Mailwright

Subprocessors

Effective 2026-10-11Draft for legal review — not an approved contract

Draft for legal review — not an approved contract. Effective 2026-10-11. The operator’s legal name, address, and governing law are blank because they are not in the product.

All documents

1. Status of this list

This is a draft list of providers confirmed in the product code. It is not a finished subprocessor register, and it does not name the operator. Optional environment variables that are empty by default, such as a verification API or a web-push key, are not listed as active providers.

Not stated in the product, and not filled in by this draft: the operator’s legal name, registered address, governing law, and court. A lawyer has to supply them. Do not treat this page as a signed contract.

“When” means when that feature is actually used. Infrastructure rows apply to this deployment’s containers. The hosting company’s legal name is not in the repository.

2. Providers

Providers confirmed in the code

Provider	What it is used for	When	Data the feature sends
Google (identity)	Sign-in and registration	When you use the Google button	openid, email, and profile. No Gmail read scope and no gmail.send on this button.
Google (Gmail API)	Sending mail you launch	When you connect Gmail for sending	gmail.send, plus openid and email. Tokens encrypted at rest. Message content of mail you send.
Google (Calendar, Postmaster)	Meetings and domain reputation stats	Only if you connect that integration	calendar.events and calendar.freebusy, or postmaster.readonly and siteverification.
Google Fonts	Fraunces and Outfit on the site	Page loads	Browser requests to fonts.googleapis.com and fonts.gstatic.com (IP address and user agent go to Google with the request).
Microsoft (identity)	Sign-in and registration	When you use the Microsoft button	openid, email, profile, offline_access. No mailbox read scope on this button.
Microsoft (setup button)	Account-setup control labeled Connect Microsoft	If you use that control	The request adds Graph Mail.Send and Mail.Read. The sign-in callback does not store those mail tokens as a mailbox.
Microsoft (integrations)	Calendar, or the Outlook mailbox connection	Only if you connect that integration	Calendars.ReadWrite, or SMTP.Send and IMAP.AccessAsUser.All. Tokens encrypted if the connection finishes.
DeepSeek	Default language-model endpoint	When a model key is configured	Campaign brief, template, recipient fields, and, for reply drafts, inbound message text. Default host api.deepseek.com, model deepseek-chat. The operator can change the base URL.
Stripe	Checkout for a plan	When Stripe keys are configured and you start checkout	Account email and plan. Card numbers are not stored in Mailwright. Customer portal is not finished.
PostgreSQL and Redis	Database and job queue for this deployment	While the service runs	Application data in Postgres. Queue data in Redis. Containers on the operator’s host, not a named database vendor.
Caddy	HTTPS reverse proxy in the deployment notes	While the public site is served	Request metadata required to proxy https://mailwright.tech to the application.
Mailbox host you choose	SMTP send and IMAP read	When you save that mailbox	The host receives the login and the messages. If it is not Google or Microsoft, it is your choice, not a provider Mailwright selected for every customer.

Provider. Google (identity)
What it is used for. Sign-in and registration
When. When you use the Google button
Data the feature sends. openid, email, and profile. No Gmail read scope and no gmail.send on this button.
Provider. Google (Gmail API)
What it is used for. Sending mail you launch
When. When you connect Gmail for sending
Data the feature sends. gmail.send, plus openid and email. Tokens encrypted at rest. Message content of mail you send.
Provider. Google (Calendar, Postmaster)
What it is used for. Meetings and domain reputation stats
When. Only if you connect that integration
Data the feature sends. calendar.events and calendar.freebusy, or postmaster.readonly and siteverification.
Provider. Google Fonts
What it is used for. Fraunces and Outfit on the site
When. Page loads
Data the feature sends. Browser requests to fonts.googleapis.com and fonts.gstatic.com (IP address and user agent go to Google with the request).
Provider. Microsoft (identity)
What it is used for. Sign-in and registration
When. When you use the Microsoft button
Data the feature sends. openid, email, profile, offline_access. No mailbox read scope on this button.
Provider. Microsoft (setup button)
What it is used for. Account-setup control labeled Connect Microsoft
When. If you use that control
Data the feature sends. The request adds Graph Mail.Send and Mail.Read. The sign-in callback does not store those mail tokens as a mailbox.
Provider. Microsoft (integrations)
What it is used for. Calendar, or the Outlook mailbox connection
When. Only if you connect that integration
Data the feature sends. Calendars.ReadWrite, or SMTP.Send and IMAP.AccessAsUser.All. Tokens encrypted if the connection finishes.
Provider. DeepSeek
What it is used for. Default language-model endpoint
When. When a model key is configured
Data the feature sends. Campaign brief, template, recipient fields, and, for reply drafts, inbound message text. Default host api.deepseek.com, model deepseek-chat. The operator can change the base URL.
Provider. Stripe
What it is used for. Checkout for a plan
When. When Stripe keys are configured and you start checkout
Data the feature sends. Account email and plan. Card numbers are not stored in Mailwright. Customer portal is not finished.
Provider. PostgreSQL and Redis
What it is used for. Database and job queue for this deployment
When. While the service runs
Data the feature sends. Application data in Postgres. Queue data in Redis. Containers on the operator’s host, not a named database vendor.
Provider. Caddy
What it is used for. HTTPS reverse proxy in the deployment notes
When. While the public site is served
Data the feature sends. Request metadata required to proxy https://mailwright.tech to the application.
Provider. Mailbox host you choose
What it is used for. SMTP send and IMAP read
When. When you save that mailbox
Data the feature sends. The host receives the login and the messages. If it is not Google or Microsoft, it is your choice, not a provider Mailwright selected for every customer.

3. What this list leaves out

YouTube and Vimeo are allowed as embed hosts if an administrator pastes a video URL. They are not loaded by the legal pages. Web push (VAPID), an external verification API, and a SOCKS proxy for SMTP probes are optional settings. They are not listed as current subprocessors because the code treats them as unset until an operator fills them in.

This draft does not claim the model provider, Stripe, Google, or Microsoft are forbidden from using data under their own terms. Read those terms for the feature you turn on. The privacy draft explains what Mailwright sends them.

4. Contact

Questions about this list: support@nxtfluencez.com. The privacy draft and the Data Processing Addendum link here.