Privacy Policy
Last updated 11 September 2026
Campaign previews
Before subscribing, you can create a bounded campaign preview. We store the company details you confirm, public website excerpts, targeting, draft copy and plan preference for 30 days from creation. A first-party, HTTP-only possession cookie links an anonymous preview to your browser; after sign-in it is associated with your workspace. Confirmed details and relevant website text are sent to Anthropic to suggest buyers and draft copy. No contact enrichment or sending occurs in a preview. We store hashed network identifiers temporarily to enforce abuse limits. Expired previews are inaccessible and removed by daily cleanup; deletion requests can be sent to privacy@usemaila.com.
Who we are
Maila operates the Maila application. This policy explains what we collect when you use usemaila.com and the Maila application, why we collect it, and the choices you have. Contact: privacy@usemaila.com.
What we collect
Account data you give us (name, email, company) through Clerk, our authentication provider. Workspace data you create (campaign websites, research, customer segments, outreach sequences, teammates, jobs, approvals and run logs). Connection tokens for tools you authorise (for example Google), stored encrypted in your workspace vault. Billing data handled by Stripe; we never see full card numbers. Usage and diagnostic data such as request logs and error reports. We record first-party funnel event names and page categories to improve signup and campaign setup; those events do not include your website, email or user ID and respect Do Not Track and Global Privacy Control. Unless your browser sends Do Not Track or Global Privacy Control, Meta Pixel and Meta Conversions API receive page and conversion events, browser identifiers, ad click identifiers, network and device information, and account details when you are signed in. To display a company logo during setup, Google’s favicon service may receive the public company domain and ordinary browser request data. A session-storage draft remembers your entered company website, and first-party cookies preserve your funnel state and advertising attribution.
How we use it
To run the service: executing the jobs you configure, showing you what your teammates did, and billing your plan. To secure the service: detecting abuse and enforcing plan limits. To measure advertising and understand whether campaigns lead to visits, registrations and purchases. To communicate: transactional email about your account and, if you opt in, product updates. We do not sell personal data and we do not train models on your data.
Model providers
When a teammate runs, the content needed for that task is sent to the model provider you configured (for example Anthropic) using your own API key, or to our metered pool using Maila's provider account. Provider terms and retention apply to that transfer. Your credentials are never included in model prompts.
Google user data
Google sign-in uses identity scopes through Clerk. Managed outbound sending does not require Gmail access. If you use a legacy Google connection, the permissions shown on its consent screen govern that connection. Tokens are encrypted, can be revoked by disconnecting the account, and are not used to train models. Our use of Google API data follows the Google API Services User Data Policy, including Limited Use requirements.
Sending on your behalf
For managed sending, Winnr processes mailbox addresses, email content, recipients, message identifiers and replies. We store campaign messages and relevant replies to display your conversations and stop follow-ups. Warmup mail unrelated to your campaigns is excluded. Outreach identifies your business and includes your business postal address and an unsubscribe link. Suppression applies across your workspace.
Retention and deletion
Workspace data is retained while your account is active. You can delete teammates, connections, jobs and run logs from the app at any time, and you can request full account deletion at privacy@usemaila.com. Deleted data is removed from live systems within 30 days.
Sub-processors
Cloudflare (hosting, storage), Clerk (authentication), Stripe (payments), Anthropic (model inference for the metered pool), Meta (advertising measurement), Winnr (managed email hosting, sending and inbox retrieval), and Google (favicon retrieval and connected services you authorise).
Your rights
Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Email privacy@usemaila.com and we will respond within 30 days.
Changes
We will post changes here and, for material changes, email account owners before they take effect.