Service providers
Infrastructure, authorization, mailbox and client roles.
MAILMAN MCP / SERVICE INFORMATIONMAILMAN MCP / MAIL
Privacy notice.
How the core MailMan service processes account information, mail requests and operational records.
01MAILMAN / MAIL
Operator and effective date
MailMan MCP is operated by 7x Systems LLC, a Wyoming LLC in the USA. Effective October 21, 2026. Andrew Naegele is the support and privacy contact: [email protected]. For billing questions, use [email protected].
02MAILMAN / MAIL
Information we process
We store your product email address, profile settings, password hash, mailbox addresses and provider identifiers, permission settings and authorization records. We process requested message metadata, message bodies, drafts, recipients and attachment bytes to carry out email tools. Operational records can include selected message IDs, queries, sender summaries, send-recipient addresses, outcomes and errors. The hosted core service does not keep a general full-mail replica or its own per-message search index.
03MAILMAN / MAIL
Why information is used
MailMan uses this information to authenticate you and your client, connect the mailbox you select, enforce permissions and safety limits, carry out requested tools, return results, keep activity records, investigate failures and answer support requests. General write-enabled tools can change or send mail without a separate MailMan approval dialog. Review the account, recipients and your AI client's confirmation settings before allowing changes.
04MAILMAN / MAIL
Where a request goes
Your chosen AI client sends an authenticated request to MailMan. MailMan checks access, calls the mailbox provider and returns the result to that client. Hosted Google and Microsoft connections can use Composio for authorization and proxied provider requests; this path processes connection identifiers and the applicable request and response data. IMAP/SMTP operations go to the mail servers you configure. An explicit unsubscribe request can contact the sender's HTTPS unsubscribe endpoint, which may contain a recipient-specific identifier.
05MAILMAN / MAIL
Hosting, support and your AI client
Hetzner hosts the application and database. Cloudflare provides domain DNS and, where enabled, web proxy and security services. Google Workspace handles support and billing correspondence. Google, Microsoft or your configured mail host processes its own mailbox data. The AI client you choose receives the mail returned to it and applies its own processing and retention terms. The hosted core service does not require a server-side AI model or run JEV classification. See the service-provider inventory for each role.
06MAILMAN / MAIL
Encryption and account security
Provider credentials are stored in encrypted envelopes. Passwords and local access tokens are stored as hashes. The ordinary database columns, including account and operational metadata, are not all encrypted by the application. HTTPS protects supported public connections in transit. These controls are not a security certification or a promise that every disk, backup, log or client copy is encrypted.
07MAILMAN / MAIL
Retention
Current service defaults are 90 days for activity and seven days for idempotency records, which can contain operation results. Browser sessions expire after 14 days and MCP sessions after 24 hours. Local OAuth access tokens expire after one hour, refresh tokens after 30 days, provider authorization state after 10 minutes and signed attachment links after five minutes. Personal access tokens have no expiry unless one is set. Expiry blocks use; physical removal depends on successful cleanup. Account and sender metadata, bulk-operation records and some system records have no universal automatic retention period. Backup and infrastructure-log retention are separate; immediate removal from those copies is not promised.
08MAILMAN / MAIL
Disconnecting, revoking and deleting
Disconnecting a mailbox removes its stored local credential and stops future authorized calls; it retains account and operational metadata and does not remove the provider-side grant or recall an operation already sent. Revoke grants or app passwords separately with your mail provider, and revoke client tokens separately in MailMan. Product-account deletion requires your typed email confirmation and removes the associated live application records through database cascades. Active or unconfirmed Stripe obligations, if any, must be resolved before deletion so billing references are not lost. Deletion does not erase your provider mailbox, an AI client's copies, support correspondence, external billing records or retained backups and logs immediately.
09MAILMAN / MAIL
Website measurement and optional services
The public website code has no advertising or general analytics SDK. An optional collector counts only approved event names and page paths in process memory, without visitor identifiers or mailbox data. Infrastructure still handles request metadata such as IP addresses and URLs. The core offer has no paid plan, and experimental beta features are disabled. If optional beta enrollment is opened, its separate consent stores the accepted version and enrollment/withdrawal times. Payment tests or future billing are separate from mailbox access; card entry belongs to hosted Stripe pages, not a MailMan card form.
Cookies
Authentication cookies and service boundaries.
10MAILMAN / MAIL
Your choices and questions
You can change account settings, limit Read and Write, disconnect a mailbox, revoke client tokens or request product-account deletion. Contact us about access, corrections, deletion or other privacy questions. Privacy rights may depend on where you live. We do not state a universal response period or an immediate backup-erasure promise. This notice describes the current core service; changes to its processing will be reflected here.
11MAILMAN / MAIL
Contact and requests
Andrew Naegele is the support and privacy contact: [email protected]. For billing questions, use [email protected]. For a privacy request, identify the product account and the information you want to access, correct or remove. We may need to verify control of the account. Send a sanitized error code or task ID for troubleshooting; never send passwords, tokens, card details or private message contents.
Support and privacy
Contact Andrew Naegele. Include a sanitized error code or task ID, never passwords, tokens or private mail.
Billing questions
Ask about billing records or a payment outcome. Never email card details. No paid plan is currently offered.
YOUR AI POSTAL SYSTEMYOUR INBOXES.
Get started
YOUR INBOXES.
UNDER CONTROL.
Get started Start with a free account and one read-only search. Existing accounts keep their connection.