Data processing agreement (summary)

Enterprise agreements include the DPA. If you use another plan for business purposes, request the DPA by email to sales@askquri.com or through our contact form.

Request the full DPA

Processing of the personal data contained in the mailboxes you connect, and of data derived from it (search index, answers, drafts), for the duration of your contract.

Synchronizing mail over IMAP, storing and indexing it, generating AI answers and drafts, sending messages over SMTP on your instruction, and providing export and deletion.

• Data: email headers (names, email addresses, dates, subjects), email text, and derived data such as the search index, questions, answers and drafts; account and usage data of your users.
• Data subjects: your users; senders and recipients of emails in connected mailboxes; people mentioned in those emails.

• We process personal data only on your documented instructions.
• Everyone authorized to process the data is bound to confidentiality.
• We implement technical and organizational measures under Art. 32 GDPR (summary below).
• We engage subprocessors only with your general authorization, inform you in advance of intended changes and give you the opportunity to object.
• We help you respond to data subject requests. Self-service export and deletion are available on every plan.
• We help you meet your obligations under Art. 32 to 36 GDPR, including security, breach notification and data protection impact assessments.
• We notify you without undue delay after becoming aware of a personal data breach.
• At the end of the contract we delete or return all personal data, unless the law requires us to keep it.
• We make available the information needed to demonstrate compliance and allow for and contribute to audits.

• Data stored and processed in EU regions (Convex EU, Qdrant EU).
• Mailbox credentials and API keys encrypted with AES-256-GCM using versioned keys.
• Email content encrypted at rest by our infrastructure providers.
• Website and app served over HTTPS only.
• Self-service export and deletion; mail removed from a mailbox is purged after 30 days.
• Optional BYOK for AI and search providers (Enterprise).

The current list, with purpose, location and transfer safeguard, is on our subprocessors page.