Privacy Policy
Last updated: August 12, 2026
This Policy describes what data we collect, for what purpose, and to whom we pass it. It covers the Word2Mail browser extension, the web platform at word2mail.com, and the backend services behind both.

A few terms are used consistently throughout this document — "AI model provider", "identity provider", "payment processor", "supported mailbox". Who is behind each of them today is listed in the table in section 5.

1. Who is responsible for your data
   1.1 The controller
   Word2Mail is operated by:

Piotr Kucharski, trading as "Piotr Kucharski Bioinformatyka" (jednoosobowa dzialalnosc gospodarcza — a Polish sole proprietorship)
ul. Meksykańska 3 lok. 14, 03-948 Warszawa, Poland
NIP: 1133118497  |  REGON: 527213825

For all matters covered by this Policy, Piotr Kucharski is the sole Data Controller under Article 4(7) GDPR.

1.2 How to reach us
Email admin@word2mail.com for anything privacy-related: questions about this Policy, exercising your rights, or reporting a concern.

1.3 Roles under GDPR
For your account data (profile, preferences, billing, generation metadata) we act as Controller. For the transient content of the message and voice recording (or typed instruction) you submit for a single generation, we act as Processor on your behalf — you decide what to dictate and send; we exist to carry it to the AI model and back.

1. What we collect, and why
   There is exactly one advertising-related use: measuring how our own campaigns perform — only after your marketing consent, and only in the scope described in sections 2.9 and 5.

2.1 Voice input
When you dictate, the extension records audio and passes it to the AI model provider to generate your draft. We do not store the recording on our servers — it is deleted the moment the generation is complete. If you type your instruction instead of speaking, the same rule applies to that text.

2.2 The message you are replying to
When you reply to a message, the extension reads its text — at the moment you ask for a draft to be generated — and passes it, together with your recording or typed instruction, to the AI model provider for that single generation. It is then discarded; we do not persist it. When you write a new message from scratch, the extension reads no correspondence at all.

Such a message contains other people's data. The email addresses and words of people who wrote to you are part of what we read and pass to the AI model provider. We process it solely for that one generation, on your behalf. None of it is stored, and none of it is used for anything beyond that single generation.

2.3 Your account
Signing in uses a third-party identity provider, whichever you choose. We receive and store your user ID at that provider, email address, display name, and profile picture URL where the provider supplies one, to authenticate you, enforce your plan's quota, and let you use the Service across devices.

If you use the extension in more than one mailbox, we also store the addresses of those mailboxes against your account — so we can tell which one you are working in and attribute the generation to the right plan.

2.4 Preferences and custom instructions
Settings such as language, tone, and auto-generate toggles, plus any free-text "custom instructions" you write to steer how the AI drafts for you, are stored against your account and sent to the AI model provider with every generation. If you put your name, title, or company in your custom instructions, that becomes part of your stored preferences.

2.5 Generation records (metadata only)
Every time you generate an email, we write a technical record about that generation, tied to your pseudonymous user ID, capturing basic operational measurements (such as timing, length indicators, and your rating if you give one). We deliberately do not store your recording, the input text, the message content, or the generated email itself in this record — only the measurements. These records exist to keep the service reliable, improve quality over time, and calculate cost.

2.6 Feedback and the ratings program
If you rate a generation, we store that rating. Ratings may earn you bonus generation credits.

2.7 Billing and purchases
Subscription status, plan tier, and one-time "Generation Pack" purchases are recorded against your account. We store the package purchased, credits granted, amount, and status — we do not receive your card number or CVC — you give them directly to the payment processor. If a purchase fails to process cleanly, we record that event for review and delete it after a short period.

2.8 Website usage
If you consent to analytics, we measure site usage without passing that data to any third-party analytics provider, to see which pages and buttons get used, so we can fix what's broken and prioritize what matters. These events are not tied to your account, to a user ID, or to any identifier stored on your device. Your IP address and browser user-agent reach us; they are used only to produce aggregate figures (such as country and device type) and are never kept as a profile of you.

2.9 Advertising attribution (opt-in only)
If you consent to marketing cookies, we remember how you arrived at the site, in a small number of first-party cookies valid for a limited period. This serves one purpose only: understanding which ad campaigns bring people to the site.

When we record a visit we also store your IP address and user-agent, for as long as we need to link that visit to a later install and sign-up. This record is only created after marketing consent, and it goes away when you withdraw it.

2.10 Contact form
If you write to us through the website's contact form, we store your name, email, and message to respond to you. We do not store your IP address — it is used only at the moment you submit the form, to limit abuse.

2.11 Local device storage
Your language and theme preferences, and your cookie-consent choice, are stored in your browser on your own device. Our servers only see any of it if you explicitly sync a preference to your account.

2.12 Location detection (IP-based)
When you visit the site or use the extension, we resolve your country from your IP address — the address itself is not stored for this purpose, and we resolve country only, never city or any finer location. We remember the result briefly in your browser so we don't repeat the lookup on every visit. The country code is used to show the right currency, to set your default interface language, and — from account creation onward — to decide whether we can currently offer the Service in your country at all (Section 2.13).

2.13 Registration country, billing country, and the market waitlist
We currently only accept new sign-ups and purchases from Poland. The country resolved at the moment you register is stored against your account, together with the country the payment processor reports at your first purchase — both are kept to meet EU VAT place-of-supply record-keeping requirements (Council Implementing Regulation (EU) No 282/2011). If either was resolved incorrectly (for example because of a VPN or travel), contact us and we will correct it.

If your country isn't one we support yet, you can leave your email address to be notified when it is. Submitting your email into that form is itself your consent to receive that one notification (Polish Electronic Communications Law, art. 398(2)) — we do not use it for anything else, and it is never added to a newsletter or marketing list. You can remove yourself at any time, with no login required, using the same email address; we also delete the entry automatically no later than 12 months after signup, whichever comes first.

Automated country check. The country check performed when you create an account is automatic, with no human involvement, and it happens before any contract is formed. If your country is not supported yet, you can join the waitlist described above.

1. Where your data goes: AI processing
   3.1 Our AI model provider
   Every generation — turning your recording (or typed text) and, when you are replying, the message text, into a draft — is processed by the AI model provider under an arrangement we have with that provider. We may change the AI model provider; the current one is always named in the table in section 5. If a change materially affects processing of your data, we will notify you as described in section 10.

3.2 What we send, and what happens to it
We send your voice recording (or your typed instruction), the text of the message you are replying to, and your first name. Under the terms of that arrangement, this content is not used to train the provider's models. Retention on our side is described in Section 6. Only the metadata described in Section 2.5 persists.

3.3 Automated selection of generation settings
Generation settings are selected automatically, based on aggregate data across all users — never your individual profile. You always see the result and can regenerate, edit, or discard it; nothing is sent on your behalf without your review. This does not amount to automated decision-making with legal or similarly significant effects on you under Article 22 GDPR.

3.4 Our commitments regarding your mail content
We only use the content of your correspondence to power features you can see and asked for (drafting, replying, summarizing). We never use it for advertising, and we never use it to build behavioral or creditworthiness profiles. We never sell it. We do not transfer it to third parties beyond what's needed to generate your draft. No Word2Mail employee or contractor reads your email content, except with your specific, affirmative request (e.g. a support ticket), for security investigation, or where the law requires it.

Extension store compliance. Our use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

1. Legal bases for processing (GDPR Article 6)
   What | Basis | Why |
   Voice recording or typed instruction, reading the text of the message you are replying to, passing that data to the AI model provider | Contractual necessity (Art. 6(1)(b)) | Without this processing no draft can be produced. |
   Account, preferences, custom instructions, billing | Contractual necessity (Art. 6(1)(b)) | Can't run the Service you signed up for without them. |
   Generation metadata, fraud/abuse prevention, contact-form IP handling | Legitimate interest (Art. 6(1)(f)) | Keeping the Service reliable, secure, and improvable, balanced against minimal, pseudonymized or anonymized collection. |
   Invoices and payment records | Legal obligation (Art. 6(1)(c)) | Polish tax law requires us to keep them. |
   Country detection (currency, language, market eligibility); registration-country and billing-country records | Legitimate interest (Art. 6(1)(f)) for browsing/eligibility; Legal obligation (Art. 6(1)(c)) for the VAT place-of-supply record once you buy | Avoiding tax and consumer-law obligations in countries we haven't verified we can serve, and meeting EU VAT evidence rules for paying customers. |
   Website analytics | Consent (Art. 6(1)(a)) | The Service works exactly the same if you decline. |
   Sending conversion data to the advertising platforms to measure how our campaigns perform | Consent (Art. 6(1)(a)); for reading and writing identifiers on your device, additionally Article 399(1) of the Polish Electronic Communications Law | You can withdraw consent at any time via "Cookie Settings"; withdrawal takes effect going forward. |
   Sending commercial information to your email address (new features, promotions, tips) — only if you tick the separate checkbox on the welcome screen | Consent (GDPR Art. 6(1)(a)) plus the prior consent required for commercial information sent by electronic means (Article 398(1) of the Polish Electronic Communications Law; Article 398(2) allows that consent to be given by supplying an address for the purpose of receiving commercial information — the address you gave when creating the account is not such a supply) | Declining has no effect on creating an account or on using the Service. |
   Market waitlist signup | Consent (Art. 6(1)(a)), given by submitting your email; Polish Electronic Communications Law art. 398(2) treats this submission itself as consent to the one notification | — |

For every consent we record the revision of the Terms and of the Privacy Policy you were shown, and the time it was given.

Three separate consents. The marketing-cookie consent (section 2.9) — cookie banner and the "Cookie Settings" link. The commercial-information consent (the messages we send to your email address) — a separate checkbox on the welcome screen, withdrawn in your account settings or via the link in the footer of every message. The extension-telemetry consent (anonymous events about how the extension itself behaves, not the content of your correspondence or what you dictate) — a separate checkbox on the welcome screen, withdrawn in your account settings. None of these three is a condition of the others, and none is a condition of using the Service. Withdrawal takes effect going forward and does not affect the lawfulness of messages sent before it.

1. Who else touches your data
   We use the third-party processors listed in the table below. Some of them are established outside the European Economic Area, or operate on globally distributed infrastructure. In every such case we rely on appropriate transfer safeguards recognized under Chapter V of the GDPR — such as the European Commission's Standard Contractual Clauses or, where applicable, the EU-US Data Privacy Framework. On request we will tell you which mechanism applies to which recipient.

Term used in this Policy | Who that is today | For what | What it receives | Where |
AI model provider | Google (Gemini API) | generating your reply | voice recording or typed instruction, the text of the message you are replying to, your first name | EU / provider's global infrastructure |
infrastructure provider | Google Cloud Platform | hosting, database, authentication | account data | European Union |
identity provider | Google, Microsoft | sign-in | user ID, email address, display name, profile picture URL | EU / provider's global infrastructure |
payment processor | Stripe | payment processing | email address, account identifier, amount, currency | US / EU |
our own analytics instance | Plausible Community Edition | site analytics (with consent) | IP address and user-agent at request time, event name | self-hosted, EU |
advertising platforms | Meta Platforms Ireland Ltd. | advertising measurement (only after marketing consent) | at most: hashed email address, a hashed identifier of your account, click and browser identifiers passed unhashed, purchase amount and currency; and if the pixel is running in your browser, also your IP address and user-agent. | Ireland; infrastructure also outside the EEA |
advertising platforms | Google Ads | advertising measurement (only after marketing consent) | at most: your consent signals and click identifiers | EU; infrastructure also outside the EEA |
transactional email provider | Gmail (SMTP) | transactional email delivery | recipient address and message content | EU / provider's global infrastructure |

Without your marketing consent, nothing reaches the advertising platforms.

Where the extension runs. The term "supported mailbox" means, today, Gmail (mail.google.com) and Outlook on the web (outlook.live.com, and — for Microsoft 365 work mailboxes — outlook.office.com and outlook.office365.com). The extension additionally loads on our own pages, solely to sign you in and connect it to your account. On no other website does it run.

We also keep our own attribution records, which link the source of your visit and your purchase with your email address, so that we know which advertising campaigns work. No third party receives them.

We do not add new recipients without updating this Policy and notifying you as described in section 10.

1. How long we keep things
   We keep personal data only for as long as we need it to run the Service, comply with our legal obligations, and defend our legitimate interests. In practice this means:

Raw voice audio: not stored — deleted the moment the generation is complete.
Message text and your dictated or typed instruction sent for a generation: not persisted — discarded once the draft is returned.
Generation metadata and other operational records: retained for up to 12 months, then automatically deleted.
Purchase records: retained for up to 7 years from the purchase date, then automatically deleted — this covers both our accounting-record retention obligations and the general period during which a purchase-related claim could still be raised against us; for this reason purchase records are excluded from the deletion cascade described in Section 7.2.
Failed-purchase review queue: retained for a short period for manual review, then automatically deleted.
Feedback ratings and bonus balance: kept for the life of the Account, deleted on account deletion.
Website analytics events: retained for a limited period.
Account profile, preferences, custom instructions: kept for the life of the Account, deleted on account deletion.
Contact-form submissions: retained only as long as necessary to handle your enquiry and any follow-up.
Tax invoices: kept until the limitation period expires for the tax liability connected with the transaction (Article 70 § 1 of the Polish Tax Ordinance), which for a typical transaction means roughly seven years from the date the transaction took place.
Registration country and billing country: kept for the life of the Account plus the statutory VAT/tax record-keeping period.
Market waitlist signups: deleted automatically no later than 12 months after signup, or immediately if you unsubscribe.

1. Your rights
   7.1 Access and portability (Art. 15, 20)
   The dashboard's "Export My Data" button gives you a machine-readable file with your data. Subscription and invoice history is not covered by that export (it lives with the payment processor) — email admin@word2mail.com and we'll add it within 30 days.

7.2 Erasure (Art. 17)
The dashboard's "Delete Account" button immediately deletes: your profile and usage history, your generation records, your contact-form submissions, your authentication account, and cancels any active Subscription. Purchase records are not deleted at this point — they are retained for the period described in Section 6 as accounting evidence for payments we've received. Within the same 30-day window we delete or anonymize the remaining data tied to your account, including at the payment processor; invoices are kept per tax law (Section 6).

7.3 Rectification (Art. 16)
Update your display name and preferences directly in the extension popup or the web dashboard.

7.4 Restriction and objection (Art. 18, 21)
Turn off auto-generate or specific features in your settings, or withdraw analytics/marketing consent any time via the cookie settings link in the footer. You can object to processing based on our legitimate interest (Section 4); we'll stop unless we have compelling grounds that override your interest.

7.5 Revoking access at your identity provider
Sign-in access can be revoked at any time in your account settings at your identity provider.

7.6 Complaints
You can lodge a complaint with the Polish data protection authority:
Prezes Urzedu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
https://uodo.gov.pl

7.7 Response time
We may ask you to verify your identity first for requests made outside the authenticated dashboard.

1. Cookies and similar technologies
   Essential (always on, no consent needed): your sign-in session, and your cookie-consent choice itself, stored in your browser.

Analytics (only after you opt in): none — no cookies and no local storage entries. The website usage described in Section 2.8 is measured by a cookieless script which stores nothing on your device. It reads from your browser only the flag that opts you out of measurement, if you have set it yourself. Reading terminal-device storage falls under Article 399(1) of the Polish Electronic Communications Law; we keep it behind your opt-in.

Marketing/attribution (only after you opt in): the first-party attribution cookies described in Section 2.9.

Manage your choice at any time via the "Cookie Settings" link in the site footer.

1. Children
   Word2Mail is not directed at children under 16. We do not knowingly collect data from anyone under that age; if we learn that we have, we will delete the account and associated data promptly.
2. Changes to this Policy
   We'll update the "Last updated" date for any change. If a change meaningfully expands what we collect or how we use it (a new AI model provider, a new sub-processor, a longer retention period), we'll notify you by email or an in-product notice before it takes effect, and prompt you to re-consent where the change touches consent-based processing.