Privacy policy

Who we are

MailPilot is operated by DanAI (“we”). This policy explains how the MailPilot website, web app and Chrome extension handle personal data. Contact: hello@dan.ai.vn.

What we collect

Account: your email address, a salted hash of your password, your display name, language and reminder preferences.

Follow-ups you create: recipient email address, optional contact name, email subject, your notes, reminder dates, status and an activity log (for example “followed up”).

Optional image signal: only if you turn it on for an email — the time an image request was received and a coarse client category (for example “Gmail proxy”).

Session data: a hashed session token so you stay signed in.

What we never collect

The body of your emails, your inbox contents, attachments, IP addresses of email recipients, device fingerprints or location. We use no advertising or third-party analytics trackers on this website or in the app.

How the Gmail extension works

The extension runs in your own browser. When you click “Add to queue” in a Gmail compose window, it reads that draft’s recipient and subject and sends them to MailPilot. If “notice possible replies” is on, it reads sender addresses visible in your Gmail inbox list, compares them in your browser with your own waiting follow-ups, and sends only the matching addresses. It does not read email bodies and never sends email. MailPilot has no Gmail API access to your account.

Why we use data

To provide the service you ask for (reminders, templates, statistics), to keep your account secure, and to answer support requests. We do not sell personal data and do not use your data to train AI models.

Image signals and your recipients

The image signal is off by default. If you enable it, you are responsible for telling your recipients and, where the law requires it (for example in the EU), obtaining their consent. A signal is never presented as proof that an email was read.

Retention and deletion

Your data is kept while your account exists. You can delete any follow-up, export all your data as JSON, or delete your account at any time in Settings; deletion is immediate in our live database. Once hosted backups are introduced, deleted data will expire from backups within 30 days.

Your rights

You can access, correct, export and delete your data from the app, and contact us to exercise any right under applicable law, including Vietnam’s Personal Data Protection Law (Law 91/2025/QH15) and the EU GDPR.

Security

Passwords are hashed with scrypt; sessions use random tokens stored only as hashes; the web app uses HttpOnly cookies with CSRF protection; every record is scoped to its owner. No method of storage or transmission is perfectly secure.

Changes

We will announce material changes in the app and by email before they take effect.