GDPR and data protection
GDPR and your email, in plain English.
Mailbox MCP runs from London, under UK GDPR, for customers in the UK and across the EU. Your mail is read when you ask and never stored. The company behind it is Cyber Essentials certified, and our data processing agreement is part of the terms, so there's nothing to sign.
- Hosted in London, UK
- Your mail Never stored
- Breach notice Within 72 hours
The short version
Your mail, calendar and contacts pass through our servers in London in memory and are never written down. What we do keep is small, encrypted and in the UK. If you're in the EU, the European Commission's adequacy decision lets your data come here as freely as it moves inside the EU, until 27 December 2031. And if a breach ever affects your data, we tell you within 72 hours of confirming it.
What we hold
What we hold, and the email data we never hold
Start with the part that matters most. Your email is never stored. When your AI asks to read a message, our server fetches it from your mail provider, hands it over and lets it go. Nothing is written to disk, so there's no archive of your mail here to be breached, subpoenaed or lost.
The same goes for your calendar and your address book. A contact stays in memory for about 10 minutes after it was last asked for, so the next question about the same person is quick, and then it's forgotten.
What we do keep is the minimum the service needs to work:
- Your account: your email address, your settings, and a password stored only as an Argon2id hash.
- A credential for each mailbox you connect, each encrypted with AES-256-GCM under its own key and bound to that mailbox, so a stolen row opens nothing else.
- A record of each call your AI makes, kept 90 days, and an audit record kept 400 days unless you choose less. Neither ever holds a message.
- The record that you paid, kept as long as UK tax law requires. Your card details stay with Stripe and never reach us.
The full list, with every retention period, is on the IT and security page, and the privacy policy says why each one is kept.
Where it lives
Where your data lives: London, United Kingdom
The servers are run by us, in London. They're on 365i, which is part of BSolve IT Limited, the company that runs Mailbox MCP. There's no other region, and no third party sits in front of the service.
Every night an encrypted backup is taken and a verified copy is filed off the machine, also in the UK. Every week we restore the newest one into a scratch database and decrypt a real credential out of it, because that's the only test that proves a customer could be put back to work.
3 things are handled outside the UK, and each has a legal basis named in our data processing agreement. None of them is ever given a password, an access token or the contents of a message.
| What leaves the UK | Who, and where | The legal basis |
|---|---|---|
| Card payments | Stripe, in the United States and the European Union | Stripe's own data processing agreement and transfer mechanism |
| The emails the service sends, such as receipts and password resets | Brevo, in France and Belgium | Both are in the EEA, which UK law approves under Article 45A of UK GDPR |
| A support request sent from the control panel | Cloudflare, in the United States | The UK Extension to the EU-US Data Privacy Framework, to which Cloudflare is certified |
Clause 7.2 of the data processing agreement gives each basis in full.
We keep that list honest by changing the agreement when the service changes, not when somebody asks. When every email the service sends moved to Brevo on 10 October 2026, version 7 of the agreement went up the same day, naming the transfer and its basis.
EU customers
EU GDPR and the UK adequacy decision
If your business is in the EU, the GDPR you work under is the EU's. Sending personal data to a supplier outside the EU normally needs extra paperwork, such as standard contractual clauses. The UK doesn't, because the European Commission has decided that UK law protects personal data to an equivalent standard.
The Commission renewed that decision on 19 December 2025. It now runs until 27 December 2031, with a review after 4 years. Its Executive Vice-President for Tech Sovereignty, Security and Democracy put the practical effect plainly:
"It ensures the free flow of personal data between the EEA and the UK in full compliance with data protection rules while reducing costs and administrative burdens."
Notice the words "free flow". For you, sending your mail through a service in London is treated the way sending it to a supplier in Dublin or Berlin would be: no transfer assessment, no extra clauses. The date matters too. A decision that runs to the end of 2031 is one you can plan a supplier around, rather than a question you'll be asked to revisit next year.
Our data processing agreement is written under UK GDPR, the law we're bound by. UK GDPR kept the EU regulation's rules for processors when the UK left the EU, so the duties it sets out for us are the ones an EU controller expects to see. If your organisation needs anything more, write to us.
Certified
Cyber Essentials certified: the company, not just the host
A data centre's certificate covers the building. Ours covers the business that runs your service.
Certificate number
f97b9fa1-0051-4b5c-8a3a-22cad9a487d7
Issued 17 September 2026 to BSolve IT Limited, with the whole organisation in scope. Recertification is due 17 September 2027.
BSolve IT Limited, the company that runs Mailbox MCP, was certified with everything in scope: the people, the devices and the systems we use to run the service. Cyber Essentials is the National Cyber Security Centre's scheme, and it assesses 5 technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
That's the difference worth asking any provider about. A hosting company's certificate tells you the data centre is well run. It says nothing about the business holding the keys to your mailbox. The security page has the full particulars.
The agreement
Our GDPR data processing agreement and sub-processors
The data processing agreement is a page anyone can read, and it covers you from the first call.
-
It's part of the terms, so there's nothing to sign.
When you use the service for a business, the agreement applies automatically. If your procurement team needs a countersigned copy, ask and we'll send one.
-
You're the controller. We're the processor.
For the mail, calendar and contacts you connect, we act only on your instructions. For your own account details we're a controller in our own right, and the privacy policy covers that.
-
Your mail isn't used to train anything.
The agreement says it outright: nothing processed under it is used to train anything, to profile anybody, or for our own purposes.
-
4 sub-processors, each named.
Stripe for payment, a UK data-centre operator for the infrastructure under our servers, Cloudflare for the uptime monitor and support requests, and Brevo for the emails we send. The IT page lists what each one handles.
-
30 days' notice of any change.
A new sub-processor is announced by email 30 days before it starts. If you object, you can close your account in that time and we refund the unused part of what you paid.
-
Help with your own obligations.
If someone asks you for their data, or you need to assess a new use, the agreement commits us to help. Your activity record can be exported as a CSV at any time.
If something goes wrong
Data breach notification within 72 hours
Our commitment
If a personal data breach affects your data, we email you without undue delay and within 72 hours of confirming it, saying what was affected and what to do. Where the law requires it, we tell the Information Commissioner's Office within 72 hours.
That 72 hours is the clock the law sets for telling the regulator. The Information Commissioner's Office is direct about it:
"You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it."
For a processor telling its customers, the law asks for "without undue delay" and names no number of hours. We've put a number on it, in writing, because if your data is involved you'll have your own deadline with your own regulator, and you can't meet it on ours.
Because your mail is never stored, a breach here can't expose an archive of it. What it could expose is the encrypted credentials and the account records, and our email would say which. It would also tell you to revoke access at your mail provider, which you can do yourself in a minute, whatever state our systems are in.
Your controls
GDPR controls you hold: two-factor, audit and deletion
Everything here is done from your side, in the control panel or at your mail provider, without waiting for us.
-
Two-factor, required of everyone.
One switch under Settings, Security requires an authenticator app of every person on your account. Anyone without one can do nothing but set one up, and their AI connections are refused until they have.
-
An audit record, kept as long as you choose.
Every call is logged: which tool, when, on which mailbox, and whether it worked, never what a message said. The default is 400 days, and you can shorten it to any period from 90 days.
-
Limits on what an AI can do.
Each connection is set to read only, draft and file, or send and delete, and each mailbox carries a limit no connection can go above. The server enforces both on every call.
-
Revoke access yourself.
Remove a mailbox and its credential is deleted that minute. Or withdraw access at Microsoft or Google, or revoke an app password, and it ends at once. Here's how.
-
Close your account, and it's gone.
Your details, credentials, saved routines and call records are deleted at once. The last encrypted backup holding them ages out within 14 nights. Your mail needs no deleting: it was never here.
-
Ask us what we hold about you.
You can ask for a copy of your data, or for it to be corrected or deleted. Your rights under UK GDPR are listed in the privacy policy.
Before you choose
5 GDPR questions to ask any email AI provider
Whoever you choose, these 5 questions separate the providers who've thought about your data from the ones who haven't. Each is one we're glad to be asked, and our answer sits under it with the proof.
-
Is the service itself certified, or only the company that hosts it?
A data centre's certificate says the building is well run. It says nothing about the company holding the keys to your mailbox.
Our answer
The company that runs the service, BSolve IT Limited, holds Cyber Essentials with the whole organisation in scope.
See the certificate -
Is there a published DPA that applies without signing?
If an agreement has to be requested, negotiated and signed, the service is often in use long before it is in place.
Our answer
Yes. It's published, it's part of the terms, and it covers you from the first call.
Read the agreement -
Are the sub-processors named, with the basis for each transfer?
"Trusted third parties" isn't a list. You're entitled to know who handles your data, where, and on what legal footing.
Our answer
4, each named with what it handles, and the 3 transfers outside the UK each given its legal basis.
See the sub-processors -
What is the breach notification commitment, in hours?
"Without undue delay" is the legal minimum, and it doesn't put a number on anything. A number you can hold someone to is worth more.
Our answer
72 hours from confirming a breach that affects your data, by email, in writing.
Read the commitment -
Is my email content stored, and for how long?
Anything a provider keeps can be breached, subpoenaed or lost, and a copy of your mailbox is the most sensitive thing it could hold.
Every answer above holds on the free tier too: 5 calls a day on any mailbox, with no card, so you can check them on your own mail first.
Limits
GDPR limits: what this page does not promise
Data protection is shared work, and some of it stays with you. Here's where our part ends.
-
You're still the controller.
You decide what your AI does with your mail and why, and you need your own lawful basis for it. We act on your instructions, and we can't make those choices for you.
-
Your AI provider is your choice, and outside our agreement.
When your assistant reads a message, it goes to the AI company you use, under your agreement with them. Your mail provider and your AI provider aren't our sub-processors: you chose them, and they hold what they hold.
-
Our agreement hasn't been reviewed by a solicitor yet.
We wrote it ourselves and the page says so. It's written under UK GDPR. If your procurement team needs a countersigned copy, ask.
-
3 things leave the UK.
Payment, support requests and the emails we send, each on the basis named above. Everything else stays here.
Questions
GDPR questions about Mailbox MCP
Is Mailbox MCP GDPR compliant?
We run the service to UK GDPR, the law we are under, and our data processing agreement sets out our duties as your processor. If you are in the EU, the European Commission has decided UK law gives personal data essentially equivalent protection, so your data can come to us without extra paperwork. Your mail is never stored, our servers are in London, and BSolve IT Limited is Cyber Essentials certified.
Where is my email data stored?
Your mail, calendar and contacts are never stored. They are read in memory while your AI is answering you, and then dropped. What we do keep, your account, your settings and an encrypted credential for each mailbox, is on our own servers in London, with a nightly encrypted backup that also stays in the UK. Payment, support requests and our emails are the 3 things handled outside the UK.
Can EU businesses use Mailbox MCP under GDPR?
Yes. On 19 December 2025 the European Commission renewed its decision that the UK protects personal data adequately, and it runs until 27 December 2031. That lets personal data move from the EU to the UK as freely as within the EU. You stay the controller of your mail, and our data processing agreement covers us as your processor.
Do I need to sign a data processing agreement?
No. Our data processing agreement is published at https://mailbox-mcp.com/dpa/ and forms part of the terms whenever you use the service for a business, so it applies without anything being signed. If your procurement team needs a countersigned copy, write to support@mailbox-mcp.com and we will send one.
Who are Mailbox MCP's sub-processors?
4, each named with what it does: Stripe for payment, a UK data-centre operator for the infrastructure under our servers, Cloudflare for the uptime monitor and support requests, and Brevo for the emails the service sends. None is given a password, an access token or the contents of a message. Changes are announced by email 30 days before they take effect.
What happens if there is a data breach?
If a personal data breach affects your data, we email you without undue delay and within 72 hours of confirming it, saying what was affected and what to do. Where the law requires it, we tell the Information Commissioner's Office within 72 hours. Because your mail is never stored, a breach cannot expose an archive of it, and you can revoke access at your mail provider without waiting for us.
Which certification does Mailbox MCP hold?
Cyber Essentials, the National Cyber Security Centre's scheme, delivered by IASME. It is held by BSolve IT Limited, the company that runs the service, with the whole organisation in scope, so it covers the business itself and not only the data centre. The certificate is published on our security page and verified on the IASME registry.
How do I delete my data?
Remove a mailbox and its credential is deleted that minute. Close your account and your details, credentials, saved routines and call records are deleted at once; the last encrypted backup holding them ages out within 14 nights. Payment records stay as long as UK tax law requires. Your mail needs no deleting, because it was never stored. You can export your activity record as a CSV first.
Attribution
Sources for this GDPR page
- European Commission: Commission renews decisions to allow for the free and safe flow of personal data with the UK Press release IP/25/3059, 19 December 2025. The renewal, the date it runs to and the 4-year review, and the quotation from Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy. Read 31 October 2026.
- European Commission: UK adequacy, renewal decision under the GDPR The decision itself, linked from the press release. Read 31 October 2026.
- European Commission: data protection adequacy for non-EU countries What an adequacy decision is and which countries hold one. Read 31 October 2026.
- Hunton Andrews Kurth: European Commission renews UK data adequacy decisions A law firm's account of the renewal, published 23 December 2025, giving the same dates. Read 31 October 2026.
- Freeths: European Commission renews UK adequacy decisions until 27 December 2031 A UK law firm's account by Hema Singhal, 5 March 2026, on what it means for data moving from the EEA to the UK. Read 31 October 2026.
- Information Commissioner's Office: personal data breaches, a guide The quotation on reporting a notifiable breach within 72 hours. Read 31 October 2026.
- National Cyber Security Centre: Cyber Essentials overview The scheme and its 5 technical controls. Read 31 October 2026.
- IASME registry: certificate f97b9fa1-0051-4b5c-8a3a-22cad9a487d7 The independent record of the certificate held by BSolve IT Limited. Read 31 October 2026.
Everything said here about the service is ours, and each fact is stated in full on the page it links: the IT and security page, the security page, the privacy policy and the data processing agreement. What could still go wrong, attack by attack, is in the threat model.
Keep going
Read next
Connect a mailbox, and know where your data goes.
5 calls a day free, on any mailbox, with no card. Your mail stays where it is and is never copied here.