Privacy | ACK

Draft, under legal review. It describes how ACK handles data today. Questions: support@ack.now.

ACK gives software agents and teams email inboxes, reached over a REST API, an MCP server and a web app. This page says what data we hold, why, where it lives and how long we keep it.

Two kinds of data

Your account data. Your name, email address, sign-in method, organisations, API key metadata, billing details and how you use ACK. We are the controller of this data.
Mail in your inboxes. Messages you send and receive, attachments, threads, labels, drafts, contacts and calendar items. You are the controller of this data. We process it only to run the service for you.

What we collect

Sign-up details: email address, and your Google profile name and email if you sign in with Google.
Payment: a card is required for the trial. Stripe collects and stores card details; we see only the card brand, last four digits and billing status.
Mail: every message that reaches or leaves an ACK inbox, including headers, and the delivery, bounce and complaint events our mail provider reports for it.
Open tracking: if a sender turns it on, outbound messages carry a small image. When a recipient's mail client loads it, we record that the message was opened and when.
Security and audit logs: IP addresses, API key used and the actions taken in your organisation.

How we use it

To deliver, store, thread and search mail, and to run the API, MCP server and web app.
To bill you and run the trial.
To protect deliverability: we check bounce and complaint rates and pause accounts that send abuse.
To answer support requests and send you service notices.

We don't sell data, we don't use mail content for advertising, and we don't train AI models on your mail.

Where it lives

Mail, attachments and the database are stored in the EU, in Amazon Web Services' Stockholm region (eu-north-1). Everything is encrypted at rest with keys we control and in transit with TLS. Mail between ACK and other mail servers requires TLS.

Who else processes it

Amazon Web Services: hosting, storage and email delivery (Amazon SES).
Stripe: payments and invoices.
Google: only if you choose to sign in with Google.
bunny.net: serves this public website. It doesn't handle mail or account data.

How long we keep it

Mail stays until you delete it or until a retention policy you set removes it. Deleting through the API is immediate.
Legal hold, when you turn it on, stops deletion until you turn it off.
Records exports you request are deleted after 7 days.
Database backups roll over after 7 days, so deleted data leaves backups within that window.
When you close an organisation, its mail and data are deleted. We keep billing records as long as tax law requires.

Your rights

You can export everything in an organisation at any time from the web app or the API. You can ask us to access, correct or delete your account data, or object to how we use it, by writing to support@ack.now. If you are in the EU or UK you can also complain to your data protection authority.

If you run ACK inboxes on behalf of others, they should contact you first. We'll help you answer their requests. A data processing agreement is available on request.

Cookies

The web app sets a session cookie to keep you signed in and protect forms, and a short-lived cookie during single sign-on. This website sets no cookies and uses no analytics; it loads fonts from Google Fonts.

Changes

We'll post changes here and email account owners before material changes take effect.