Privacy Policy
What Nexmail collects, why, who sees it, and how to have it deleted.
Last updated: 23 October 2026
1. Who we are
Nexmail is operated by Nexprove Limited (“we”, “us”). This policy explains what information Nexmail collects, why, who it is shared with, and the choices you have. It covers the Nexmail website and the Nexmail app, including the API and the MCP connector.
Nexmail is a tool that organizations use to run email on their own domain. For the email, contacts, calendars and other content an organization puts into Nexmail, that organization decides what is stored and why, and we process it on their behalf. For your account details, billing and use of the website, we decide, and we are responsible for it.
2. What we collect
Your account
Your name, email address, a hash of your password (never the password itself), the organizations you belong to and your role in each, and security records such as sign-in sessions and an audit log of sensitive actions.
Email and attachments
Messages your organization receives and sends through Nexmail, including their headers, bodies and attachments, along with drafts, notes, labels, assignments and delivery status (delivered, bounced, complained) reported by your sending provider.
Contacts and campaigns
Contact lists your organization imports or builds, campaigns sent to them, unsubscribes and suppressions. Campaign emails can include open and click tracking: a small image that records when a message is opened, and links that pass through Nexmail so a click can be recorded before the reader is sent on to the destination. We record which recipient opened or clicked, which link, and when. Ordinary one-to-one email is not tracked. Every campaign carries an unsubscribe link that works without signing in.
Connected services
If your organization connects an email provider (such as Resend, Brevo, Amazon SES, SMTP2GO, an SMTP or IMAP server, or a Gmail or Google Workspace account with an app password), a DNS host, or Slack, we store the credentials needed to use it and the data that flows through it.
Calendars and bookings
If you connect a calendar (Google Calendar, Microsoft Outlook, CalDAV, or an ICS link), we store the access tokens or link you provide and the events we sync: titles, times, locations, attendees, descriptions and meeting links. If you publish a booking page, we store the name, email address and any note a person leaves when they book a time with you.
Meeting notes
If you ask Nexmail to take notes for a meeting, a notetaker bot joins that call. We store the transcript it produces, including speaker names, and a summary.
AI features
If your organization turns on the sales pipeline and you use Draft with AI, the instruction you type and the relevant email thread or contact details are sent to the AI provider to write the draft you asked for; the draft is shown in your composer and is not stored unless you save or send it. On the Team plan, the text of incoming email that mentions a meeting, and what you type into calendar quick add, may be sent to the AI provider to find the date and time; meeting transcripts are sent to it to write the summary, which is stored in Nexmail.
API and MCP credentials
When you create an API key or connect an AI tool over MCP, we store a hash of the secret, its scopes, and when it was last used.
Billing
If you subscribe to a paid plan, Lemon Squeezy handles checkout and payment. We receive and store the subscription status, plan and customer reference. We never see or store your full card number.
Feedback and website use
If you send feedback, we store your message, any name and email you give, the page you were on, your browser’s user agent, and a one-way hash of your IP address used only for rate limiting. Like any web service, our hosting provider keeps standard request logs. We use cookies only to keep you signed in, remember preferences such as the theme, and understand how people find Nexmail (below). We do not use advertising cookies.
How you found us
When you visit our website we set one first-party cookie, nm_attrib, that records where your visit came from: the campaign tags in the link you followed (such as utm_source), an ad click identifier if the link carried one, the website that referred you (its domain only), the page you landed on, and when. It keeps your first visit and your most recent one, expires after 90 days, and is never shared with or readable by anyone else. If you sign up, we store those details and your optional answer to “How did you hear about us?” with your account. We use them only to understand how people find Nexmail, and keep them for as long as your account exists.
We also use Vercel Web Analytics and Speed Insights to count page views and measure page speed. They use no cookies and do not identify you or follow you across other websites.
3. How we use it
- To provide Nexmail: receive, store, route, display and send email, run campaigns, sync calendars, and the other features you use.
- To keep it secure and reliable: authenticate you, prevent abuse and spam, enforce sending limits, and fix faults.
- To bill paid plans and manage subscriptions.
- To contact you about your account, security, and changes to the service.
- To answer feedback and support requests.
- To meet legal obligations.
We do not sell personal information, we do not use your organization’s email or content for advertising, and we do not use it to train AI models.
Where data protection law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, your consent where we ask for it, and legal obligations.
4. Google user data
If you connect Google Calendar, Nexmail asks Google for permission to read and manage your calendars. We use that access only to show your calendar in Nexmail, keep it in sync in both directions, add events you create or accept in Nexmail, place bookings from your booking page, and send a notetaker to a meeting when you ask for one.
Nexmail’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Google Calendar data is used only to provide and improve the calendar features you use in Nexmail.
- It is not sold, and it is not used for advertising.
- It is not used to develop, improve or train generalized AI or machine learning models.
- It is not transferred to anyone else except as needed to provide a feature you asked for (for example, a meeting link sent to the notetaker you booked, or a meeting title included in a summary you requested), for security, or to comply with the law.
- People at Nexprove Limited do not read it unless you ask us to, it is needed for security or to comply with the law.
Your Google access tokens are encrypted at rest. You can disconnect Google Calendar in Nexmail at any time, which deletes the stored tokens and the events synced from Google, and you can also revoke access from your Google Account settings.
6. How long we keep it
We keep your organization’s data for as long as the organization has a Nexmail account, because keeping your email is the service. Messages moved to Trash stay there until they are deleted.
An organization owner can delete the organization from its settings. That permanently removes the organization’s email, attachments, contacts, campaigns, calendars, meeting notes and connected credentials. Disconnecting a calendar deletes its stored tokens and the events synced from it. Unsubscribe and suppression records are kept while the organization exists so that people who opted out are not mailed again. Backups and logs held by our providers roll off on their own schedules.
To delete your personal account or ask us to delete specific data, email admin@nexprove.com.
7. Security
Connection to Nexmail is encrypted in transit. Provider keys, OAuth tokens and other secrets are encrypted at rest with AES-256-GCM and are never shown back in full, not even to admins. Passwords and API keys are stored as one-way hashes. Every query is scoped to a single organization so one organization cannot read another’s data. No system is perfectly secure, and if we learn of a breach that affects your data we will tell you without undue delay.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict how we use it, and to withdraw consent. You can edit your profile and disconnect services in Nexmail at any time.
If you received email sent through Nexmail by one of our customers, that customer is responsible for it. Use the unsubscribe link in the message, or contact the sender. If you cannot reach them, email admin@nexprove.com and we will help.
To make a request, email admin@nexprove.com. We will answer within 30 days. You also have the right to complain to your local data protection authority, including the Nigeria Data Protection Commission.
9. International transfers
Nexprove Limited and our service providers operate in several countries, including the United States. Your information may be processed outside the country where you live. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses offered by our providers.
10. Children
Nexmail is a business tool for people aged 18 and over; you must confirm you are 18 or older to create an account or use it. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has given us personal information, email admin@nexprove.com and we will delete it.
11. Changes to this policy
We may update this policy as Nexmail changes. We will post the new version here with a new “last updated” date, and for significant changes we will tell account owners by email or in the app before they take effect.
12. Contact
Questions or requests about privacy: admin@nexprove.com, Nexprove Limited. See also our Terms of Service.