Privacy Policy

Who we are

Mailloop helps job seekers send personalized, individual emails through their own Gmail account. Czar16 operates Mailloop. For privacy requests or support, contact czar16dev@proton.me.

Information we handle

Google sign-in supplies your Google account identifier, email address, and name. We store your account profile, preferred job roles, reminder preference, and an encrypted Google authorization refresh token. Session cookies keep you signed in. We do not receive your Google password.

We store the contacts you enter or import, templates, campaign history, recipient and message snapshots, delivery outcomes, Gmail message and thread identifiers, and manually recorded replies. Legacy manual evidence and address records are retained. Editing or archiving a contact or template does not erase historical message snapshots. Uploaded resume PDFs are kept in private storage and attached only when you choose to include them.

How Gmail access is used

We use Gmail sending permission to send each approved message individually from your account. Each email gets one sending attempt; failed preparation and rejected sends are not automatically sent again. Mailloop requests Gmail sending permission only and never reads your inbox, threads, or Sent folder. Premium users use Mark replied manually; this stops reminders for that contact. Mailloop does not detect replies. Gmail acceptance status reports that Gmail accepted an email, not guaranteed recipient delivery. Uncertain sends stay Needs review and are never automatically resent. Premium follow-up reminders use your choice of 3, 7, or 14 elapsed days since sending unless a reply is marked. You decide whom to follow up with and approve each message. Reminders never send automatically.

Mailloop’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and Google Workspace API user data policy, including their Limited Use requirements. Google user data is not sold, used for advertising, or used to train generalized AI or machine learning models. Human access is limited to circumstances allowed by those policies, such as your specific consent for support, security investigations, or legal requirements.

Sharing and disclosure of Google user data

Hosting and PostgreSQL database providers process application data to operate the service. Private Vercel Blob storage processes uploaded PDFs in production; local development uses local files. Inngest processes account and send identifiers and background job outcomes for delivery and maintenance. Google processes emails, recipients, and attachments when sent through Gmail. Recipients receive the message and any attached PDF. These providers process data under their applicable terms. We may disclose data when required by law or to address abuse and protect the service.

Dodo Payments is our payment processor and Merchant of Record. Optional subscriptions use its hosted checkout and customer portal. We send your account name, email, and internal billing identifiers to associate the transaction with your account. We retain customer and subscription identifiers, checkout identifiers and outcomes, billing country and currency, recurring amounts, verified billing dates, cancellation state, and minimal verified payment-event records for access checks, cancellation recovery, and reconciliation. Card details stay with the payment provider; Mailloop does not store them. Real charges are not enabled.

To enforce request limits and diagnose failures, we retain recent request timestamps, internal account and job identifiers, fixed error categories, provider status codes, counters, and operational timestamps. Operational logs exclude authorization tokens, recipient addresses, subjects, message bodies, and raw provider responses. Request-limit records expire and are cleaned up daily. Minimal recovery records may remain after account deletion until pending cleanup is resolved.

• Vercel (application hosting): Our server code runs on Vercel and processes your Google account profile, authorization credentials, contacts, email content, and delivery results to authenticate you and send the emails you approve.
• Neon (PostgreSQL database): Stores your Google account identifier, name, email address, encrypted Google refresh token, and Gmail message and thread identifiers, together with your contacts, templates, and campaign history, so your account and sending history remain available.
• Vercel Blob (private file storage): Stores the resume PDFs you upload and their storage metadata. A PDF is sent through Gmail only when you choose to attach it.
• Inngest (background job coordination): Processes internal account and send identifiers, job timing, and background job outcomes to coordinate sending and account maintenance. OAuth tokens, email bodies, and attachments are not included in Inngest event payloads or step results.
• Google (Google sign-in and Gmail API): Processes authorization credentials to authenticate you and authorize sending. When you approve an email, we transfer the sender and recipient addresses, subject, message body, and any selected attachment to Gmail to send it from your account.
• The recipients you select: Receive your sender name and email address, message subject and body, and any attachment you choose to include. Each email is sent individually.

Our infrastructure providers process data to operate Mailloop under their applicable service terms. We do not sell or rent Google user data, share it with advertising networks or data brokers, or transfer it for generalized AI or machine learning model training. Disclosure to authorities or other parties is limited to what is necessary to comply with applicable law or investigate security issues or abuse, consistent with Google’s Limited Use requirements.

How we protect sensitive data

We use the following safeguards to protect Google user data, authorization credentials, email content, and uploaded resumes against unauthorized access or disclosure:

• Encryption in transit: The production website uses HTTPS, and communication with Google’s authorization and Gmail APIs uses HTTPS to protect data during transmission.
• Encrypted stored credentials: Google refresh tokens are encrypted with AES-256-GCM before being stored in the database. The encryption key is held in server-side environment configuration, separately from the database records.
• Server-side credential handling: Gmail API calls and token decryption run on the server. OAuth tokens and service secrets are not included in client-side application data or account exports. We never receive or store your Google password.
• Account access controls: Access to account data requires authentication and is scoped to the signed-in user’s account. Background service callbacks use service authentication.
• Private resume storage: Uploaded PDFs are stored in private Vercel Blob storage. Resume downloads require an authenticated owner, and the server checks account ownership before loading a file for sending.
• Limited operational records: Application logs and background job event payloads and step results exclude OAuth tokens, email bodies, and raw email messages.

These safeguards reduce the risk of unauthorized access; no system can guarantee absolute security. Retention, account deletion, and Google access revocation are described below.

Your controls and retention

Settings lets you download a JSON export of your profile, preferences, contacts, templates, message history, manual evidence, legacy address records and reasons, minimal delivery receipts, and attachment metadata. It excludes credentials and private storage locations. Your current resume can be downloaded separately. You can revoke Mailloop’s Google access through Google account connections; revocation does not delete your Mailloop data.

Delete history in Settings permanently removes completed message content and its follow-up reminders. Legacy address records and reasons survive contact and history deletion until account deletion; they do not block sending. Queued and unresolved deliveries remain, and Gmail emails are unchanged. We retain minimal delivery receipts containing your account ID, recipient address, original creation time, and successful-send time until account deletion. These preserve sending limits and warnings for previously emailed addresses. Empty campaign records retain submission keys to prevent duplicate sends. While a campaign has queued or unresolved deliveries, hidden completed rows retain recipient roles and original recipient counts to enforce plan eligibility; their message content is removed. A later history cleanup removes these rows once the campaign is terminal.

Account deletion disables access immediately and cancels emails that have not begun delivery. Already sending or uncertain deliveries cannot be recalled. The deletion request cannot be undone. You cannot sign in or create another Mailloop account with the same Google account while deletion is pending. Billing cancellation is attempted immediately. After a minimum 15-minute waiting period, the next daily cleanup run attempts Google authorization revocation and begins irreversible deletion of ordinary profile and content data and owned PDFs. The maximum target is 30 elapsed days from the original request, including requests already pending. Billing and storage outages do not hold up database content cleanup. An independent recovery record retains only original owner and provider identifiers, checkout/cancellation state, stage timestamps, and a keyed Google identity hash while cleanup remains unresolved. Any temporary encrypted revocation credential is scheduled for erasure one day before day 30, even if Google is unavailable. A missed or delayed daily run can delay erasure. Failed external cleanup remains retryable in daily runs; provider outages may delay completion. Minimal billing or legal evidence may remain where narrowly necessary for reconciliation or legal obligations. Outages may delay cleanup attempts; failures are retried in daily runs. Deleting Mailloop does not remove emails from Gmail or recipients’ inboxes. Provider-managed logs and backups follow the relevant provider’s retention practices; this policy does not promise a particular backup deletion deadline.

We retain account data while your account exists. Older PDFs can be removed once replaced or removed from Settings and no pending or uncertain delivery needs them. Historical attachment metadata may remain until account deletion. Contact us for access, correction, or privacy questions.

Changes

We will update this page when our practices change. Material changes to Google data use require appropriate notice and consent before that new use.