Privacy Policy

This policy explains how Pempo handles personal data for Pempo Mail, Pempo Contacts, and Pempo Calendar, and for the related websites, applications, and support services described below.

Who we are

Pempo is a French simplified joint-stock company (SAS). Its registered office is 16 rue de la Ville l’Évêque, 75008 Paris, France. Pempo is registered in Paris under number 101 767 010 R.C.S. Paris. Its SIRET is 101 767 010 00016 and its VAT number is FR41101767010.

You can contact Pempo and its data protection officer at contact@pempo.me.

Pempo is the data controller for the personal data it uses for its own purposes, such as account administration, billing, security, and support. A controller decides why and how personal data is used.

Data we receive

Depending on the services and features you use, the data can include:

• Account data, such as your name, account identifiers, email addresses, authentication details, account preferences, and subscription details.

• Mail data, such as message content, attachments, email addresses, subject lines, dates, and routing or delivery information.

• Contact data, such as names, email addresses, telephone numbers, and other information you add to a contact.

• Calendar data, such as event titles, dates, participants, locations, descriptions, and invitations.

• Technical and security data, such as IP addresses, device or connection information, authentication events, operational logs, and records of suspected abuse.

• Payment and support data, such as invoices, payment status, support requests, and information you choose to provide to us.

We receive information when you create or use an account, communicate with us, or provide content. We can also receive information from correspondents, people who invite you to events, and external providers you choose to connect.

Your messages, invitations, and contacts can contain information about other people who do not have a Pempo account.

How we use data and the legal bases

A legal basis is the reason the law permits a particular use of personal data. The following bases are proposed for Pempo's own processing and require confirmation for each launch feature.

• Provide your account and the services you request: performance of the contract with you, where the processing is necessary for that contract.

• Deliver messages, store your service data, and provide requested features: performance of the contract with you, where necessary.

• Prevent abuse, investigate incidents, and protect services and users: our legitimate interests in security and service integrity, where those interests are not overridden by your rights.

• Handle invoices, taxes, and legally required records: compliance with the applicable legal obligation.

• Respond to requests and manage disputes: performance of a contract, compliance with a legal obligation, or our legitimate interests, depending on the request.

Where we rely on legitimate interests, you can object as explained in Your rights. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that occurred before withdrawal.

Pempo Mail

Pempo Mail sends and receives messages. Messages exchanged with other providers also pass through their systems.

Pempo uses encryption to protect your messages. Messages between compatible Pempo accounts use end-to-end encryption with post-quantum cryptography.

Pempo can access sender and recipient addresses and information needed to deliver and organize messages. Mail from other providers can also expose its subject and content.

Messages from other providers can arrive without end-to-end encryption. Pempo can read those messages while providing services such as delivery, spam filtering, and search. Some temporary copies remain accessible to Pempo while processing continues.

Connecting Gmail: access and use of Google data

Connecting Gmail to Pempo Mail is optional. Google asks you to authorize read-only Gmail access before Pempo imports your mail. Pempo requests the read-only Gmail permission. This connection does not request access to Google Contacts, Google Calendar, or Google Drive.

Pempo accesses your Gmail email address, message content, attachments, sender and recipient addresses, subject lines, dates, message identifiers, labels, and message status. Message status includes whether a message is read, starred, important, or a draft. The initial import includes messages in Spam and Trash. Pempo also receives mailbox counts and synchronization identifiers to track import progress and retrieve new messages.

Pempo uses this data to copy your Gmail messages into Pempo Mail, organize them into folders, and let you read and search them. The connection continues to import new messages while it remains active, including when you are not using Pempo. This is a one-way import. Pempo does not use this permission to send, modify, or delete messages in Gmail. Deleting a message in Gmail does not delete its imported copy in Pempo.

Google gives Pempo access tokens and a refresh token, which allow Pempo to access Gmail without receiving your Google password. Pempo stores the refresh token encrypted, together with your connected email address and records of connection status and import progress. Pempo uses the token to maintain the connection. Pempo encrypts imported Gmail message content as it arrives on its servers and does not store that content in clear text. Imported messages become encrypted copies stored in your Pempo mailbox. Pempo processes readable Gmail content temporarily in memory within Pempo-operated infrastructure hosted by Scaleway. Pempo staff cannot access that content.

Restrictions on Google data use

Pempo uses Google user data only to provide the Pempo Mail features described in this policy. Pempo's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. These restrictions also apply to data derived from Google user data.

Pempo and its service providers do not sell Google user data or use it for advertising or credit scoring. We do not transfer Google user data to advertising platforms, data brokers, or information resellers for those purposes.

Pempo and its service providers do not use data obtained through Google Workspace APIs to develop, improve, or train general, non-personalized AI or machine-learning models. This restriction includes imported Gmail content and data derived from it. Processing a message with an existing AI model to provide a feature is separate from training that model.

Disconnecting Gmail and deleting imported data

You can disconnect Gmail in Pempo's mail connection settings. Pempo removes the active connection and its import-tracking records, and requests revocation of the Google authorization. You can also remove Pempo's access directly through your Google Account connections.

Disconnecting Gmail or removing Google's authorization does not delete messages already imported into Pempo. You can delete those copies in Pempo. Deleting an imported copy in Pempo does not delete the original in Gmail. You can request deletion of imported Gmail data or closure of your account at contact@pempo.me. Pempo deletes your account's encrypted content, including imported Gmail messages and backup copies, within 30 days after account closure. The retention and deletion rules below also apply to imported Gmail data.

Pempo Contacts

Pempo Contacts stores and organizes the contact information you add or import. A contact can include personal information about someone other than you.

Pempo uses encryption to protect contacts. Pempo can access contact email addresses to help filter spam.

Pempo Calendar

Pempo Calendar stores and organizes the events you add.

Pempo encrypts calendar events. Invitations are sent by email, so recipients and their providers can read them.

AI and automated decisions

Pempo uses AI to organize messages and extract information from readable message content. This includes imported Gmail messages. Pempo processes that content temporarily in memory on its own servers hosted by Scaleway. Pempo staff cannot access the readable Gmail content.

The AI features assign message categories, identify messages that need attention, and extract information for features within Pempo. Pempo operates the AI models on its own servers. Pempo does not send message content to Scaleway Generative APIs or other external AI services.

Pempo and its service providers do not use customer message content, including Google user data, to develop, improve, or train general AI models.

Cookies and similar technologies

We use cookies and similar technologies to remember preferences and support the services. Pempo does not plan advertising, promotional messages, advertising cookies, or optional analytics.

Where law requires consent, we will ask for it before using the relevant technology. Accepting the Terms and Conditions is not a substitute for that consent.

Who receives data

We disclose personal data only for the purposes and under the conditions described in this policy or as required by law. Recipients can include service providers that help us host, secure, support, and operate the services, and payment providers where payment is offered. Pempo does not sell your personal data.

Pempo uses Scaleway to host its infrastructure, including storage, mail delivery, and Pempo-operated AI processing. Imported Gmail content stays within this Pempo-operated infrastructure unless you send or export it. Pempo does not disclose readable Gmail content to staff or external AI services. Mollie handles web subscription payments.

When mobile notifications are enabled, Apple or Google receives information needed to deliver them, including unread counts and identifiers. When you connect Gmail, Google receives the information needed for authorization and synchronization.

When you communicate with other people or connect an outside service, the recipient and that service receive the information needed for that interaction. Their own privacy notices can apply.

We can disclose data to a competent authority when required by applicable law.

Security and sensitive data

We use encryption and access controls to protect personal data. Pempo uses HTTPS to communicate with Google and encrypts stored Google refresh tokens. The import service decrypts those tokens when it needs to access Gmail. Encryption on arrival protects stored Gmail message content. Pempo receives readable messages during import, so this protection is not end-to-end encryption between Gmail and your device.

Messages, contacts, and calendar entries can contain sensitive data, such as health information.

International transfers

Pempo's core hosting is configured in the European Union. A provider's location or its access to data can still involve a transfer outside the European Economic Area.

How long we keep data

We keep personal data for the period needed for the purpose described in this policy, subject to applicable legal obligations and the rights described below.

Some deleted messages can be recovered for a limited period. Account deletion follows a separate process.

Pempo deletes your account's encrypted data, including imported Gmail messages and backup copies, within 30 days after you close your account. You can request account closure or deletion of your data at contact@pempo.me. We can retain certain records needed to meet legal obligations, such as invoices.

Your rights

Subject to the conditions in applicable data protection law, you can ask to access, correct, or erase personal data, restrict processing, or receive portable data. You can object to processing based on legitimate interests and object at any time to direct marketing. You can withdraw consent where processing relies on consent.

Where French law applies, you can give instructions about the retention, erasure, and disclosure of your personal data after your death.

To make a request, contact contact@pempo.me. We can ask for information needed to confirm your identity. We will respond within the applicable legal period and explain any lawful extension or refusal.

You can complain to the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), at https://www.cnil.fr/en/plaintes. You can also contact the competent supervisory authority where you live, work, or believe an infringement occurred.

People without a Pempo account can also exercise their rights by contacting contact@pempo.me.

Children

The services are recommended for users aged 12 and older. Pempo does not plan to check users' ages.

Changes to this policy

We can update this policy when our services or legal obligations change. We will make the updated policy available and give additional notice when law requires it. Before using Google user data for a new purpose or accessing additional Google data, we will notify you and obtain your consent.