Privacy Policy

BabelMails (hereafter “we”) is operated by Vyper Ltd. We understand that email content involves your commercial secrets and personal privacy, so this policy details how we collect, use, and protect your data. By using the service, you agree to the practices described here.

1. Information We Collect

To provide the service, we collect the following information:

• Account information: the email address, name, interface language preference, native language, and other basic profile details you provide when registering.
• Email account authorization credentials: when you connect an email account, the associated authorization token (OAuth Token) or login credentials. These credentials are encrypted with AES-256-GCM before storage and are used solely to send and receive email on your behalf.
• Usage records: quota counts and anonymized usage logs from your use of AI translation, smart drafting, and other features, used for billing and service improvement.
• Content you actively create: custom glossaries, email drafts, labels, and other data you actively create and store.

2. How We Use Your Information

• To provide core features such as email translation, AI-assisted drafting, and glossary management;
• To send and receive email on your behalf through your authorized mailbox accounts;
• To calculate and enforce each plan’s usage quota;
• To diagnose technical issues and improve service stability and the feature experience;
• With your consent, to send you service notifications (such as security alerts and policy changes).

We do not sell your data to any third party.

3. How We Handle Email Data

Email data is the most sensitive part of the service. To provide core features such as bilingual side-by-side display, full-text search, cross-device sync, and AI-assisted drafting, client-side caching alone is insufficient, so we store your email metadata (sender, recipients, subject, timestamps, attachment names, etc.) and email bodies on our servers. We apply the following principles to email data:

• Encrypted server-side storage: sensitive content such as email bodies, email snippets, translation cache (TranslationCache), and mailbox authorization credentials are encrypted at rest in the database with AES-256-GCM, and all transit is protected by TLS. Email metadata (sender, recipients, subject, timestamps, etc.) is stored in plaintext to support full-text search, but remains under strict account isolation and access control.
• Used only for service features: email data stored on our servers is used solely to deliver the Service’s features (display, translation, search, drafting, cross-device sync). It is never used for advertising, sold as user profiles, or commercially shared with any third party.
• Strict account isolation: every email record is bound to a unique account identifier and isolated at both the application and database layers; unauthorized users cannot access another user’s email.
• Encrypted translation cache: to avoid repeatedly calling the AI service, translation results are cached. All TranslationCache entries are encrypted with AES-256-GCM and strictly isolated per account.
• Unbind clears data: when you unbind a mailbox account, the associated emails (bodies and metadata) and translation cache are automatically cleared after 30 days.
• Account deletion: when you delete your account, all associated data (mailboxes, email bodies and metadata, drafts, glossaries, quota records) is cleared according to the retention periods described below.
• Third-party mailbox providers: actual delivery and inbox synchronization still depend on your authorized mailbox provider (e.g. Gmail, Outlook). We access them only within the scope you authorize; see Section 4 below.

4. AI and Translation Data

When you use features such as AI translation, smart drafting, or risk-word checks, the relevant email text is sent to our AI service provider (OpenAI) for processing. After processing, the AI results are encrypted and cached (as described above), while the original request text is not retained long-term by us or OpenAI for training purposes.

We have taken measures to ensure AI processing follows the minimization principle: only the text fragments necessary to complete the current task are sent, never the full metadata or unrelated content of an email.

5. Data Storage and Security

• Encrypted transit: all communication between client and server is encrypted via TLS.
• Encrypted sensitive fields: sensitive data such as mailbox authorization credentials, email bodies, email snippets, and translation cache is encrypted at rest in the database with AES-256-GCM. Email metadata (sender, recipients, subject, etc.) is stored in plaintext to support full-text search, but remains under strict account isolation and access control at all times.
• Strict isolation: each user’s data is strictly isolated at both the application and database layers; unauthorized users cannot access another user’s data.
• Access control: only necessary operations and engineering personnel may access production data under strict auditing, and every access is logged.
• Encrypted backups: the database is backed up on a schedule, encrypted, and used for disaster recovery. Backup media are subject to the same access control and encryption as production data and are purged only after reaching the same security level.
• Storage region: email data is stored in cloud regions we designate. Where cross-border data transfer is involved, we handle it in accordance with applicable laws (e.g. PIPL, GDPR).

6. Cookies and Analytics

We use two categories of cookies:

• Essential cookies: the session cookie required to keep you signed in (HttpOnly, transmitted over HTTPS only). It is active without consent and contains no sensitive data such as your password.
• Analytics cookies (optional): only after you explicitly accept via our consent banner do we load Google Analytics (traffic statistics) and Microsoft Clarity (session replays and heatmaps). For signed-in users who have consented, a Clarity session may be associated with your account identifier for product improvement and for troubleshooting when you contact support. You may withdraw consent at any time via “Cookie settings” in the footer.

We do not use advertising or cross-site tracking cookies. Payments are processed by Stripe, which sets cookies necessary for payment security and fraud prevention under its own domain (see Stripe’s privacy policy).

7. Your Rights

Under applicable data protection laws (such as the GDPR), you have the following rights:

• Right of access: to know what data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to data portability: to obtain a copy of your data in a structured format.
• Right to erasure: to request deletion of your account and associated data.
• Right to withdraw consent: to unbind a mailbox at any time and stop data collection.
• California consumers (CCPA): we do not sell your personal information. You may request disclosure and deletion of your personal information as permitted by law; exercise these rights the same way as above.

To exercise any of these rights, contact [email protected]. We will respond to your request within a reasonable timeframe.

8. Data Retention

During normal account use, email data (bodies and metadata), translation cache, drafts, and other data are retained on our servers to maintain service features and cross-device sync. After account deletion, all associated data is cleared within 30 days; after unbinding a mailbox, that account’s email bodies, metadata, and translation cache are likewise cleared after 30 days. Financial records required by law to be retained (such as transactions and invoices) are excepted. Even during the retention period, email data remains encrypted and account-isolated at all times.

9. Policy Changes

This policy may be updated from time to time. On material changes, we will notify you via in-app notice or email. The “Last updated” date at the top of this page will be adjusted accordingly; continued use of the service constitutes acceptance of the updated policy.

10. Contact Us

If you have any questions, suggestions, or complaints about this policy, contact Vyper Ltd at [email protected]. We will reply within a reasonable timeframe.