Privacy Policy

Effective Date: 4 May 2026 · Last updated: 23 October 2026

At Picmail Private Limited, based in Hyderabad, India (“Picmail,” “we,” “our,” or “us”), your privacy is a priority. This Privacy Policy explains how we collect, use, share, and protect personal information when you use our mobile application and related services (together, the “Services”).

This Policy applies to all users of Picmail. By using the Services, you acknowledge that you have read and understood this Policy.

1. Information We Collect

We collect information directly from you, automatically when you use the Services, and from the third-party integrations (Google, Microsoft and Apple) you choose to enable.

a. Information You Provide

Account Data: When you sign in via Google, Microsoft or Apple, we receive your name, email address and authentication tokens to manage your session. For Microsoft sign-in we also receive your Microsoft account identifier, which we use to key your Picmail account.
Communications with us: Any correspondence you send us, including support requests and feedback via hello@picmail.app.
Preferences: Settings such as your “Glimmer” image style preference, the artworks you mark as liked, and your device’s time zone (used to schedule your daily digest).

b. Information We Collect Automatically

Device Information: IP address, device type, operating system, and unique device identifiers collected via Firebase and standard system logs.
Usage Data: Logs of when you sync your emails, which features you interact with, and general activity within the application.
Troubleshooting Logs: Technical logs generated while your artwork is produced. These can include the email text we sent to the model and the model’s output, and are retained for a maximum of 30 days to ensure service reliability.
Push Notification Token: If you allow notifications, we store the device token issued by Firebase Cloud Messaging, with your device’s time zone, so we can deliver your daily digest. It is removed when you sign out or delete your account.
Subscription Data: If you open the paywall or purchase a subscription, the RevenueCat SDK in the app sends RevenueCat your Picmail account identifier and standard app and device information (platform, OS version, app version, locale, IP address). Google Play or the Apple App Store provides your purchase receipt or token, product identifier, subscription status and renewal dates. We store the resulting entitlement — plan, status, free or paid period, period start and end, store and product — under your account. We never receive your payment card details, and we do not enable RevenueCat’s advertising-identifier collection.

c. Connected Mailboxes and Third-Party Data

Connected Gmail Account: When you link your Gmail account, we access restricted scope data (gmail.readonly). This includes email metadata (sender, recipient, subject, timestamp) and email content (body and preview text). This data is accessed solely to provide the user-facing features described in Section 2 (artwork, priority label and summary). We never send, delete or modify your email.
Connected Outlook.com Account: When you link a personal Microsoft account (Outlook.com, Hotmail, Live), we request read-only mailbox access (Mail.Read) and basic profile access (User.Read) through Microsoft Graph. We read the same fields as for Gmail (sender, recipients, subject, received time, preview, body and conversation identifier) and process them in exactly the same way. Work and school (Microsoft 365) accounts are not supported. Your Microsoft access tokens are held on your device in the Microsoft Authentication Library’s protected token cache and are removed when you sign out.
Google API Limited Use Statement: Picmail’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Contacts: We do not currently sync or store your contacts unless you explicitly interact with features that require them.

2. How We Use Your Information

We use personal information only for legitimate purposes, including:

AI Artwork, Priority and Summary: For each email, we send the subject (up to 500 characters) and body (up to 10,000 characters) to Google’s Gemini models on Vertex AI (Google Cloud): a text model produces a priority label (urgent, moderate or low), a summary of one or two sentences and an image prompt, and an image model renders the artwork from that prompt. The artwork, its thumbnail, the summary, the priority label and the prompt are stored under your account so they appear on all your devices. If you mark an artwork as liked, that like and its time are stored with it.
Limited Use Disclosure: We read and transmit your email content only to deliver these user-facing features. We do not use it for advertising or marketing, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine learning models. Vertex AI processes it under Google Cloud’s data-processing terms and does not use it to train Google’s models.
Qualified No-Human Access: No human will read your emails, except as required by law, to investigate a security incident, or to fulfill a specific user-requested support task.
Provide and Operate the Services: Synchronizing your generated images across devices using Firebase Firestore.
Daily Digest Notifications: If you allow notifications, we send one push a day, at about 7 am in your device’s time zone, telling you how many new artworks are ready and whether an email was marked urgent. The notification never contains a sender, subject or email text. You can turn it off in your device’s notification settings.
Subscriptions and Usage Limits: We process your subscription status to unlock paid features, and we count the images generated for your account to apply the allowance of your plan.
Communicate with you: Sending service updates, support responses, and account-related notices.
Security and Compliance: Fraud prevention, detecting abuse, and complying with our legal obligations under GDPR and DPDPA, and the security requirements of CASA.

Legal Bases for Processing (GDPR Art. 13)

We process your personal data on the following bases:

(a) Contract Performance (Art. 6(1)(b)): To deliver the service you have signed up for: artwork, priority labels, summaries, digests and, if purchased, your subscription.
(b) Legitimate Interests (Art. 6(1)(f)): For fraud prevention, security monitoring, and maintaining service reliability.
(c) Legal Obligation (Art. 6(1)(c)): Where required by applicable law (e.g., court orders or tax obligations).

3. How We Share Information

We share personal information only in limited circumstances:

Service Providers and Subprocessors: We work with Google LLC (Firebase for infrastructure and storage, Vertex AI for the generative models, Cloud Logging for the troubleshooting logs in Section 1b) and with RevenueCat, Inc. to manage subscriptions (see its privacy policy). Microsoft Corporation provides sign-in and mailbox access for Outlook.com accounts and processes your Microsoft account data as an independent controller under the Microsoft Privacy Statement. Apple Inc. provides Apple Sign-In on the same basis under Apple’s Privacy Policy. Payments are processed by Google Play or the Apple App Store as independent controllers; we never receive your card details.
Legal Purposes: If required by law, subpoena, or government request (e.g., from the Data Protection Board of India or a court of law), or to protect the safety and rights of Picmail and our users.
Business Transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred to a successor entity.

We do not sell your personal information, and we do not share it with third parties for advertising purposes.

4. Data Retention and Deletion

We retain personal information only as long as necessary to provide the Services, comply with our legal obligations, and enforce agreements.

Retention Schedule

Account Identity and Authentication Data: Retained for the duration of your active account.
Transient Email Data: Raw email body text sent for processing is held in memory only and is not stored in our database after processing, subject to the 30-day troubleshooting logs in Section 1b, which may contain that text. Sender, recipient and subject are held in the processing queue only while an item is being processed and are removed when processing completes or is abandoned.
AI-Generated Images, Thumbnails, Summaries, Priority Labels, Prompts and Likes: Retained until account deletion.
Usage and Device Logs: Retained for up to 90 days.
Troubleshooting Logs: 30 days (see Section 1b).
Email Content Cached on Your Device: The app keeps an encrypted local copy of recent email headers and bodies (up to 50 KB per email) so the gallery works offline. It is excluded from cloud backups and is wiped when you use “Delete My Data” or uninstall the app. Signing out removes your access tokens and image caches; the cached emails stay on the device until you delete your account or uninstall.
Push Notification Token: Until you sign out or delete your account.
Time Zone: Stored with your notification token (removed when you sign out) and on your account profile (removed when you delete your account).
Subscription Records: For the life of your subscription, and afterwards for as long as tax and accounting laws require.
Account Deletion: If you use the in-app “Delete My Data” feature, the data on your device is wiped immediately, Picmail’s access tokens are removed and, for Google accounts, Picmail’s access is revoked. We delete your account identity (Firebase Auth), database records (Firestore), images and thumbnails (Cloud Storage) and notification token within 30 days of your request; residual backups are purged within a further 30 days. Deleting your account does not cancel an active subscription — cancel it in Google Play or the App Store first, or you may continue to be charged.

5. Your Privacy Choices and Rights

Depending on your location (e.g., EU/EEA or India), you have specific rights under the GDPR and the Digital Personal Data Protection Act, 2023 (DPDPA):

Access and Portability: Request a copy of your personal data by emailing hello@picmail.app; we provide it in a structured, machine-readable format (JSON) within 30 days. Where the app offers an “Export Data” option, you can use that instead.
Correction and Deletion: Request that we correct inaccurate data or delete your account.
Right to Restrict / Terminate: You can stop Picmail reading your mailbox at any time by signing out in the app, which removes Picmail’s access tokens from your device and stops all syncing. To withdraw the permission you granted, remove Picmail from your Google Account permissions or your Microsoft account app permissions (sign in to your Microsoft account first). Using “Delete My Data” also revokes Picmail’s Google access. Neither step deletes previously generated artwork, summaries or labels unless you also use “Delete My Data”.
Right to Object: Where we process your data based on legitimate interests (Art. 6(1)(f)), you have the right to object to that processing at any time. To do so, contact us at hello@picmail.app. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Lodge a Complaint: You have the right to contact a supervisory authority (such as an EU Data Protection Authority or the Data Protection Board of India).

To exercise these rights, contact us at hello@picmail.app.

6. Security Measures

We implement the strict security safeguards required by the Cloud Application Security Assessment (CASA). This includes encryption of data in transit and at rest, and secure handling of restricted Google API tokens and Microsoft access tokens. The database on your device is encrypted, and sensitive data is excluded from device backups. While we strive to protect your information, no system is completely secure, and we cannot guarantee absolute security.

7. International Users

Picmail is based in Hyderabad, India. We utilize Firebase and Google Cloud servers which may be located in the United States or other regions. Generative processing on Vertex AI may run in any Google Cloud region, including outside India and the EU/EEA. RevenueCat, Microsoft and Apple process data in their own regions under the agreements referenced in Section 3.

EU/EEA Users: Transfers are governed by Standard Contractual Clauses (SCCs) to ensure a high level of data protection.
Indian Users: We rely on the contractual protections provided by our processors pending finalization of cross-border transfer rules under the DPDPA.

8. Children’s Privacy

Our Services are not directed to minors. Age thresholds vary by jurisdiction:

Global: We do not knowingly collect data from children under 13.
EU/EEA Users: We do not knowingly collect data from children under 16 without parental consent.
Indian Users: We do not knowingly collect data from individuals under 18 in accordance with the DPDPA 2023.

If you believe we have inadvertently collected such data, please contact us immediately.

9. Cookies and Tracking Technologies

Picmail does not use third-party advertising or tracking cookies. Any local storage used is essential for core functionality, such as maintaining your login session and caching your emails, artwork and summaries in the app’s encrypted database for performance and offline use.

10. California Residents’ Privacy Rights (CCPA/CPRA)

While we are based in India, we respect the principles of the California Consumer Privacy Act (CCPA). We do not “sell” or “share” your personal information for cross-context behavioral advertising as defined by California law. You may exercise your rights to know, access, delete, and correct your data by emailing us at hello@picmail.app.

11. Changes to This Policy

We may revise this Policy from time to time. If we make material changes, particularly to how we handle restricted scope data from Google or mailbox data from Microsoft, we will provide prominent notice within the application prior to the changes taking effect.

12. Contact Us and Grievance Redressal

If you have questions, concerns, or requests regarding this Policy, please reach out to us:

Picmail Private Limited
Registered office: Plot No 32 & 33 Upperpally, Attapur, Rangareddy, Hyderabad, Telangana 500048, India
Office: WeWork Krishe Emerald, Kondapur Main Road, Laxmi Cyber City, Whitefields, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500081, India
Email: hello@picmail.app

Grievance Officer (DPDPA): For users in India, data protection complaints may be directed to our Grievance Officer at hello@picmail.app. We will acknowledge complaints within 72 hours and resolve them within 30 days.