, and sending you the emails the application depends on, such as address confirmations and invitations (Article 6(1)(b) GDPR). If a customer invited you to their workspace, we do this on the basis of our legitimate interest in providing the application to that customer (Article 6(1)(f) GDPR).

Customer support. When we deal with your requests, we process your personal data on the basis of our legitimate interest in providing our services and appropriate support (Article 6(1)(f) GDPR).

Protecting legal claims and internal control. We process your personal data on the basis of our legitimate interests in protecting legal claims and in our internal records and control (Article 6(1)(f) GDPR).

Commercial communications to customers. If we obtain your electronic contact details in connection with an order or our services, we may also use them to offer you our other goods and services, on the basis of our legitimate interest in promoting ourselves, unless you have refused this (Article 6(1)(f) GDPR).

Keeping them running and secure. When you visit mailgiraffe.io or the application, we process your IP address and data about your device, on the basis of our legitimate interest in providing our services over the internet and keeping them secure (Article 6(1)(f) GDPR). We do not use analytics or advertising tools.

Meeting our legal obligations. We also process your personal data to meet our legal obligations, in particular in connection with providing information to public authorities and keeping accounting and tax records (Article 6(1)(c) GDPR).

How long we keep it. We store personal data only for as long as strictly necessary for the purposes above, and then erase it without delay. We usually keep personal data for the limitation period (normally 3 years) and one further year, in view of claims raised at the end of that period. The following specific periods also apply:

1. Account data stays for as long as your account exists. When you delete your account, it is erased from the application at once and from backups within 30 days. Records of our contract, such as invoices and correspondence, follow the general rule above.
2. In court and other proceedings, we process your personal data to the necessary extent for their whole duration and the remaining limitation period after they end.
3. For commercial communications, we process your personal data until you refuse them, or for 2 years after our contract ends.
4. To meet legal obligations, we process personal data for as long as those obligations require.
5. We keep server logs only for as long as we need them to run and secure our services.

Whether you must provide your data. Your name, email address and a password are necessary to create an account, and payment details to buy a paid plan. Without them we cannot conclude the contract.

No automated decisions. We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

Processors. We use other parties as processors, who process personal data only on our instructions:

1. Hetzner Online GmbH, Germany, which hosts our website and application in the EU;
2. Resend (Plus Five Five, Inc.), USA, which delivers the application’s emails.

Controllers. If you buy a paid plan, we pass the minimum necessary data to our payment partner, Stripe Payments Europe, Limited, Ireland, which acts as a controller of payment data. We also disclose personal data to public authorities where the law requires it.

Services you choose to connect. If you connect a mailbox, an AI provider or an MCP server to the application, data is exchanged with that service because you chose it, and it handles that data under the terms between you and it. In particular, what an AI agent reads goes to the AI provider whose API key it runs on.

Transfers outside the EU. In some cases your personal data may be transferred outside the European Economic Area, on the basis of an adequacy decision under Article 45 GDPR, appropriate safeguards under Article 46 GDPR or an exception under Article 49 GDPR. For Resend, this is the EU–US Data Privacy Framework, with standard contractual clauses as a fallback. You can ask us for a copy of the safeguards.

Your rights as a data subject. You have the right to:

1. ask us to correct inaccurate or outdated personal data;
2. ask us to confirm whether we process your personal data and, if so, for the information set out in Article 15 GDPR and a copy of the data (we may charge a fee covering the necessary costs of further copies);
3. in some cases, have your personal data erased. We erase it without undue delay if we no longer need it for the purposes we processed it for, if you object and we find we have no legitimate interests that justify the processing, or if the processing turns out no longer to comply with the law. This does not apply where processing is still necessary to meet our legal obligation, for archiving, scientific or historical research or statistical purposes, or to establish, exercise or defend our legal claims;
4. have processing restricted. In certain cases you can ask that your personal data be marked and not be subject to any further processing operations;
5. ask for your personal data to be transferred, where we process it on the basis of your consent or a contract;
6. object to processing based on our legitimate interest. We stop unless we have compelling legitimate grounds to continue, and if you object to marketing, we stop it;
7. refuse commercial communications at any time, and withdraw at any time any consent you have given to other processing.

How to exercise them. The best way is by email at support@librato.ai. In the application you can also change your name and password and delete your account yourself, on the Account page.

Complaints. If you believe that we have breached the GDPR when processing your personal data, you have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

Our website. mailgiraffe.io does not use cookies or similar technologies.

The application. The application uses only what it needs to work:

1. a cookie that keeps you signed in, for up to 30 days;
2. a cookie and browser storage that remember your interface settings, such as whether the sidebar is open and which workspace you last used.

Nothing else. We do not use analytics, advertising or other third-party cookies. The payment pages of our payment partner are its own, and it sets its own cookies there.