# AI email assistant privacy: storage, training and GDPR

> Where AI email assistants process your mail, who trains on it and what the GDPR requires: Gemini, Copilot, Fyxer, Superhuman, Canary and SaneBox compared.

Updated: 2026-10-30 · Fact-checked: 2026-10-30 · Canonical: https://commandmail.app/en/learn/ai-email-assistant-privacy · Deutsch: https://commandmail.app/de/wissen/datenschutz-ki-e-mail-assistenten.md

Three questions decide how private an AI email assistant is: which company ends up holding your mail or a copy of it, whether that company or its AI supplier may train models on it, and what legal basis covers the transfer if the data leaves the EU. Nearly every provider we checked rules out training by third-party AI suppliers. Whether the assistant trains its own models, how long it keeps data and where it runs differ a lot more.

## What decides how private an AI email assistant is?

Start with who receives the mail. If your mail provider builds the assistant in, it remains your direct provider; an add-on with access to your inbox brings in another company. Either way, service providers can be involved, above all companies running language models.

Next comes training. Two layers are worth separating here: training of large foundation models by suppliers such as OpenAI or Anthropic, and training of the assistant's own smaller models for sorting or matching your writing style.

The third question is legal. Used for work, an assistant also processes the personal data of your customers and contacts, and the GDPR then asks for contracts and a transfer mechanism. The sections below summarise what six assistants say about each point. ChatGPT and Claude connected to Gmail have their own page: [Is it safe to connect Gmail to ChatGPT or Claude?](https://commandmail.app/en/learn/is-it-safe-to-connect-email-to-ai)

## Where does your mail go when an assistant reads it?

With a built-in assistant, the company that already stores your mail remains your direct provider. Google says Gemini in Gmail only processes what you ask for and does not hold on to the data afterwards[^6]. For Microsoft 365 Copilot at work, prompts, retrieved data and responses are processed and stored under the same contractual commitments as the organisation's other Microsoft 365 content[^9]. Microsoft also offers third-party models in Copilot, such as Anthropic and OpenAI models, and admins decide whether to use them[^9].

An add-on brings in another company, and what it keeps varies widely. SaneBox's privacy policy says it only accesses envelope and header data and never downloads message bodies[^16]; its security page adds that optional features retrieve the body but never store it[^17]. Superhuman stores your emails through a SOC 2-compliant third-party vendor once Ask AI is on[^14]. Fyxer sends email content to the AI model providers it uses in order to sort mail and write drafts[^11].

Canary Mail takes a third route. By default, message content stays on your device, and the personalised models used for prioritisation are created and stored there[^15]. Drafting, summaries and chat use hosted models from providers such as OpenAI, Anthropic, Cohere and Google. If you turn on push notifications, Canary temporarily keeps your address, credentials, sender, subject line and first line on its server; Cloud Sync also keeps data there temporarily until you turn it off[^15].

A separate inbox fed by forwarding, such as Command Mail, keeps copies with whoever runs that inbox. The originals stay with your existing provider, so the mail then exists in two places.

## Who trains on your email?

The table reflects what each provider wrote on 2026-10-30. We have not tested these commitments ourselves.

| Assistant | Training on email content | What is stored |
| --- | --- | --- |
| Gemini in Gmail, personal account | foundation models not trained on personal emails[^6] | nothing beyond the task, per Google[^6] |
| Gemini, Google Workspace | no training or human review outside your domain without permission[^7] | prompts and responses 90 days to indefinite, as set by admins; feedback up to 18 months[^7] |
| Copilot in Outlook, Microsoft account | prompts, responses and file content not used for foundation models[^8] | activity history in some apps[^8] |
| Microsoft 365 Copilot, work | prompts, responses and Graph data not used for foundation models[^9] | like other Microsoft 365 content, manageable in Purview[^9] |
| Fyxer | not by AI suppliers; Fyxer's own models by default, can be turned off[^11] | not documented in detail |
| Superhuman Mail | help: no training; privacy policy for individual accounts: own models, with a control[^13][^14] | emails at a vendor; some queries and responses 90 days[^14] |
| Canary Mail | no generalised models; supplier sharing opted out[^15] | content on device; temporarily on server with push or Cloud Sync[^15] |
| SaneBox | no training on email content, per AI blog[^18] | headers; activity logs 30 days[^16] |
| Command Mail | no training, per privacy policy[^19] | copies while the account exists[^19] |

Fyxer's own training setting is on by default. Before training, Fyxer says it replaces names and email addresses with codes and removes sensitive information. You can turn it off under Dashboard › Settings › Account by unchecking "Allow Fyxer to use my data to train and improve its AI models", and admins can opt out the whole organisation[^11].

Superhuman's two sources differ. The Ask AI help article says of Superhuman Mail: "Neither Mail nor any vendor trains on your data"[^14]. The platform privacy policy, which also covers Grammarly, says Superhuman uses collected information to train its AI models and that you control this through training settings in your account[^13]. That policy applies to individual accounts; content in accounts managed by an organisation is processed under that organisation's contract and data protection terms with Superhuman[^13].

Google Workspace and Copilot have separate rules for feedback. Google keeps Workspace feedback for up to 18 months but does not use it to train the models behind Workspace features[^7]. Microsoft uses optional feedback to improve Copilot, again without training the foundation models on it[^8][^9].

## What does the GDPR say about AI email assistants?

For personal use, the GDPR usually does not apply to your own processing. Article 2(2)(c) excludes processing by a natural person in the course of a purely personal or household activity[^1]. Recital 18 makes clear that the regulation still applies to the controllers and processors who provide the means for it[^1].

Business use is different. A work inbox holds data about customers, applicants and partners, and you are responsible for it. If an assistant processes that data on your behalf, Article 28(1) says you may only use processors that give sufficient guarantees of appropriate technical and organisational measures[^1].

Article 28(3) requires a contract that sets out, among other things, the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects[^1]. This is the data processing agreement, or DPA.

Transfers to the United States need a basis under Articles 44 and following[^1]. Since the Commission's adequacy decision of 10 July 2023, personal data can flow without further authorisation to US companies that participate in the EU-US Data Privacy Framework[^2]. For recipients outside the framework, standard contractual clauses remain the usual appropriate safeguard under Article 46, and data subjects must have enforceable rights and effective legal remedies[^1][^2]. Under the Schrems II judgment, the exporter and the recipient must check before the transfer whether the required level of protection is actually respected in the third country[^5].

The General Court dismissed the action against that decision on 3 September 2025[^3]. An appeal against the judgment is pending before the Court of Justice as case C-703/25 P[^4]. Its predecessor, the Privacy Shield, was declared invalid by the Court of Justice on 16 July 2020[^5]. Whether a specific use is lawful in your business is a question for your data protection adviser; this page only summarises the rules and what providers state.

## What do providers say about location and transfers?

Fyxer AI Limited is a UK company registered with the Information Commissioner's Office. Its help centre says the core platform stores and processes data in the EU, on Google Cloud with primary servers in Belgium and the Netherlands[^10]. Some service providers sit outside the UK and EEA, including in the US, and Fyxer names the EU standard contractual clauses, the UK International Data Transfer Addendum or the UK Extension to the Data Privacy Framework as safeguards[^10]. The pricing table lists a choice of storage region between the EU, UK and US only for Enterprise[^12].

Microsoft keeps Microsoft 365 Copilot inside the EU Data Boundary for EU customers. Anthropic models are currently excluded from it, and queries from customers outside the EU may be processed in the US, the EU or other regions[^9]. For Google Workspace, Google points to its Cloud Data Processing Addendum, under which it processes customer data only on the customer's instructions[^7].

Superhuman Platform Inc. is based in the US, and its privacy policy says it is certified under the Data Privacy Framework, with standard contractual clauses for other countries[^13]. Canary names Cartasec Pte. Ltd. as controller and says it has data processor agreements with its service providers; the page does not name a transfer mechanism[^15].

SaneBox, Inc.'s privacy policy was last modified on 1 February 2021 and still names the Privacy Shield as the basis for transfers to the US[^16], which has not been a valid basis since the 2020 judgment[^5]. The policy does not say what SaneBox relies on today. When you cancel, the policy says SaneBox deletes all data on its servers for your mail account, including the labels and flags it created[^16].

## What to check before you switch one on

We derive this order from the rules and provider statements above:

1. **Know your account type.** Google and Microsoft make different commitments for personal and work accounts[^6][^7][^8][^9].
2. **Find the training control.** Fyxer and Superhuman have settings for training their own models[^11][^13].
3. **Read the retention periods.** How long prompts, responses and copies are kept often sits in a help article, outside the privacy policy[^14].
4. **Look at the subprocessors.** Fyxer links to a subprocessor list showing where each one processes data[^10]; Canary names its model providers[^15].
5. **For businesses: contract and transfers.** Ask for a DPA, check the transfer mechanism, and for US recipients look up the certification on the Data Privacy Framework site[^2].
6. **Revoke access when you stop.** Cancel and remove the connection in your Google or Microsoft account; what gets deleted afterwards is up to each provider.

## Where does Command Mail stand on privacy?

Command Mail is our product. It is run by FYN Labs LLC in the US, which its privacy policy names as controller under the GDPR[^19]. The app and database run on Cloudflare, Inc., also a US company, and attachments are stored in Cloudflare's EU region[^19]. The policy gives no region for message text or the database.

For transfers to the US it relies on the Data Privacy Framework where the recipient is certified and on standard contractual clauses otherwise[^19]; it does not say whether FYN Labs itself is certified. The home page lists a contract with a DPA under the Enterprise plan and does not mention one for Free or Pro[^20].

Your mail arrives as forwarded copies. According to the privacy policy, Command Mail does not use your mail or account data to train AI models[^19].

To assess spam, fraud and phishing, it sends the sender, recipients, subject, attachment names and up to 4,000 characters of text of incoming mail to the service provider TypeSafe[^19]. According to our app code, this also includes the sender's display name and, if you have set up automatic labels, their names and sorting rules. In the subject and text, the code first replaces only certain patterns, such as one-time codes after words like "code" or "PIN", passwords, link parameters, IBANs and long tokens; card numbers are not specifically removed. Sender, recipients, attachment names and label rules are sent unredacted.

According to the app code, two web app features send further data to TypeSafe. When you open the agent panel for an incoming message, through "Reply with agent" or the agent button, the sender with display name, recipients, redacted subject and up to 4,000 characters of redacted text go there to rank suitable reply types; this is skipped for mail recognised as automated. After you archive a message or move it to spam, the web app may also offer similar messages. When you open that list, it sends the original message and up to 30 candidates, each with sender, redacted subject and up to 1,000 characters of redacted text, to TypeSafe to check how similar they are.

If you enable notifications, the subject and sender of new messages reach your device through Apple's or Google's push services, without the message body[^19]. Anything an agent you connect retrieves is processed by that agent's provider under its own terms[^19]. How OpenAI and Anthropic handle it is covered in [Is it safe to connect Gmail to ChatGPT or Claude?](https://commandmail.app/en/learn/is-it-safe-to-connect-email-to-ai)

When you delete your account, the policy says Command Mail deletes account data, mail and attachments within 30 days unless the law requires longer retention[^19]. A message you move to the trash can be restored from there at first. If you delete permanently in trash or spam, or empty either folder, the app code removes the messages without a further step; agents may only do this on the `auto` level with the `mail:read` and `mail:send` permissions. A retention period you set for trash or spam removes expired messages automatically, except in mailboxes on `read`; without one, the code deletes nothing over time.

## Review status

As of 2026-10-30. All sources were retrieved that day; case C-703/25 P could only be read through a search index extract of InfoCuria, because the page itself loads only with JavaScript. Statements about Command Mail also rest on the app code at commit `d9ab36c` (TypeSafe payload including the agent panel and the similar-messages list, redaction, permanent deletion and retention) and the production configuration of the attachment store. We have not verified the other providers' commitments ourselves.

You can [start for free](https://commandmail.app/login?signup=1), forward one address and connect your agent with read and draft permissions only at first.

## Frequently asked questions

### Does Google train on my email when I use Gemini in Gmail?

Google says it does not train its foundational models, including Gemini, on your personal emails, and that Gemini in Gmail does not keep your data after the task. For Google Workspace the commitment is contractual: no training and no human review outside your domain without permission.

### Is an AI email assistant GDPR compliant?

That depends on how you use it. For purely personal use the GDPR usually does not apply to you, although it still applies to the provider. For business use you need a contract under Article 28 if the assistant processes mail on your behalf, plus a legal basis for transfers outside the EU, such as the Data Privacy Framework or standard contractual clauses.

### Do I need a data processing agreement as a private user?

Usually not. The GDPR does not cover processing by an individual in the course of a purely personal or household activity. Recital 18 adds that it does still apply to the providers who supply the tools for it.

### Which AI email assistants process mail in the EU?

Fyxer names servers in Belgium and the Netherlands for its core platform, and Microsoft keeps Microsoft 365 Copilot inside the EU Data Boundary for EU customers, except for Anthropic models. Command Mail stores attachments in Cloudflare's EU region. The other providers we checked do not state EU processing.

### Does Command Mail train AI on my email?

No. Its privacy policy says Command Mail does not use your mail or account data to train AI models. Whatever an agent you connect retrieves is handled by that agent's provider under its own terms.

## Sources

1. [German Federal Data Protection Commissioner (BfDI): GDPR and BDSG texts (March 2026), Art. 2, Art. 28, Art. 44–46 and Recital 18 (German)](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Broschueren/INFO1.pdf?__blob=publicationFile&v=1), accessed 2026-10-30
2. [European Commission: EU-US data transfers (adequacy decision on the Data Privacy Framework)](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en), accessed 2026-10-30
3. [CJEU press release 106/25: General Court judgment T-553/23 Latombe v Commission, 2025-09-03 (PDF)](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf), accessed 2026-10-30
4. [InfoCuria: Case C-703/25 P Latombe v Commission, appeal pending](https://infocuria.curia.europa.eu/tabs/affair?lang=EN&publishedId=C-703%2F25+P), accessed 2026-10-30
5. [CJEU press release 91/20: judgment C-311/18 (Schrems II), 2020-07-16 (PDF)](https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf), accessed 2026-10-30
6. [Google: Gemini in Gmail, how Google keeps user emails private (2026-04-07)](https://blog.google/products-and-platforms/products/gmail/privacy-in-gmail-with-gemini/), accessed 2026-10-30
7. [Google Workspace Admin Help: Generative AI in Google Workspace Privacy Hub](https://support.google.com/a/answer/15706919?hl=en), accessed 2026-10-30
8. [Microsoft Support: Copilot in Microsoft 365 apps for home, your data and privacy](https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy), accessed 2026-10-30
9. [Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy), accessed 2026-10-30
10. [Fyxer Help: Where Fyxer data is stored (server locations and jurisdiction)](https://support.fyxer.com/article/where-fyxer-data-is-stored-server-locations-jurisdiction), accessed 2026-10-30
11. [Fyxer Help: How Fyxer secures your data (updated 2026-10-21)](https://support.fyxer.com/article/how-fyxer-secures-your-data), accessed 2026-10-30
12. [Fyxer: Pricing, feature table and FAQ](https://www.fyxer.com/pricing), accessed 2026-10-30
13. [Superhuman: Privacy Policy (Superhuman Platform Inc.)](https://superhuman.com/privacy), accessed 2026-10-30
14. [Superhuman Help: Ask AI (updated 2026-09-01)](https://help.superhuman.com/hc/en-us/articles/46005676610829-Ask-AI), accessed 2026-10-30
15. [Canary Mail: Privacy](https://canarymail.io/privacy), accessed 2026-10-30
16. [SaneBox: Privacy Policy (last modified 2021-02-01)](https://www.sanebox.com/privacy), accessed 2026-10-30
17. [SaneBox: Security](https://www.sanebox.com/security), accessed 2026-10-30
18. [SaneBox blog: Introducing the AI Bundle (2026-10-26)](https://blog.sanebox.com/2026/10/26/saneboxs-next-evolution-introducing-the-ai-bundle/), accessed 2026-10-30
19. [Command Mail: Privacy Policy (last updated 2026-10-28)](https://commandmail.app/privacy), accessed 2026-10-30
20. [Command Mail: home page, Enterprise plan](https://commandmail.app/en), accessed 2026-10-30

[^1]: [German Federal Data Protection Commissioner (BfDI): GDPR and BDSG texts (March 2026), Art. 2, Art. 28, Art. 44–46 and Recital 18 (German)](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Broschueren/INFO1.pdf?__blob=publicationFile&v=1), accessed 2026-10-30
[^2]: [European Commission: EU-US data transfers (adequacy decision on the Data Privacy Framework)](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en), accessed 2026-10-30
[^3]: [CJEU press release 106/25: General Court judgment T-553/23 Latombe v Commission, 2025-09-03 (PDF)](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf), accessed 2026-10-30
[^4]: [InfoCuria: Case C-703/25 P Latombe v Commission, appeal pending](https://infocuria.curia.europa.eu/tabs/affair?lang=EN&publishedId=C-703%2F25+P), accessed 2026-10-30
[^5]: [CJEU press release 91/20: judgment C-311/18 (Schrems II), 2020-07-16 (PDF)](https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf), accessed 2026-10-30
[^6]: [Google: Gemini in Gmail, how Google keeps user emails private (2026-04-07)](https://blog.google/products-and-platforms/products/gmail/privacy-in-gmail-with-gemini/), accessed 2026-10-30
[^7]: [Google Workspace Admin Help: Generative AI in Google Workspace Privacy Hub](https://support.google.com/a/answer/15706919?hl=en), accessed 2026-10-30
[^8]: [Microsoft Support: Copilot in Microsoft 365 apps for home, your data and privacy](https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy), accessed 2026-10-30
[^9]: [Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy), accessed 2026-10-30
[^10]: [Fyxer Help: Where Fyxer data is stored (server locations and jurisdiction)](https://support.fyxer.com/article/where-fyxer-data-is-stored-server-locations-jurisdiction), accessed 2026-10-30
[^11]: [Fyxer Help: How Fyxer secures your data (updated 2026-10-21)](https://support.fyxer.com/article/how-fyxer-secures-your-data), accessed 2026-10-30
[^12]: [Fyxer: Pricing, feature table and FAQ](https://www.fyxer.com/pricing), accessed 2026-10-30
[^13]: [Superhuman: Privacy Policy (Superhuman Platform Inc.)](https://superhuman.com/privacy), accessed 2026-10-30
[^14]: [Superhuman Help: Ask AI (updated 2026-09-01)](https://help.superhuman.com/hc/en-us/articles/46005676610829-Ask-AI), accessed 2026-10-30
[^15]: [Canary Mail: Privacy](https://canarymail.io/privacy), accessed 2026-10-30
[^16]: [SaneBox: Privacy Policy (last modified 2021-02-01)](https://www.sanebox.com/privacy), accessed 2026-10-30
[^17]: [SaneBox: Security](https://www.sanebox.com/security), accessed 2026-10-30
[^18]: [SaneBox blog: Introducing the AI Bundle (2026-10-26)](https://blog.sanebox.com/2026/10/26/saneboxs-next-evolution-introducing-the-ai-bundle/), accessed 2026-10-30
[^19]: [Command Mail: Privacy Policy (last updated 2026-10-28)](https://commandmail.app/privacy), accessed 2026-10-30
[^20]: [Command Mail: home page, Enterprise plan](https://commandmail.app/en), accessed 2026-10-30

---

Command Mail: one inbox for you and your AI agent. Start free: https://commandmail.app/login?signup=1 · Connect your agent: https://commandmail.app/en/agents · MCP: https://commandmail.app/mcp