Privacy & security
Where your data lives
Speudio is hosted in the EU. Three providers outside it handle part of your data. OpenAI (USA) receives the relevant content when you use an AI feature. Cohere (USA/Canada) does two things: it turns your mail and files into the search index that lets a question in one language find an answer written in another, and it orders search results by relevance from the search text and the text of the candidate messages (up to about 4,000 characters each). Cloudflare (US-headquartered) holds only our nightly encrypted off-site backup, sealed with a key only we hold before it leaves our server, so Cloudflare stores ciphertext it cannot read. Your attachment files and the original formatted copy of each message (what you see under “view original”) are stored on our own server in Sweden, alongside the EU database that holds the readable text the app and the AI read. All of these transfers are safeguarded under EU Standard Contractual Clauses, none of your content is used to train models, and the AI providers keep it at most about 30 days. Our Privacy Policy sets out each one in full, including what Cloudflare can and cannot read.
What we have access to
A read-only copy of your emails. Your IMAP credentials are encrypted at rest with AES-256-GCM. Only you can see your own data, and Speudio staff never read your email contents.
GDPR rights
- Right of access: account menu (bottom-left) → Settings → Global → Privacy → Export my data. You get a ZIP holding the records Speudio stores for you across every mailbox you have connected: contacts, notes, tags, custom fields, files you uploaded yourself, AI conversations, support messages and payments. Your email is left out by default, because it is still sitting in your own mailbox and including it makes the file very large. Tick Include my email and its attachments before you download and you get everything. A README inside names what is there and what is not.
- Right to erasure: account menu (bottom-left) → Settings → Global → Privacy → Delete account. Your data is wiped within 24 hours of confirmation.
- Right to rectification: Edit any field on any contact at any time.
What we do NOT do
- Read your emails as a human, apart from an answer you flag yourself (see above) and the two channels you open yourself, described below.
- Train AI models on your data, apart from an answer you flag yourself (see above).
- Share data with third parties beyond the AI providers strictly necessary to process your request.
- Send marketing email to your contacts.
- Modify, delete, or send mail from your mailbox.
The two times a person here sees your content
Nobody at Speudio reads the mail we imported for you, and that is held in place by how the software is built rather than by staff being asked not to look: every query for email, attachments and contact profiles is scoped to the account that owns them. There are exactly two channels where a person does see content, and you open both yourself.
The first is a screenshot you attach to feedback. Someone here looks at it, and because it is a picture of your screen, whatever was on your screen is in the picture. We delete your feedback, and the screenshot with it, within 90 days.
The second is a support ticket, which our support team reads, including any of your own email you quote into it. If we ask the assistant to summarise a ticket or draft a reply, that text goes to OpenAI. Support access stays narrow even so, and this part is worth stating precisely: somebody reading your ticket cannot open your mailbox, your attachments or your contact profiles from it, because those queries are scoped to your account and not theirs. What they see is the ticket you wrote. A ticket lasts as long as your account does, and is deleted with it.