Version [DRAFT 1], [DATE]. We tell users [30] days before we add or replace a sub-processor, [in the app and by email / LAWYER], so they can object or end their plan.
In use
Cloudflare
| Entity | Cloudflare, Inc., United States [CONFIRM the contracting entity in the account's terms] |
|---|---|
| What for | Runs MailGraph's server (the relay at account.mailgraph.app), stores the account and the sync mailboxes, sends the sign-in emails, hosts the app's update files |
| Contract | Cloudflare's self-serve terms and data processing addendum on the Workers Paid plan [CONFIRM that the addendum is in force for the account, and who signs it once the company exists] |
| Transfer safeguard | [CONFIRM: the EU-U.S. Data Privacy Framework and/or the standard contractual clauses in Cloudflare's addendum] |
The Cloudflare services the relay uses, and what each handles:
| Service | What it does for MailGraph | Personal data it handles | Where |
|---|---|---|---|
| Workers | Runs the relay: sign-in, devices, the sync mailbox routes, MailGraph AI's route | Everything a request carries, in memory: email addresses at sign-in, device names and keys, tokens, sealed sync records, and the text of MailGraph AI's questions and answers, which are never stored. The internet address of every request; the relay itself keeps only a daily-changing hash of it for rate limits and the two-letter country | The Cloudflare location that receives the request, normally the one nearest the user, worldwide (no placement is set) |
| Workers static assets | Serves the account site's pages | The internet address of the browser | as Workers |
D1 (two databases, mailgraph-accounts and mailgraph-usage) | The account, its identity (the address, sealed), devices, hashed sign-ins and codes, the security list, rate-limit counts, the deletion list; the allowance, a paid plan with Paddle's customer number, the ids of Paddle's notices already handled, and money spent | as listed in the privacy notice, under The MailGraph account | EU jurisdiction (made with --jurisdiction eu) [CONFIRM in the dashboard] |
Durable Objects (Mailbox, Budget, one of each per account) | The sealed records between a user's devices (7 days at most); the money spent per month (per billing period for a paid plan) and short holds while a question runs | Sealed records it cannot open; which device sent what to which, when and how large; the names, keys and one-time numbers in the first, unsealed messages that add an iPhone | EU jurisdiction (DATA_JURISDICTION = "eu") |
| Email Sending (Email Service, in public beta) | Sends the six-digit sign-in code and the notice when an old sign-in was used again, from sign-in@mailgraph.app | The recipient's address, the code, the device name in a notice | [CONFIRM where it processes, and what delivery logs it keeps and for how long] |
| R2 (a public bucket) | Holds the app's update files; the app asks it for the newest version and downloads updates | The internet address of the Mac | [CONFIRM the bucket's location and whether access is logged] |
| Cron Triggers | Runs the nightly clean-up at 03:17 UTC | none of its own | — |
Request logging ("observability") is off for the relay, and the relay's code writes no log. [CONFIRM what Cloudflare still records of requests on its own, for example for security or aggregate analytics, and for how long.] [CONFIRM how long Cloudflare keeps restore points of D1 databases and Durable Objects, during which deleted data can still be restored.]
Built in, switched off: Cloudflare Turnstile on the sign-in form. If it is switched on, the sign-in form's check, with the user's internet address, goes to Cloudflare's Turnstile service. Add it to this list before switching it on.
Planned: the website on Cloudflare Pages (it would see visitors' internet addresses; it sets no cookies and runs no analytics).
Built in, off until Apple's key is in: Apple Push Notification service (Apple Inc.). New mail as a notification on an iPhone that asks for it: the relay sends each notice to the phone through Apple's service, with the phone's push token. What the notification says is sealed on the Mac to the iPhone (Apple sees a sealed notice and the words "New mail"); Apple sees the token, the app it is for, when, and the internet address of the relay. [CONFIRM Apple's terms for the service (the Apple Developer Program License Agreement), and whether Apple counts as a sub-processor for a sealed notice.] Add it under "In use" once the key is in.
Only for tests until the legal texts are live
Anthropic
| Entity | Anthropic, PBC, United States [CONFIRM: the contracting entity for a company in the EU] |
|---|---|
| What for | Answers MailGraph AI's questions (the Claude API: Claude Sonnet 5.5 by default; Anthropic's own fallback to another Claude model when the first declines) |
| Personal data | The text of each question: the user's emails (text, senders and recipients by name and address, subjects, dates), the text of attached PDFs, project summaries and the people in them, calendar events, drafts. Card numbers, bank account numbers, link tails and long codes are taken out first; names and sensitive content are not. The answer |
| Where | [CONFIRM where Anthropic processes API requests; by default outside the EU] |
| Kept | [CONFIRM: how long Anthropic keeps API inputs and outputs (docs/ACCOUNT_PLAN.md noted on 17 October that it deletes them within 30 days); whether zero data retention is granted (the plan asks for it); no training on API data; what is kept longer when Anthropic's safety systems flag a question; that the prompt cache only holds MailGraph's fixed instructions for a short time] |
| Contract | For the company, none yet. Needs: a commercial API account for the company, Anthropic's commercial terms and data processing terms, the zero-retention request, and a spend limit in Anthropic's Console. Today's test runs on a Console organisation in the maker's own name (docs/AI_INCLUDED_PLAN.md, step 1) |
| Transfer safeguard | [CONFIRM: the EU-U.S. Data Privacy Framework and/or standard contractual clauses] |
| Status | Since 18 October it answers for invited accounts only (AI_INCLUDED = "invited"): the maker's own mail, as a test. Not to be offered to anyone else before the company exists and this list, the privacy notice and the terms are live |
Paddle
| Entity | Paddle.com Market Limited, United Kingdom; by Paddle's buyer terms, Paddle.com Inc. sells to buyers in the United States and Paddle.com (Canada) Ltd. to buyers in Canada [CONFIRM] |
|---|---|
| What for | Selling MailGraph AI's paid plans as merchant of record: checkout, payment, VAT, invoices, refunds, and its customer portal for the card, receipts and cancelling |
| Role | As merchant of record Paddle sells to the user in its own name and is the controller of the payment data it collects. It is listed here because MailGraph and Paddle exchange data about the user [LAWYER: confirm the role and the wording] |
| Data MailGraph sends | The account's internal id, in each checkout's custom data, so that the plan reaches the right account; with Paddle's own customer id, requests for a link to its customer portal and to cancel a plan for the end of its billing period, or to keep it (relay/src/paddle.ts). No email address, name or card |
| Data MailGraph receives | Paddle's signed notices about the plan: its status, the end of its billing period, a cancellation for that day, full refunds and chargebacks, and Paddle's customer id, kept in seller_customer; each notice's id is kept so that it counts once. Notices about payments, which may carry card details, pass through the relay's memory unused: only their id is kept |
| Transfer safeguard | [CONFIRM: the EU adequacy decision for the United Kingdom] |
| Status | Built and tried in Paddle's sandbox, its test mode with test cards only, on 18 October: checkout, notices, customer portal, cancelling and keeping a plan (docs/AI_INCLUDED_PLAN.md, step 4). The live account waits for the company (step 6) |
In the code, not in use
- Resend (resend.com), an alternative way to send the sign-in emails (
MAIL_PROVIDER = "resend"). Not in use: production sends through Cloudflare (MAIL_PROVIDER = "cloudflare"). Add it to this list before switching.
Not sub-processors of MailGraph
These receive data when someone uses MailGraph, but under the user's own agreement with them, or at the user's own request, not for MailGraph:
- The AI a user connects with their own account: Anthropic through Claude Code (the user's Claude plan), OpenAI (the user's ChatGPT plan), OpenRouter and the providers it routes to (the user's OpenRouter credit). MailGraph is the software; the question goes from the user's Mac under the user's account. [LAWYER: confirm, open question 1 of what-leaves-the-mac.md.]
- A model on the user's Mac (Ollama, LM Studio): runs on the same Mac; nothing is sent.
- The user's mail and calendar providers (Apple iCloud, Google, Microsoft, Fastmail, any IMAP server), and Google's and Microsoft's sign-in pages for those accounts.
- Senders' own servers, for logos and the pictures in an email.
- Publishers of programs and models the user chooses to download: Anthropic's installer for Claude Code, Ollama's model library.
No analytics, crash-reporting or advertising service is used in the Mac app, the iPhone app, the relay or the account site.