Privacy Policy

Bruce Mail is a smart email assistant by Bruce Apps B.V. (“Bruce Mail”, “we”, “us”). We care about your privacy and that of your customers. This policy explains which personal data we process, why, how long we keep it and what rights you have. It follows the General Data Protection Regulation (GDPR).

1. Who is responsible?

For the use of your own account (registration, billing, settings) Bruce Apps B.V. is the data controller. For the content of the emails you process through Bruce Mail — and the personal data of your customers within them — you are the controller and Bruce Mail acts as processor. For this we enter into a data processing agreement with you.

Contact details:
Bruce Apps B.V.
[Registered address]
Chamber of Commerce: [number] · VAT: [number]
Email: [email protected]

2. Which data do we process?

• Account data: name, email address, encrypted password, language preference and app settings.
• Connected mail accounts: the credentials/access tokens of the mail accounts you connect (stored encrypted) and their email addresses.
• Email content: subjects, senders, message content and attachments needed to create summaries, urgency estimates and draft replies.
• Usage and billing data: subscription type, payment status, company details for invoicing and limited logs for security and debugging.
• Device data for notifications: if you enable push notifications we store your device’s subscription identifier.

3. Purposes and legal bases

• Performance of the contract: to deliver the service — fetching, analysing, drafting replies, scheduling and sending notifications.
• Legitimate interest: security, abuse prevention, improvement and support of the service.
• Legal obligation: retaining invoice data for tax purposes.
• Consent: for sending push notifications (which you can always turn off).

Bruce Mail does not use the content of your emails to train AI models. Email content is only processed to give you the result (summary, reply).

4. AI processing

To summarise and reply to emails and estimate urgency, we send the relevant text to our AI provider (Abacus.AI). For speech we use ElevenLabs. These parties process the data solely on our instructions and do not use it for their own purposes or model training.

5. Sub-processors

We use carefully selected sub-processors:

• Abacus.AI — application hosting, database and AI processing.
• ElevenLabs — text-to-speech (read-aloud).
• Microsoft / Google — solely for connecting the mail accounts you link yourself.

Where data is processed outside the EEA, we ensure appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs).

6. How long do we keep data?

• Account data: while you have an account, and up to 30 days after termination.
• Cached email content: temporarily, to keep the service fast; periodically purged.
• Invoice data: 7 years (legal retention obligation).

7. Security

We encrypt traffic via HTTPS, store passwords and tokens encrypted and limit access to those who strictly need it. You can further secure your account with a passkey (Face ID / fingerprint).

8. Your rights

You have the right to access, rectification, erasure, restriction, objection and data portability. Send your request to [email protected]; we respond within 30 days. You also have the right to lodge a complaint with your data protection authority.

9. Changes

We may update this policy. The current version is always on this page with the date of last change at the top.