MailFlows ("we", "our", "the Service") is a cold email platform that lets you connect your own Gmail account to find, verify, and email business contacts from a single dashboard. This policy explains what data we collect, why, and how it's handled — including how we use data accessed through your Google Account.
Summary: how MailFlows handles your Google user data
What Google user data we access: your Google account email address and profile name (scopes userinfo.email and userinfo.profile), and permission to send email from your connected Gmail account (scope gmail.send). We do not request access to read your Gmail inbox.
How we use it: only to show which Gmail account is connected, and to send emails from that account when you click Send inside MailFlows (Quick Send, Campaigns, or Reply). We never send anything without you initiating it.
Who we share it with: no one for advertising, and we never sell it. Google user data is shared only with the service providers strictly needed to run MailFlows (listed in Section 4) or when required by law. It is not used to train generalized AI or machine learning models.
How we protect it: Gmail access tokens are encrypted at rest, passwords are never stored in plain text, and all traffic between your browser and MailFlows is encrypted over HTTPS.
Retention and deletion: sent emails and replies are automatically and permanently deleted after 90 days. You can disconnect Gmail at any time from Settings, revoke access from your Google Account permissions page, or request deletion of your account and data by contacting us.
1. What we collect
Account info: your email address and password (stored securely, hashed, via our authentication provider), and your display name.
Contacts you add or find: names, email addresses, company/website info you manually add, import, or discover using our email-scraping tool.
Campaign and email data: subject lines, message content, send timestamps, and replies to emails you send through MailFlows.
Payment info: handled entirely by our payment processor (Paystack) — we never see or store your card details.
Basic usage data: which features you use, for the purpose of enforcing plan limits and improving the product.
2. How we use Google user data
When you connect your Gmail account, MailFlows requests the following Google OAuth scope:
Scope
What it's used for
gmail.send
Sending emails on your behalf, only when you click Send (Quick Send, Campaigns, or Reply) inside MailFlows. We never send anything without you initiating it.
userinfo.email, userinfo.profile
Identifying which Gmail account you've connected and displaying your name/email in the app.
MailFlows does not request permission to read your Gmail inbox. We do not use any Gmail read scope (gmail.readonly or gmail.metadata). Replies to emails you send through MailFlows are captured through a separate mechanism: outgoing emails carry a unique reply-tracking address on our own domain, and replies sent to that address are routed to us directly — your Gmail inbox itself is never accessed by MailFlows.
Limited Use disclosure: MailFlows' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the specific features described above, is never used for advertising, and is never sold or transferred to third parties except as necessary to provide the Service (see Section 4) or to comply with the law.
AI and machine learning disclosure: MailFlows does not use, transfer, or disclose Google user data (including data received via Gmail API scopes) for the purpose of training, fine-tuning, or improving generalized or non-personalized AI or machine learning models.
3. Data retention
Sent emails and replies are kept for 90 days, then automatically and permanently deleted.
Contacts and campaign data are kept until you delete them or close your account.
If you disconnect your Gmail account, we stop accessing it immediately — no further sends or data access occur through that connection.
4. Who we share data with
We use the following third-party services to operate MailFlows. Each only receives the minimum data needed to perform its function:
Supabase — database, authentication, file storage
Railway — backend hosting
Cloudflare — frontend hosting, DNS, and reply-capture routing
Google — Gmail sending, on your explicit authorization
Paystack — payment processing
Tavily — web search used for the contact-finding/scraper feature
Google Gemini API — powers the optional AI email-writing assistant and FAQ chatbot
We do not sell your data or any Google user data to anyone, ever.
5. Your rights
You can disconnect your Gmail account at any time from Settings — this immediately revokes MailFlows' access.
You can permanently revoke MailFlows' access to your Google Account at any time via Google Account Permissions.
You can request deletion of your MailFlows account and all associated data by contacting us (below).
You can export your contacts at any time via the Contacts page.
6. Security
Passwords are never stored in plain text. Sensitive tokens (such as Gmail access tokens) are encrypted at rest. All traffic between your browser and MailFlows is encrypted via HTTPS.
7. Children's privacy
MailFlows is not directed at children under 16 and we do not knowingly collect data from them.
8. Changes to this policy
If we make material changes to this policy, we'll update the date at the top of this page and, where required, notify you directly.
9. Contact
Questions about this policy or your data? Reach us through the in-app Support option, or email teams@mailflows.org.