Privacy Policy - nexmail.ai

Nexmail, Inc. ("Nexmail," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered email marketing platform and related services (collectively, the "Services"). By accessing or using our Services, you agree to this Privacy Policy.

Our Services are designed for businesses, including eCommerce brands and marketing agencies. We provide AI-powered email marketing software that generates email copy and designs, builds campaign calendars, integrates with platforms like Klaviyo and Shopify, tracks performance, and uses AI to optimize future campaigns.

1. Information We Collect

1.1 Information You Provide to Us

When you create an account or use our Services, we collect: - Account Information: Name, email address, business name, and login credentials - Billing Information: Payment details processed securely through our third-party payment processor, Stripe - Company Metadata: Industry, brand voice, product information, and other business-related data you provide to personalize your experience

1.2 Information from Third-Party Integrations

When you connect third-party platforms (such as Klaviyo, Shopify, Google Drive, or other email marketing, eCommerce, and file storage platforms) to our Services, we may collect: - Campaign Performance Data: Email engagement metrics including open rates, click-through rates, and revenue data - Product Information: Product catalog data from your eCommerce platform - Order and Revenue Data: Transaction data tied to your campaigns - Email Content: Email templates and content from connected platforms

1.3 Information from Google Drive

If you choose to connect Google Drive, we request access only to the specific files you select, and to your Google account email address. We do not request access to your Drive as a whole, and we cannot see, browse, or open any file you have not chosen.

You choose files using the Google Picker, a file selection window provided and operated by Google. Only the files you select there are shared with Nexmail. For each selected image we read and download the file and its metadata, such as name, file ID, MIME type, size, and creation and modification timestamps, and store a copy in your Nexmail media library so you can use it in emails you create.

We do not read, download, or store any other file in your Drive, and we cannot access files you add to your Drive later unless you select them as well. Section 12 describes our handling of Google user data in full, and takes precedence over this Privacy Policy wherever the two conflict.

Important Note: Nexmail does not directly collect personal information about your end customers (such as email addresses or purchase history of individual consumers) unless accessed via integrations strictly for analytics purposes.

1.3 Automatically Collected Information

We automatically collect certain information when you use our Services, including: - Usage Data: Information about how you interact with our platform, features used, and time spent - Device Information: IP address, browser type, operating system, and device identifiers - Cookies and Tracking Technologies: We use cookies for authentication, session management, performance analytics, and tracking email component engagement via unique URLs

2. How We Use Your Information

We use the information we collect for the following purposes: - Provide and Improve Services: To generate and personalize AI-driven email copy and designs, build campaign calendars, and deliver our core platform functionality - Campaign Optimization: To improve campaign recommendations, power benchmarking and performance dashboards, and optimize future campaigns using AI - AI Model Training: To train and improve our internal campaign optimization models using aggregated and anonymized campaign performance data from connected email and eCommerce platforms. We never use Google user data, in raw, aggregated, or anonymized form, to train or improve any model. See Section 12. - Account Management: To process billing, manage your account, and communicate with you about our Services - Platform Development: To develop new features, enhance existing functionality, and improve overall user experience - Security and Compliance: To detect and prevent fraud, maintain platform security, and comply with legal obligations - Communications: To send you service-related notifications, updates, and marketing communications (which you can opt out of at any time)

3. How We Share Your Information

We do not sell your personal information, and we do not share it with data brokers, advertisers, or information resellers. We may share your information in the following limited circumstances:

3.1 Service Providers: We share information with trusted third-party service providers who assist us in operating our Services, including cloud hosting providers (AWS, GCP), payment processors (Stripe), email platforms (Klaviyo), analytics providers, and AI model providers (Anthropic and OpenAI).

When you ask Nexmail to generate or edit an email, the content needed to fulfill that request, which may include images you imported from Google Drive, is sent to our AI model providers so that they can return the generated result to you. These providers process that content solely to produce output for you. They do not use it to train their models, and we have not enabled any setting that would permit them to do so.

3.2 Business Transfers: If Nexmail is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction.

3.3 Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

3.4 With Your Consent: We may share your information with other third parties when you have given us explicit consent to do so.

4. Data Retention

We retain your information for as long as necessary to provide our Services and fulfill the purposes described in this Privacy Policy: - Account Data: We retain your account information while your account is active - Campaign and Performance Data: We retain campaign data for benchmarking and analytics purposes unless you request deletion - Deleted Accounts: When you delete your account, we will delete or anonymize your personal information within 90 days or longer, unless you request earlier deletion

5. Data Security

We implement industry-standard security measures to protect your information, including: - Encrypted API integrations using OAuth 2.0 - Encryption in transit using HTTPS/TLS - Role-based access control and token-based authentication - Secure cloud hosting infrastructure - Restricted internal data access - Comprehensive logging and monitoring

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure.

6. Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information: - Access and Portability: You have the right to request access to the personal information we hold about you and to receive a copy in a portable format - Correction and Update: You can update your account information at any time through your account settings - Deletion: You have the right to request deletion of your personal information - Disconnect Integrations: You can disconnect third-party integrations at any time - Marketing Communications: You may opt out of receiving marketing emails by clicking the "unsubscribe" link - Do Not Sell: We do not currently sell personal information

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA and CPRA: - Right to Know: Request information about the personal information we have collected about you - Right to Delete: Request deletion of your personal information - Right to Correct: Request correction of inaccurate personal information - Right to Opt-Out: If we sell personal information in the future, you will have the right to opt out - Right to Non-Discrimination: You have the right to not be discriminated against for exercising your privacy rights

To exercise these rights, contact us at accounts@nexmail.com.

8. European Privacy Rights (GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, you have additional rights under the GDPR: - Right of Access, Right to Rectification, Right to Erasure, Right to Restriction, Right to Data Portability, Right to Object, and Right to Lodge a Complaint.

We process personal data on the following legal bases: performance of our contract with you, compliance with legal obligations, our legitimate business interests, and your consent where required.

9. International Data Transfers

Nexmail is based in California, United States. If you access our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

10. Children's Privacy

Our Services are intended for businesses and individuals who are at least 18 years old. We do not knowingly collect personal information from children under 18.

11. Third-Party Links and Integrations

Our Services may contain links to third-party websites or integrate with third-party platforms. We are not responsible for the privacy practices of these third parties.

12. Google User Data and Limited Use

This section describes how Nexmail handles data obtained through Google APIs. It applies in addition to the rest of this Privacy Policy, and takes precedence wherever the two conflict.

Nexmail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12.1 What We Access

We request the narrowest permissions that support the feature, and nothing more:

Per-file access to Google Drive (drive.file): Access is limited to the individual files you select through the Google Picker. This permission does not allow us to view, browse, search, or open any other file in your Drive, and it gives us no access to your Drive as a whole.
Your Google account email address (userinfo.email): Used to identify the connected Google account and display it in your integration settings.

12.2 How We Use It

We use Google user data only to provide and improve the user-facing features you request:

To import the images you select into your Nexmail media library
To let you place those images in emails you create in Nexmail
To keep an imported image current if you change it in Drive

We do not use Google user data for advertising, for credit or lending decisions, for cross-customer benchmarking, or for any purpose other than the features described above.

12.3 How We Share It

We do not sell Google user data, and we do not transfer it to data brokers, advertisers, or information resellers. We share it only with the service providers required to deliver the features above:

Amazon Web Services, which provides the encrypted storage where imported images are held
Anthropic and OpenAI, which receive an imported image only when you ask Nexmail to generate or edit an email using it, and which process it solely to return that result to you

12.4 AI and Machine Learning

We do not use Google user data, whether raw, aggregated, or anonymized, to develop, improve, or train any generalized artificial intelligence or machine learning model. We do not transfer Google user data to any third party that would use it to train its models, and we have confirmed that our AI model providers do not train on data submitted through their APIs. The internal model training described in Section 2 applies only to campaign performance data from connected email and eCommerce platforms, and expressly excludes all data obtained through Google APIs.

12.5 How We Protect It

Google user data, including OAuth tokens and imported images, is encrypted at rest using AES-256 storage encryption in our database and object storage
All data is encrypted in transit using HTTPS/TLS
OAuth tokens are held server-side and are never exposed to your browser
Google data is scoped to your organization, protected by role-based access control, and is never shared between customer accounts
Internal access is restricted to personnel who require it to operate and support the Services, and is logged and monitored

12.6 Retention and Deletion

Images you import from Drive remain in your Nexmail media library until you delete them or delete your account
Disconnecting the Google Drive integration immediately revokes and deletes our stored OAuth tokens, stops all change notifications, and ends all further access to your Drive. Images already imported remain in your media library until you choose to delete them
Because access is granted per file, revoking Nexmail's access removes our ability to read any file you previously selected
When you delete an imported image, it is removed from your media library. When you delete your account, all associated Google-derived content is deleted or anonymized within 90 days
You may revoke Nexmail's access at any time from your Nexmail integration settings, or directly from your Google Account at https://myaccount.google.com/permissions
To request deletion of Google user data, contact us at accounts@nexmail.com

13. Email Marketing Compliance (CAN-SPAM)

We comply with the CAN-SPAM Act and other applicable email marketing regulations. You are responsible for ensuring that your use of our Services and your email marketing practices comply with all applicable laws.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy. If we make material changes, we will notify you by email or through a prominent notice on our platform.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Nexmail, Inc. Email: accounts@nexmail.com

We will respond to your inquiries in a timely manner and work to address your concerns.