Legal

Privacy Policy

Last updated: 6 October 2026

This policy explains how Korvantis ("we", "us") handles personal data in KraftedMail, available at kraftedmail.com. It covers two kinds of data: data about our customers and their users, for which we are the controller, and data our customers put into the Service about their own contacts, for which the customer is the controller and we act as a processor.

1. Data about you, our customer

• Account data: name, work email, company, password (stored only as a one-way hash) or your Google account identifier if you sign in with Google.
• Billing data: the amount and date of each credit purchase and the Paddle transaction identifier. Card details are collected and stored by Paddle, never by us.
• Usage data: the actions you run, the credits they consumed, and technical logs such as IP address and browser, kept for security and to operate the Service.
• Demo requests: the message, email, name and optional company you submit on this site, together with IP address and browser details. We use these to answer your request, prevent abuse and keep a record of the conversation.

We use this data to provide the Service, bill for it, keep it secure, and contact you about your account. The legal bases are the performance of our contract with you and our legitimate interest in running a secure service. We do not sell personal data and we do not use advertising trackers.

2. Data you put into the Service

Contacts you import, the public research gathered about them, drafted and sent emails, and replies received are processed only on your instructions and only to provide the Service to you. You are responsible for having a lawful basis to process and contact those people. We help you honour opt-outs: every email includes an unsubscribe link, and opted-out addresses are never emailed again from your account.

When you connect a mailbox, we store the access credentials encrypted and use them only to send the emails you approve and to read replies to those emails.

3. Google user data

If you connect a Google account, KraftedMail uses Gmail API access only to send the emails you approved and to detect replies to them. KraftedMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train AI models, not sold, and not used for advertising.

4. Who processes data for us

We share data only with providers needed to run the Service, under contracts that limit their use of it:

• Paddle (payments and tax, as Merchant of Record);
• AI model providers, reached through OpenRouter, which receive the research material and instructions needed to draft each email;
• Exa (web search), when you ask the Service to search the web for a contact;
• Google and Microsoft, as the mailbox providers you choose to connect;
• Cloudflare Turnstile, to verify that a demo request is submitted by a person and reduce spam;
• our hosting provider, where the application and database run.

Some of these providers are located outside your country, including in the United States. Where required, transfers are protected by standard contractual clauses or equivalent safeguards.

5. How long we keep data

Account and Customer Data are kept while your account is active. When you close your account, we delete Customer Data within 30 days. Billing records are kept for as long as tax and accounting law requires. Technical logs are kept for a limited period for security.

6. Cookies

We use only the cookies needed to keep you signed in, to protect your session and to remember the language you chose. We do not use analytics or advertising cookies.

7. Security

Data is encrypted in transit, mailbox credentials are encrypted at rest, every customer's data is isolated from other customers, and access to production systems is restricted.

8. Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to its processing. If you are a contact of one of our customers, you can unsubscribe using the link in any email, or write to us and we will pass your request to the customer who controls your data. You can also complain to your local data protection authority.

9. Contact

Privacy requests and questions: contato@korvantis.io. We may update this policy and will announce material changes by email or in the Service.