Privacy policy

1. Introduction

makeo ("we", "us", "our") respects your privacy. This privacy policy describes how we collect, use, and protect your personal data when you use our AI-assisted email service (the "Service").

We are the data controller for the personal data we process. You can contact us at we@makeo.io.

2. What information do we collect?

We collect the following categories of information:

• Account information: Email address, name, and password (encrypted)
• Connection data: Information about your linked mail accounts needed to fetch and process your email
• Preferences: Settings for AI personality, organization, and other user preferences
• Usage data: Technical logs needed to operate the Service and maintain security
• Meeting data: If you use meeting recording features, audio recordings, transcriptions, participant names, and meeting metadata. You are responsible for obtaining participant consent
• Financial metadata: If email organization detects invoices or orders, extracted amounts and vendor names (never full payment details)

Important: We do not store your emails on our servers. Email is fetched directly from your provider when you use the Service and processed in real time.

2a. Use of third-party APIs (Gmail, Outlook, iCloud)

When you connect an email account (Gmail, Outlook, iCloud, etc.) via OAuth, makeo can read, organize, and help you reply to your mail. We only use data necessary to provide the Service:

• What we access: Messages (subject, sender, recipient, body, date), folders/labels, and metadata—to display, organize, and generate replies in your voice
• Purpose: Solely to provide AI-assisted inbox organization, classification, and draft suggestions. We do not use your data for ads, sale to third parties, or training of AI models
• Storage: Processing takes place on servers in the EU. We do not permanently cache email bodies—they are retrieved in real time from your provider (e.g. Google)
• Your rights: You can disconnect Gmail or other accounts in settings at any time, which revokes our access immediately

Our use of Google user data complies with Google's API Services User Data Policy and Limited Use requirements. Similar principles apply to Outlook and other providers.

3. Legal basis and purposes

We process your data on the following legal bases:

• Contract: To provide the Service you have subscribed to
• Consent: On first login we ask for your explicit consent to processing. You may withdraw consent at any time
• Legitimate interests: To improve the Service, maintain security, and meet legal obligations

4. Storage and security

makeo is built with a privacy-by-design architecture aligned with strict EU processing requirements for individuals and businesses. Integrations with Gmail, Microsoft 365, iCloud, and other providers run on isolated enterprise infrastructure.

4.1 OAuth 2.0 & token-based access

We never see your mailbox passwords. Connections are created through official APIs (OAuth 2.0); makeo receives only an encrypted access token. You remain in full control and can revoke access at any time from your mail provider.

4.2 Isolated account segmentation

Each mailbox is processed in a closed, sandboxed environment. This enforces strict access boundaries and reduces the risk of cross-account or cross-user data exposure.

4.3 Encryption at rest and in transit

• At rest — Tokens and metadata are protected with AES-256-GCM encryption
• In transit — Communication between your browser, makeo, and mail servers uses TLS 1.3

Incoming webhooks are verified with cryptographic signatures. Invalid or tampered requests are rejected.

4.4 EU hosting (GDPR)

Processing and storage take place on servers located in the EU. We comply with the General Data Protection Regulation (GDPR), and your data is not moved outside European jurisdiction without your explicit consent.

4.5 Zero-persistence policy

Mail content is not stored permanently on our servers. It is retrieved only in real time via secure APIs for analysis and drafting, then cleared from active memory. Local cache on your device expires automatically.

4.6 HIPAA & HITECH readiness

makeo can enter into a Business Associate Agreement (BAA) so that sensitive personal data (PHI) is handled to high international security standards.

5. Your rights

Under the GDPR you have the following rights:

• Right of access: You may ask what information we hold about you
• Right to rectification: You may correct inaccurate data
• Right to erasure: You may delete all your data via "Delete all my data" in settings
• Right to data portability: You may request a copy of your data
• Right to object: You may object to certain processing
• Right to restriction of processing: You may request that we limit how your data is processed

To exercise your rights, contact us at we@makeo.io. You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe we process your data unlawfully.

6. Deletion of data

You can remove connected mail accounts at any time in one click—everything tied to that connection is removed. You can also permanently delete your full user account in settings. After deletion, your data is removed from our systems without a recovery option.

7. Retention periods

We keep your data while your account is active. On cancellation or account deletion, data is removed within one week unless applicable law requires longer retention.

8. Sharing of data

We do not sell your data.

We share data only with carefully selected processors necessary to provide the Service. These include providers of cloud infrastructure and hosting, payment processing, email connectivity services, and AI processing capabilities.

All processors are bound by data processing agreements (DPAs) that require them to process data only on our instructions and in accordance with GDPR.

Where processors are located outside the EU/EEA, transfers are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards approved by the European Commission.

We may also disclose data if required by law, regulation, or court order.

9. Cookies and tracking

Inside the Service we use only essential cookies required for it to function, including session management and authentication.

On our public website (makeo.io marketing pages) we ask for your consent before any analytics runs. If you accept, we use Google Analytics (IP anonymised) to measure page views and navigation, Microsoft Clarity for anonymous session insights, and the Meta Pixel to see whether a visit came from one of our ads. If you choose "Essential only", none of these are loaded and no data is sent to Google, Microsoft or Meta. We do not use the data for advertising profiles or share it with advertising networks beyond that campaign measurement.

10. Automated decision-making

The Service uses AI to categorize emails, suggest replies, and organize your inbox. These are assistive features; no binding decisions are made solely by automated means. You retain full control over all actions taken on your email.

You have the right to request human review of any automated processing.

11. Children's privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete that data promptly. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at we@makeo.io.

12. Your rights under California law (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you additional rights regarding your personal information:

• Right to know: You may request details about the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to correct: You may request that we correct inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell your personal information, nor do we share it for cross-context behavioral advertising. Therefore, there is no need to opt out, but you retain this right under the CCPA/CPRA.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, contact us at we@makeo.io. We will verify your identity before processing your request and respond within the timeframes required by law.

In the preceding 12 months, we have collected the categories of personal information described in Section 2 of this policy. We do not sell personal information and have not done so in the preceding 12 months.

13. International data transfers

Your data is processed and stored on servers in the EU. In limited cases, data may be processed by sub-processors outside the EU/EEA. Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

You may request information about these safeguards by contacting us at we@makeo.io.

14. Changes

We may update this privacy policy. Material changes will be communicated by email or on your next login. Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact

Questions about this privacy policy? Contact us at we@makeo.io.

You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.