Privacy Policy

Go Banana Mail (“we”, “us”) is an AI email assistant. You connect an email account, we read incoming messages, and we draft replies for you using AI. Because that means we handle your email, this policy describes exactly what we collect, where it goes, and how to get it deleted.

Questions about anything here? Email privacy@gobananamail.com.

1. What we collect

Account information

Your email address, full name, and (if you upload one) a profile picture. If you sign up with a password we store a hashed version of it — never the password itself. If you sign in with Google, we request only the openid, email, and profile scopes and store your Google account ID, email, and name. We do not request Gmail API or mailbox scopes through Google Sign-In.

Email account credentials

To sync mail we ask for IMAP and SMTP connection details (host, port, username, password or app password) for the account you connect — Gmail, Outlook, or any custom mail server. Passwords are encrypted at rest with AES-256-GCM before being written to our database and are only decrypted in memory when connecting to your mail server.

Email content

For each connected account we fetch and store messages: subject, sender and recipient addresses (including CC), the plain-text and HTML body, message headers used for threading, attachment metadata (name, size, content type), and timestamps. When you first connect an account you may choose to backfill historical email going back a number of days you select; those messages are stored the same way. We store both messages you receive and replies sent through us.

Knowledge base and uploaded documents

Any knowledge base entries you write, and any documents you upload to build one (PDF, DOCX, TXT, Markdown). Uploaded files are stored in our object storage; their extracted text is turned into question/answer pairs that you review before they become knowledge base entries.

Billing information

Your subscription plan, billing period, payment history (amount, currency, status, date), and Stripe customer and subscription identifiers. We never see or store your card number — card details are handled entirely by Stripe.

Usage data and logs

Counts of emails processed and AI responses generated per billing period, AI token usage, and processing times. Our servers keep standard HTTP request logs (timestamps, request paths, status codes, error messages) for operating and debugging the service. We do not use third-party web analytics, advertising, or tracking pixels, and there are no advertising cookies on this site.

2. Why we collect it

• To draft AI replies. The content of an incoming email, earlier messages in the same thread, and your relevant knowledge base entries are sent to our AI provider so it can generate a reply.
• To decide what needs a reply. The same AI step decides whether a message deserves a full reply, a short acknowledgment, or nothing at all — this is how junk and no-reply-needed mail gets filtered out of your drafts.
• To power your dashboard. Threads, drafts, sent mail, and account status are shown to you in the app.
• To send replies. Approved (or auto-approved) drafts are sent through your own SMTP server.
• To run your account. Authentication, password resets, billing, quota enforcement, and service notifications.

3. AI processing of your email

We want to be explicit about this: the body of your incoming emails, the preceding messages in that thread, and your knowledge base content are transmitted to DeepSeek (api.deepseek.com), a third-party large-language-model provider, over an encrypted connection. Uploaded document text is sent to the same provider when generating question/answer pairs.

We do not use your email content to train our own models. What DeepSeek does with data submitted to its API is governed by DeepSeek’s own privacy policy and terms, which you should read if this matters to you. We store what comes back — the generated draft, the model name, token count, and processing time — in our database alongside the thread.

4. Third parties who process your data

We do not sell your personal data, and we do not share it for advertising. We share it only with the service providers below, only as needed to run Go Banana Mail:

We may also disclose data where legally required — for example in response to a valid legal request — or to protect our rights or the safety of users.

5. Retention and deletion

We keep your data for as long as your account exists. We do not currently run an automatic expiry job that ages out old email, drafts, or knowledge base content — synced messages stay in your account until you or we delete them.

• Disconnecting an email account deletes that account’s stored credentials, threads, messages, and the AI drafts generated for them.
• Deleting a knowledge base entry or document import removes it, and removes the extracted question/answer pairs belonging to it.
• Deleting your account removes your profile, connected email accounts, all stored email threads and messages, AI drafts, knowledge bases, uploaded documents, usage records, and billing history.

You can delete your account yourself at any time from Settings → Delete Account in the app. When you do, we immediately stop syncing your mailboxes, disable auto-replies, and cancel any active subscription — no further email content is read or sent to our AI provider from that moment.

Your data is then held for 30 days so you can change your mind, and permanently erased after that. To restore an account inside that window, contact privacy@gobananamail.com. You can also email us to request deletion instead of using the in-app flow; we action those requests within 30 days. Backups are purged on their normal rotation after erasure.

Data held by the third parties listed above is retained under their own policies; we ask them to delete on our instruction where their service supports it.

6. Your rights

Depending on where you live (including under the GDPR in the EU/UK and the CCPA/CPRA in California) you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — fix inaccurate account information, which you can also do yourself in your profile settings.
• Delete — request erasure of your account and data, as described above.
• Port — receive your data in a machine-readable format.
• Restrict or object — ask us to stop particular processing. You can stop AI processing at any time by disabling auto-response or disconnecting the email account.
• Opt out of sale or sharing — we do not sell or share personal data for cross-context behavioural advertising, so there is nothing to opt out of, but you may confirm this with us.
• Non-discrimination — we will not degrade your service for exercising these rights.

Exercise any of these by emailing privacy@gobananamail.com. We respond within 30 days. EU/UK users also have the right to complain to their local data protection authority.

7. Security

Email account passwords are encrypted at rest with AES-256-GCM. Account passwords are stored as one-way hashes. Traffic between you and us, and between us and every provider listed above, is encrypted in transit. No system is perfectly secure, but we limit access to production data to those who need it to operate the service.

8. Children

Go Banana Mail is not intended for anyone under 16, and we do not knowingly collect their data.

9. Changes to this policy

If we change this policy we will update the date at the top of this page and, for material changes, notify you by email.

10. Contact

Privacy questions, data requests, and deletion requests: privacy@gobananamail.com