KiQ Limited, Ireland

KiQ Mail Privacy Policy

Version 2026-10-19. Effective from 19 October 2026.

This policy explains what personal data KiQ Mail uses, why, who helps us, where it is kept, how long we keep it and what your rights are. It covers the KiQ Mail web app at app.kiqmail.app (also inside KiQ Hub), the KiQ Mail apps for iPhone, iPad, Mac and Android, and the website kiqmail.app.

1. Who is responsible

KiQ Limited ("KiQ", "we", "us"), a company registered in Ireland under number [CRO number], with its registered office at [registered address], is the controller of your personal data in KiQ Mail. For personal data of other people that you process with KiQ Mail for a business, we act as your processor, as section 10 explains.

You can reach us about privacy at privacy@kiqmail.app.

2. What we never do

• We do not sell your personal data or your email.
• We do not show ads, and we do not use your data for advertising or build advertising profiles.
• We do not use your email or your content to train AI models, and our AI partners may not use it to train theirs.
• The apps contain no advertising, analytics or crash reporting tools from other companies, and no tracking.
• We do not read your email as a matter of course. Section 13 explains the rare cases when people at KiQ may look at content.

3. What we use, and why

Your account and sign-in (KiQ ID)

• You sign in with KiQ ID (kiqid.app), the sign-in service for all KiQ apps, which is also run by KiQ Limited. How KiQ ID handles your password and sign-in is explained in the KiQ ID privacy notice at [KiQ ID privacy notice URL].
• From KiQ ID, KiQ Mail receives your KiQ ID number, name, email address, profile picture and language, and whether your email address is confirmed. The sign-in tokens are stored encrypted.
• KiQ Mail tells KiQ ID which KiQ Mail plan you have, its name and until when it runs, so that your KiQ ID shows which KiQ apps you own.
• We also keep your settings, your plan and its status, your referral code if you have one, which version of the Terms you accepted, when and in which app, and when we sent you the welcome email.

Mailboxes you connect

• For each mailbox: the email address, the display name and mailbox name you choose, the server settings, the user name and the password or app password.
• Passwords and app passwords are encrypted on our server and used only by our server to fetch and send your email. They are never sent to the apps on your devices.
• For a @kiqmail.net mailbox, we create a password and keep it encrypted in the same way.

Your email

• To make your mail open fast on every device, to search it and to read it offline, our server keeps a working copy of your email: the headers (sender, recipients, subject, date), the text and the formatted (HTML) version, and a search index.
• Our server downloads ahead of time the inbox emails of about the last 60 days (at most the newest 1,500 per mailbox) and, if you use offline mail on a device, the emails of the last 120 days.
• Attachments are not stored on our server. They are fetched from your mail provider when you open them. Files you attach in Compose are kept encrypted only until the email is sent, and deleted a day later.
• To save space, the formatted version of emails older than 60 days that have not been opened for 30 days is dropped. Their text is kept. If you open such an email, it is fetched again from your mail provider.
• Emails you schedule with Send later are kept encrypted until they are sent or you cancel them.
• Your mail provider always keeps the original. Your mail provider is responsible for its own handling of your email.

Footers, contacts, calendar and notes

• Footers. The text, logo and photo of your email footers. Footer pictures and the footer's "Save contact" vCard are public at addresses that are hard to guess, so that the people you write to can see them.
• Contacts. The contacts you add, import or connect, with their photos (stored encrypted). Imports come from your iPhone's Contacts (with your permission), from iCloud or Google with an app password that is used for that one import and never kept, or from a file.
• Contact photos from your iPhone are shown on the phone only, unless you switch on "Show them on the web too". Then small copies (address, name and photo) are kept encrypted in your account, and switching it off removes them.
• Calendar and notes. Your KiQ Mail calendars, events and notes.
• Device calendars. On iPhone, iPad and Mac, if you allow it, KiQ Mail shows the calendars of your device next to yours. They are read on the device and are not sent to us. If you switch on "Copy into this device's Calendar", your KiQ Mail events are written into a KiQ Mail calendar on the device. Event alerts are local notifications on the device.

Sharing links

• Contact share links. When you share a contact by QR code or link, we create a link to that contact's details and photo (never your private notes or the verification code). Anyone who has the link can open it for 3 days. Then it stops working and our server erases it.
• My Card. If you make a My Card, its link shows the fields you chose to anyone who scans it, until you switch the link off or replace it.

Sender logos

To show company logos next to emails instead of initials, our server looks up the icon on the public website of the sender's domain (the part of the address after the @). The look-up is made by our server, never by your device, so the website does not learn who you are or which email you received. Addresses of free email services are skipped. Logos are kept for 30 days (7 days when a domain has no usable icon). You can also upload a logo for a sender yourself.

KiQ AI

• KiQ AI processes your email only when you use a KiQ AI tool, or when you switch on a feature that runs by itself, such as the KiQ AI Agent for a mailbox or automatic replies. You can switch KiQ AI off in Settings.
• For each request, we send what the tool needs: for example the email or conversation you want summarised or answered, the draft you want improved, or, for clean-up, only the sender, subject and the first words of each email. For meeting times, the KiQ AI Agent sends only free and busy times from your calendar, never the details of your events.
• What KiQ AI produces for you, such as summaries, prepared drafts, digests and priority marks, is kept in your account until you remove the mailbox or delete your account.
• The path of an AI request. Requests go from the KiQ Mail server to KiQ Hub (kiqhub.app), our own service that holds the AI key for all KiQ apps, and from there to Mammouth AI (Mammouth AI SAS, France). Mammouth passes each request to the company that runs the AI model we have chosen, such as Anthropic, OpenAI, Google or Mistral. Where we connect a model provider directly instead, the same rules apply. These companies receive only what is needed to answer each request. Under the business terms we use them on, they process it to give the answer and may not use it to train their models.
• KiQ Hub records how much AI it answered for KiQ Mail each day (number of requests and amount used), never what was asked.

The KiQ AI usage meter

To show how much of your monthly KiQ AI allowance you have used, and to apply your plan's limit, we record for each AI request the amount of AI processing used, the type of tool, the tier and the month. We also keep a monthly total of your use and of the number of requests. These records never contain the content of your email or of the AI answer. The meter is shown to you in Settings and to authorised KiQ staff in our admin panel.

KiQ AI+ agents (if you connect them)

If you connect the separate KiQ AI+ app to your KiQ Mail, its agents can read and act on your email, calendar, contacts and, if you allow it, attachments, within the permissions you approve. We keep the connection's access tokens only in hashed form, and a count of attachments read, without their content. You can disconnect in Settings at any time. How KiQ AI+ handles your data is explained in the KiQ AI+ privacy notice.

Notifications

• iPhone, iPad and Mac apps. If you allow notifications, the app gives our server a push token, and new-mail alerts and reminders go through Apple's push service (APNs). Alerts contain the sender and subject of the email, like any mail app.
• Computers. If you allow notifications in your browser, alerts go through the push service of your browser's maker (for example Apple, Google, Mozilla or Microsoft). They are encrypted so that only your browser can read them.
• Android. The Android app currently checks for new mail by itself and does not use a push service. If we add Google's Firebase Cloud Messaging, alerts will go through Google, and we will update this policy first.
• Your notification settings, such as quiet hours and which mailboxes may alert you, are kept in your account.

Devices and security

• For each device you use: a device key made by the app, the device name, platform, app version, time zone, language, push token and when it was last seen. You can see and remove your devices in Settings.
• If you sign in with Face ID or Touch ID, your face or fingerprint never leaves your device. Our server keeps only a scrambled (hashed) form of a key that the device keeps behind Face ID or Touch ID.
• Your session is kept in a secure cookie on the web and in the app's protected storage on your devices.
• We use your IP address for a short time to protect sign-in and other sensitive actions against abuse, for example to limit repeated attempts.

Payments (Stripe)

• Paid plans are bought on our website. Payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland). Stripe collects your card or other payment details. We never see or store your full card number.
• We receive and keep your Stripe customer and subscription numbers, the plan, monthly or yearly, the status, the amount, the renewal or end date, and whether payments succeeded. Invoices and receipts are made by Stripe.
• Stripe also uses some data as an independent controller, for example to prevent fraud and to meet its legal duties, as its own privacy policy explains.
• If you joined through a friend's referral link, we record who invited you, so that the right person gets the referral credit.

@kiqmail.net mailboxes (Migadu)

If your plan includes a @kiqmail.net mailbox, its email is stored by our email hosting provider Migadu (Switzerland) and reached by KiQ Mail like any other mailbox. Our system emails, such as the welcome email and notices about your plan, are sent from a @kiqmail.net address through the same provider.

Emails we send you

We send you a welcome email when you first accept the Terms, and service notices, for example when your plan or trial ends or when your @kiqmail.net mailbox will be paused or deleted. We do not send marketing emails without your consent.

Account activity and admin

• We keep a record of events in your account, such as a mailbox added, a plan changed or a setting changed by an administrator, with counts but without email content.
• Authorised KiQ staff can see, in our admin panel, your account email, plan and its dates, AI use, number of devices, Terms acceptance and the switches in your settings, and can change plans, limits and switches when needed. The admin panel never shows email content, mailbox addresses or passwords. Every admin change is recorded with a reason.

Server logs

Our servers keep technical logs to run the service, find errors and stop attacks: IP address, time, the address requested, the app version and error details. Our own application logs record numbers, not email addresses or email content.

Cookies and similar technologies

The web app uses cookies and browser storage that are strictly necessary: your session, protection against cross-site requests, your preferences and, if you use it, offline mail. The website keeps an invite code from a referral link and whether you have seen its intro in your browser's storage, and uses a cookie only for people we invite to preview it. We use no advertising or analytics cookies, so there is no cookie banner. If the web app loads program files from a public content delivery network (currently jsDelivr), that network receives your IP address when your browser fetches them.

On your devices

The apps keep some data on your device so they work quickly and offline: copies of recent email (up to 120 days if you use offline mail), contacts, calendar and settings. This data stays in the app's private storage and is removed when you sign out or delete the app. App lock with Face ID or Touch ID works on the device only.

Support

If you write to us, we use what you send to help you, and keep it as long as needed to deal with your request.

4. Our legal bases

• Contract. Most processing is needed to provide KiQ Mail as you asked: your account, your mailboxes and email, footers, contacts, calendar, notes, notifications, KiQ AI tools you use, the AI meter, your plan and payments.
• Legitimate interests. Keeping KiQ Mail secure, preventing fraud and abuse, fixing errors, server logs, sender logo look-ups, enforcing our Terms and defending legal claims. We balance these interests against yours, and you can object (section 11).
• Consent. Device permissions you give in the app, such as Contacts, Calendars and notifications, the "Show them on the web too" switch, and marketing emails if you ever choose to receive them. You can withdraw consent at any time in Settings or in your device's settings. This does not affect what was done before.
• Legal obligation. Keeping accounting and tax records, and answering lawful requests from authorities.

5. Who helps us

We use service providers (processors) who work for us, only on our instructions and under contracts that protect your data:

• Hosting. Vultr, with our servers in Amsterdam, the Netherlands. KiQ Mail, KiQ Hub and KiQ ID all run there. Vultr's parent company is based in the United States.
• AI. Mammouth AI (Mammouth AI SAS, France), and the companies that run the AI models it passes requests to, such as Anthropic, OpenAI, Google and Mistral.
• Payments. Stripe (Stripe Payments Europe, Limited, Ireland).
• Email hosting for @kiqmail.net and system emails. Migadu (Switzerland).
• Notifications. Apple (Apple Push Notification service), and the push services of browser makers such as Apple, Google, Mozilla and Microsoft.
• Our own services. KiQ ID (sign-in) and KiQ Hub (the AI relay and the admin panel), run by KiQ Limited.

Your mail providers, the websites asked for sender logos, and services you connect yourself (such as the KiQ AI+ app) are not our processors. They receive data because you asked KiQ Mail to connect to them or because the look-up needs it.

We may also share data with professional advisers, with a company that takes over KiQ Mail (we will tell you first), or with authorities where the law requires it.

6. Transfers outside the European Economic Area

We keep your data in the EU, on our servers in the Netherlands. Some providers, or the companies they use, are based outside the European Economic Area, for example in the United States (some AI model providers, Vultr's parent company, Apple and Google). Switzerland has an adequacy decision of the European Commission. For other transfers we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses, with extra safeguards where needed. You can ask us for a copy of the safeguards.

7. How long we keep data

• Your account, settings, Terms acceptance and activity record: for as long as you have your account.
• Mailbox passwords and settings: until you remove the mailbox or delete your account.
• Cached email: while the mailbox is connected. When a recent email is deleted at your mail provider, our copy is removed at a later sync. Everything is removed when you remove the mailbox or delete your account.
• KiQ AI results and Agent items: until you remove the mailbox or delete your account.
• AI usage records: for as long as you have your account.
• Files attached in Compose: until a day after the email is sent, or a day after you added them if they are never sent.
• Send later: until the email is sent or cancelled, then 7 days.
• Undo information: 30 minutes.
• Sender logos: 30 days (7 days when no icon was found).
• Contact share links: 3 days.
• My Card link: until you switch it off or replace it.
• Push tokens and devices: until you remove the device, or the token stops working.
• Server logs: up to [server log retention in days] days.
• Payment records: as long as tax and accounting law requires, in Ireland generally six years.
• Technical backups: up to [backup retention in days] days. They are used only to restore the service after a failure.
• @kiqmail.net mailboxes: deleted at Migadu 90 days after the paid plan ends (paused after 30 days). The address stays reserved for up to a year, without any email.

When you delete your account in Settings, your KiQ Mail account and everything in it is removed from our live systems at once: mailboxes with their passwords, cached email, footers and their pictures, calendars, events, contacts and photos, notes, My Card, devices and push tokens, AI use, KiQ AI+ connections and the activity record. Your paid plan is cancelled first. Copies in technical backups disappear when those backups expire. Payment records we must keep by law stay for the legal period. Your KiQ ID is not deleted, because other KiQ apps may use it. KiQ ID is told that you no longer have KiQ Mail.

8. Security

• Connections to KiQ Mail are encrypted (HTTPS).
• Mailbox passwords, sign-in tokens, files waiting to be sent, scheduled emails, contact photos and your My Card logo are stored encrypted. The encryption keys are kept in an encrypted store on the server, separate from the data.
• Sign-in keys for Face ID and the connection tokens of KiQ AI+ are stored only in hashed form.
• Access to our servers is limited to authorised people, with keys only and a firewall.
• No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Commission as the law requires.

9. Automated processing

KiQ Mail sorts and highlights email automatically, for example the Priority view (based on people you write to and your contacts), junk and clean-up suggestions, and the KiQ AI Agent's priority marks. These help you organise your own mail. KiQ Mail does not make decisions about you that have legal or similarly significant effects.

10. If you use KiQ Mail for a business

When your email, contacts and calendar contain personal data of other people that you process for your business, you decide why and how it is used. For that data you are the controller and KiQ is your processor, under the data processing terms in Annex 2 of the Terms of Use. You are responsible for having a lawful basis and for informing the people concerned. If you use KiQ Mail only for your personal and household life, data protection law generally does not apply to your own use of other people's data.

11. Your rights

You have the right to:

• access your personal data and get a copy of it;
• correct data that is wrong;
• delete your data. You can delete your account in Settings on the web, iPhone, iPad, Mac and Android;
• restrict how we use your data in some cases;
• data portability: get the data you gave us in a common, machine-readable format;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, without affecting what was done before.

To use your rights, write to privacy@kiqmail.app. We may ask you to confirm your identity. We answer within one month. If a request is complex, we may extend this by up to two more months and tell you why.

You also have the right to complain to the Data Protection Commission in Ireland (www.dataprotection.ie), or to the data protection authority in the EU country where you live or work. We would appreciate the chance to help first.

12. Children

KiQ Mail is not for anyone under 16. If you believe a child under 16 has given us personal data, please tell us and we will delete it.

13. When people at KiQ may look at content

Your content is processed automatically. People at KiQ look at it only when you ask us to and allow it (for example to solve a problem you reported), when it is needed to investigate a security problem or a serious breach of our Terms, or when the law requires it. We look only at what is needed and keep a record of why.

14. Changes to this policy

We update this policy when what we do changes. The version date at the top shows the current version. If a change matters to you, we tell you by email or in the app before it applies.

15. Contact

KiQ Limited, [registered address], Ireland. Company number [CRO number].
Privacy questions: privacy@kiqmail.app. Other questions: hello@kiqmail.app.

© 2026 KiQ Limited, Ireland. All rights reserved.

Read this together with the KiQ Mail Terms of Use. Questions: hello@kiqmail.app.