Mailwright
Privacy Policy
Effective 2026-10-11Draft for legal review — not an approved contract
Draft for legal review — not an approved contract. Effective 2026-10-11. The operator’s legal name, address, and governing law are blank because they are not in the product.
All documents
1. Status of this draft
This is a draft privacy notice for Mailwright at https://mailwright.tech. It describes behavior checked in the product. It has not been approved by a lawyer, and it is not a final privacy policy.
Not stated in the product, and not filled in by this draft: the operator’s legal name, registered address, governing law, and court. A lawyer has to supply them. Do not treat this page as a signed contract.
The default support address configured in the product is support@nxtfluencez.com. That address is a contact. It is not confirmation of a registered company or a postal address.
2. What the service does
Mailwright is a workspace for email campaigns. You create an account, connect a mailbox, import leads, optionally draft with a configured language model, approve copy, and send through the mailbox you connected. Replies can be read when you save an IMAP login for that mailbox. Follow-up steps after the first message stop when a lead is marked replied or converted. The product does not guarantee inbox placement.
3. Who decides the purpose
A working description, not a legal conclusion: you decide whom to upload and what to send, so you are likely the decision-maker for lead and campaign content. The operator decides how the account, session, and billing tools run. A lawyer has to confirm controller and processor roles, and whether a data-processing addendum is required. The draft addendum is the Data Processing Addendum.
4. Account data
Creating an account stores an email address, an optional name and company name, an 8-digit public username, a plan, a time zone, and the sign-in method (password, Google, or Microsoft). Passwords are stored as a PBKDF2-SHA256 hash. The product does not keep the password in a form it can show back to you.
Email registration sends a one-time code to the address you entered. The code is stored as a hash, expires (the default lifetime is 10 minutes), and is rejected after too many wrong attempts. Password reset uses the same kind of code. After eight failed password sign-ins, the account can lock for 15 minutes.
- A timestamp in terms_accepted_at when a new account is created. The column does not store which document version was shown.
- A hash of the signup IP address, not the raw address, and a device hash when one is provided.
- A session record: a hash of the session token, a masked IP address, a shortened user agent, a device label, and an expiry. The default session length is 180 days, and the token rotates.
- Cookie choices, when you set them while signed in.
- A deletion-request timestamp, if you submit one. Submitting it does not erase the account by itself.
5. Google and Microsoft sign-in
The sign-in and registration buttons request identity scopes only. For Google those are openid, email, and profile. For Microsoft they are openid, email, profile, and offline_access. Those buttons do not request gmail.send, and they do not request a scope that reads mailbox contents. The server reads the email, name, and subject from the identity token.
A separate control on account setup, labeled Connect Microsoft, starts the Microsoft sign-in URL with intent “connect”. That request adds Microsoft Graph Mail.Send and Mail.Read on top of the identity scopes. The sign-in callback uses the identity token to open the account. It does not save those Microsoft mail tokens as a mailbox connection.
6. Gmail sending and Google API data
Connecting Gmail for sending is a different step from signing in. That connection requests openid, email, and https://www.googleapis.com/auth/gmail.send. It does not request a Gmail scope that reads inbox mail. include_granted_scopes is false, so an older broader Gmail grant is not silently reattached. The send call uses the Gmail API users.me.messages.send endpoint. Refresh and access tokens are encrypted at rest and are not returned to the browser after they are saved.
Mailwright’s use of information received from Google APIs is limited to the feature you turn on: identifying the account; sending mail you launch; and, only if you connect them on the integrations screen, Google Calendar events and free/busy data, or Google Postmaster statistics for a domain you are verifying. The product does not sell that Google API data and does not use it to show advertising.
Mailwright’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This sentence is part of the draft. A lawyer still has to confirm it against Google’s current verification wording. Inbox reading is not done with a Gmail read scope. It is done with IMAP, described in the next section.
Other Google connections, started only if you connect them: Google Calendar (calendar.events and calendar.freebusy) and Google Postmaster (postmaster.readonly and siteverification). Tokens for those connections are encrypted the same way.
7. IMAP, SMTP, and inbox mail
Reply detection, stopping follow-ups after a reply, reply counts, and bounce notices found in the inbox use IMAP. You save a host, port, username, and app password on the mailbox. For Gmail that host is imap.gmail.com on port 993. The app password is stored encrypted. It is not a Gmail OAuth read scope, and it does mean the server can read messages in that inbox while the password is saved.
SMTP passwords for mailboxes you connect are encrypted the same way. Encryption uses Fernet. Stored secrets are prefixed with mw1 and the key is derived from the server secret. Secrets are not written into the frontend and are left out of the privacy export.
The integrations screen can also start a Microsoft mailbox connection that requests openid, email, offline_access, Outlook SMTP.Send, and IMAP.AccessAsUser.All, and a Microsoft Calendar connection that requests Calendars.ReadWrite. Those tokens are encrypted if the connection finishes. Campaign sending that this draft verified uses the Gmail send API or the SMTP mailbox you saved. Reply handling that this draft verified uses the IMAP app password on the mailbox.
8. Campaigns, leads, and follow-ups
A campaign stores the name, status, subject, body, sending mailbox, and follow-up steps. Leads store the email address you uploaded and the fields you provide, such as name, company, and custom columns. Verification results are stored with those leads. Email logs store send results, opens, clicks, and reply state.
Automatic follow-up steps (steps after the first) are not sent when the lead is marked replied or converted. A lead marked stopped is not sent further sequence mail. The replied mark depends on IMAP seeing a reply. If IMAP is not connected, a reply the product has not seen cannot stop a follow-up.
9. Pixels, clicks, and unsubscribe links
Campaign messages can include a 1×1 image hosted by Mailwright. A load of that image is stored as an open. Mail clients and scanners can load it, so an open is not proof a person read the message. Links in a message can be rewritten through a Mailwright redirect that records a click, then sends the recipient on. The redirect stores the user agent when one is sent.
Campaign sends can add a List-Unsubscribe header and a one-click unsubscribe page. Completing that page records an unsubscribe and suppresses further campaign mail to that address. Details are in the Acceptable Use Policy.
10. Drafting with a language model
When a model key is configured on the server, drafting calls an OpenAI-compatible chat endpoint. The default configuration is DeepSeek at https://api.deepseek.com/v1, model deepseek-chat. The operator can point that client at a different base URL. This draft names DeepSeek because it is the default in the application settings. It does not mean a particular production key was inspected.
A campaign draft can include the brief, the template, the recipient fields you stored (such as name, company, email, and custom fields), and writing preferences you saved. A reply draft can include the inbound subject and body and the deal context the product built from your workspace. If the model call fails, the draft falls back to your template with the lead fields filled in. The model key stays on the server.
This draft does not say that the model provider refrains from training on prompts. That promise is not in the product. It also does not say that inbox text read over IMAP is “Google API data.” IMAP is a separate login.
11. Billing
Paid checkout is implemented with Stripe and stays unavailable until Stripe keys and price IDs are configured. When checkout runs, Stripe receives the account email and the selected plan so it can open a Checkout session. Card numbers are not stored in Mailwright. The in-app customer portal is not finished: the product returns an error until a Stripe customer id exists after a subscription.
This draft does not set a refund rule. None is defined in the product. Wallet ledger rows, when you use that feature, are included in the privacy export as amounts and kinds, not as card data.
13. Export, correction, and deletion requests
A signed-in person can download a JSON export from Settings → Privacy. The export includes the account profile, owned workspaces, campaign summaries, contacts, mailbox addresses (not secrets), AI memory, writing preferences, chat messages you sent, bookings you hosted, and wallet rows. The file says credentials are left out.
The same screen can submit a deletion request. It requires the account password and the word DELETE. The product stores deletion_requested_at and writes an audit row. It does not erase the account in that request. The message the product returns says the team confirms within 30 days and that billing records may be retained where the law requires. That sentence is product copy. A lawyer has not confirmed it as a retention schedule, and this draft does not invent other deadlines.
If you signed in with Google or Microsoft and have not set a password you know, the form cannot be completed until a password is set (the reset code flow can email one, because those accounts still have a password hash). You can also write to support@nxtfluencez.com. The product does not offer a self-serve erase button that skips the request.
15. How long data stays
Specific retention periods are not configured as legal deadlines in the product. Sessions expire (default 180 days) unless revoked sooner. One-time codes expire (default 10 minutes). Disconnecting a mailbox removes that connection from the integrations list when you use disconnect. Campaigns can be deleted from the workspace. A deletion request is a request, not an automatic wipe. Billing rows may remain; the product message says that, and a lawyer must say what the law actually requires.
16. Security measures in the software
The measures this draft can point to are the ones in the code: hashed passwords, hashed session tokens, httpOnly session cookies, Secure cookies when the app is in production, SameSite=Lax, encrypted mailbox secrets and OAuth tokens, hashed one-time codes, login lockout, a new-device notice with confirm and deny links, and audit rows for actions such as export and deletion requests. This is not a SOC 2 or ISO certificate. The product does not claim those.
17. How to ask a question
Write to support@nxtfluencez.com. Signed-in users can also send a feedback ticket from the product. Please say whether you want a copy, a correction, or a deletion request, and the account email.