Mitsa Mail — Privacy Policy

Effective Date: 2 September 2026 | Last Updated: 15 October 2026

This Privacy Policy explains how Mitsa Mail, operated by Sector001 Technology Private Limited, 7A, IT Park Dehradun, India ("Sector001", "Mitsa", "we", "us", or "our"), collects, uses, stores, shares, and protects information when you use mitsa.email, the Mitsa web application, and related email and productivity services (collectively, the "Service").

1. Google API Services User Data Policy Compliance

When you connect your Google (Gmail) account to Mitsa Mail via Google OAuth:

• Data Accessed: Mitsa Mail accesses your Gmail email address, profile information, email messages, message threads, subject lines, timestamps, sender/recipient addresses, and message bodies.
• Purpose of Access: We access this data strictly to provide user-facing email client functionality—specifically to display your messages in your unified Mitsa inbox, allow you to compose and send messages, organize threads, search your mailbox, and manage drafts.
• No Advertising: We do NOT use, transfer, or disclose your Google user data to serve advertisements, build advertising profiles, or monetize your personal communications.
• No Model Retraining: We do NOT use your Google user data to train, retrain, or fine-tune generalized machine learning or artificial intelligence models.
• Human Access Restrictions: Human workers do not read your Google user data unless: (1) you have provided explicit permission to resolve a specific technical issue, (2) it is necessary for security investigations (such as investigating abuse or malware), or (3) required by applicable law.
• Limited Sharing: We do NOT transfer or sell your Google user data to third parties, except as strictly necessary to operate the Service infrastructure or comply with valid legal processes.

2. Information We Collect and Process

A. Account and Authentication Data

When you create an account, we collect your Mitsa email handle (e.g., you@mitsa.email), display name, and password. Passwords and passcodes are cryptographically hashed using salted Argon2id algorithms and are never stored in plaintext. We also collect optional recovery email addresses and confirmed timezones to properly format calendar events and email dates.

B. Mailbox and Productivity Content

We process the content of your communications, including emails sent, received, or drafted, attachments, recipient lists, contacts, calendar events, and reminders. This data is processed to deliver, display, and organize your communications.

C. Connected External Accounts (Gmail, Apple iCloud, IMAP)

If you connect external email accounts, we securely store the authentication credentials or OAuth tokens required to establish encrypted connections to those providers. OAuth refresh tokens are stored encrypted and are used exclusively to synchronize your mailbox on your behalf.

D. Website and Product Analytics

Mitsa uses browser storage to keep you signed in. It also stores a strictly necessary first-party marker indicating that a session exists, so returning users who visit mitsa.email can be directed to their mailbox. This marker contains no email address, password, or authentication token.

Mitsa uses Cloudflare Web Analytics to understand aggregate use and performance of our public website and application. It may measure page paths, referrers, browser and device information, approximate location, visits, and web-performance metrics.

Cloudflare Web Analytics does not use cookies, local storage, or browser fingerprinting to identify visitors. Mitsa does not use this analytics data for advertising or cross-site tracking.

We do not deliberately send account email addresses, mailbox content, message subjects, contacts, AI conversations, passwords, OAuth tokens, or other message data to analytics. We do not enable session replay inside the mailbox application or associate analytics with an identified Mitsa account.

E. Log and Technical Data

We automatically collect diagnostic information including IP addresses, browser types, request timestamps, mail delivery server logs, and error telemetry. This data is used solely to maintain server security, monitor network uptime, and prevent fraudulent abuse.

To diagnose unexpected AI behavior, Mitsa retains encrypted copies of the exact AI-provider request payload and response for 7 days. These may include your prompt, recent conversation, and selected mail or workspace details. Mitsa does not deliberately add API keys or login credentials, but content you supplied could itself contain secrets. Full payloads are not written to ordinary server logs; authorized server operators can inspect them for troubleshooting. Hourly cleanup removes expired records, though encrypted backups may retain them until backup rotation. AI usage and cost records are separate.

F. AI Providers

Mitsa may send the context needed for a requested AI feature to Google Gemini or OpenAI, according to the model selected for the Service. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in; see its API data controls. Google's handling of Gemini API data depends on the project's billing status and applicable terms. Mitsa does not train a general-purpose model on your mailbox content.

3. How We Use Information

We use information collected through the Service to:

• Create, maintain, and authenticate your user account;
• Receive, deliver, store, search, and manage your email messages;
• Provide unified inbox access across Mitsa and connected external accounts;
• Facilitate contact management, calendar scheduling, and task tracking;
• Detect and prevent spam, phishing, unauthorized access, and malicious activities;
• Measure aggregate website use, evaluate registration and connection funnels, and improve usability;
• Respond to your support requests and technical inquiries.

4. Data Storage, Retention, and Security

Mitsa Mail takes security seriously. All network communication between your browser and our servers is encrypted using industry-standard TLS (HTTPS). Authentication tokens and sensitive credentials are encrypted at rest.

We retain your account and mailbox data for as long as your account remains active. If you delete an email or disconnect a connected external account (such as Google), the cached data and associated OAuth access tokens are removed from our active database.

5. How to Revoke Access and Delete Data

You have full control over your connected accounts and personal data:

• Disconnect from Mitsa: You can disconnect your Google or other external accounts at any time from the "Connected Inboxes" dialog within the Mitsa application by clicking the "Disconnect" button.
• Revoke from Google Account: You can revoke Mitsa's access to your Google account at any time by visiting Google Security — Third-party apps with account access.
• Account Deletion: You can request complete deletion of your Mitsa account and all associated data by sending an email to privacy@mitsa.email.

6. Children's Privacy

The Service is not intended for individuals under the age of 13 (or the minimum legal age in your jurisdiction). We do not knowingly collect personal information from children.

7. Changes to This Privacy Policy

We may periodically update this Privacy Policy. Any modifications will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our team at:

Sector001 Technology Private Limited
7A, IT Park, Dehradun, Uttarakhand, India
Operating Mitsa Mail (https://mitsa.email)
Privacy Team: privacy@mitsa.email
Support: support@mitsa.email
Legal: legal@mitsa.email
Developer Contact: gaurav.agarwl@gmail.com