Privacy policy

Last updated: October 14, 2026

SymbioMail reads your emails to sort them for you. That is a great deal of trust: this page states plainly what we do with them and what we will never do.

1. Who is responsible for your data

The data controller is SYMBIOTEK, a French SASU with a share capital of 1 000 €, RCS Brest 952 600 906, registered office at 1 rue Amiral Nielly, 29200 Brest, France. SymbioMail is a trademark of SYMBIOTEK.

For any question about your data: support@symbiotek.io, or by post to the registered office. SYMBIOTEK has not appointed a data protection officer; your contact is its President, Sébastien Gourrier.

This policy covers the website symbiomail.com, the Clean Inbox journey, the SymbioMail application and the emails we send you. It complies with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the amended French Data Protection Act of 6 January 1978. The French version of this policy prevails.

The data of the people who write to you

Your emails contain the data of the people who write to you. For that data, you, the user, decide to process it with SymbioMail: SYMBIOTEK then acts as a processor within the meaning of article 28 GDPR. It processes that data only on your instructions, to provide the service, and never for its own purposes.

2. The data we process

• Your account: first name, last name, email address, password (stored as an irreversible hash), language, country, company and display preferences.
• Your usage profile: answers to the welcome questionnaire (SymbioScan), chosen power level, settings, rules, sender families.
• Your connected mailbox
  • Gmail: the authorisation you grant Google, in the form of access tokens, and the address of the connected account;
  • other mailboxes (IMAP): the server address, username and password, needed to fetch your mail and send your replies;
  • the content of synced emails: sender, recipients, subject, date, body, attachments, folders and labels.
• What SymbioMail computes: relevance score, sender classification, daily agenda, and the summaries or drafts you request.
• WhatsApp, if you turn it on: your number and the notifications you chose to receive.
• Billing: plan, invoices, payment history. Card details are entered and stored by Stripe, never by SYMBIOTEK.
• Technical data: IP address, login date and time, browser, country inferred from the IP address (on our servers, with no third-party service), error logs.
• Support conversations: your messages and our replies.
• Prospects (Clean Inbox journey, website forms): first name, email address, questionnaire answers, and the record of your consent (date, IP address, sign-up page).

We only ask for what the service needs. No so-called sensitive data (health, opinions, origin…) is sought; if an email contains some, it is processed like the rest of the message, only to display it to you.

3. Why we process it, and on what legal basis

Sorting and relevance scores are aids: they produce no legal effect on you and you always keep the decision. They are therefore not solely automated decisions within the meaning of article 22 GDPR.

4. Data received from Google (Gmail)

When you connect a Gmail mailbox, SymbioMail accesses your emails through the Gmail API, with the permission you grant on Google's consent screen. This access is used only to display, sync, classify, archive and send your emails from SymbioMail, and to provide the features you see on screen.

SymbioMail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• Gmail data is used only to provide or improve user-facing SymbioMail features;
• it is never sold, never used for advertising, and never used to determine creditworthiness or for lending purposes;
• it is shared with third parties only to provide those features (the processors in section 6), for security purposes, or when required by law;
• it is not used to develop, improve or train generalised artificial intelligence or machine learning models;
• no human reads your emails unless you ask us to for a specific message (for support, for example), to investigate security issues or abuse, or when required by law.

You can revoke this access at any time from SymbioMail (disconnect the mailbox) or from your Google account: myaccount.google.com/permissions.

5. Artificial intelligence

Some features send the content of the relevant emails to an artificial intelligence provider, only for the time needed to produce the result: summary of an email or a selection, suggested reply, classification of a sender the rules cannot place, spotting emails that are waiting for an answer. Only the emails the feature needs are sent.

The providers used are listed in section 6. They are used through their business API offerings, whose terms forbid them from reusing this data to train their models. The results (a summary, a draft) are saved in your account, and a draft is never sent without your approval.

6. Who receives your data

Your data is accessible only to the SYMBIOTEK staff who need it to run the service, and to the processors below, each for its own task. None of them may use it for its own purposes. SYMBIOTEK does not sell, rent or trade any personal data.

Syncing, search and the preparation of notifications run on our own servers, with no third-party service. Your data may also be disclosed to a judicial or administrative authority that lawfully requests it.

7. Transfers outside the European Union

Your data is hosted in France. Some processors (Google, OpenAI, Groq, logo services) are based in the United States. Depending on the provider, these transfers rely on its certification under the EU–U.S. Data Privacy Framework or on the standard contractual clauses adopted by the European Commission. You can obtain a copy by writing to support@symbiotek.io.

8. How long we keep it

• Account and settings: for as long as your subscription lasts, then 3 years after the relationship ends, for commercial management only.
• Synced emails and what is computed from them: as long as the mailbox stays connected to SymbioMail. They are removed from the live database when you delete the mailbox or your account, then disappear from backups as these are renewed.
• Gmail authorisation and IMAP access: until the mailbox is disconnected or access is revoked.
• Invoices and accounting records: 10 years, as required by article L. 123-22 of the French Commercial Code.
• Login logs: 1 year.
• Prospects: 3 years after your last contact. After that, the address is removed and placed on a suppression list so that we never write to you again.
• Record of consent: for as long as the consent lasts, then 5 years so that we can prove it was given.

9. Cookies and browser storage

SymbioMail sets no advertising or audience-measurement cookies. The only cookies set are strictly necessary: they keep your session open and protect forms against forged submissions. They are exempt from consent (article 82 of the French Data Protection Act). Your browser also keeps a few display preferences (light or dark theme, filters), which never leave your device.

Sign-up and login forms are protected against bots by Google reCAPTCHA, which examines the visit (IP address, mouse behaviour, Google cookies) to tell a person from a program. This protection rests on SYMBIOTEK's legitimate interest in preventing fraudulent sign-ups.

The videos of the Clean Inbox journey and of the onboarding are served by YouTube (Google). Until you accept its cookies, they play in its privacy-enhanced mode (youtube-nocookie.com), with no tracking cookie; not answering counts as a refusal. If you accept, they play from youtube.com, and Google may set its own cookies, governed by its privacy policy. The question appears on pages that contain a video; your choice is kept for 6 months and can be changed at any time through the “Cookie settings” link in the footer.

You can delete or block cookies at any time in your browser settings; the SymbioMail session will then not stay open.

10. Security

SYMBIOTEK takes measures suited to the risk to protect your data:

• encryption of traffic between your browser and our servers (HTTPS);
• account passwords stored as irreversible hashes;
• passwords and access tokens of your connected mailboxes (IMAP, Gmail) stored encrypted, and shown only to the person allowed to edit the mailbox;
• firewall, administrative access to the servers restricted to named, authorised people;
• each account's data separated in its own database;
• regular backups on a separate server;
• logging of sensitive operations.

If a data breach puts your rights at risk, SYMBIOTEK notifies the CNIL within 72 hours and, if the risk is high, informs you directly. Your SymbioMail password is personal: never share it.

11. Your rights

You have the following rights over your data at any time:

• access: know what data we hold and get a copy;
• rectification: correct inaccurate data;
• erasure: have your data deleted, within the limits of our legal obligations (invoices);
• restriction: freeze processing while something is checked;
• objection: refuse processing based on legitimate interest, and object to direct marketing unconditionally;
• portability: receive the data you provided in a machine-readable format;
• withdrawal of consent, at any time, without affecting what was done before;
• instructions on what happens to your data after your death.

To exercise them, write to support@symbiotek.io or by post to SYMBIOTEK, 1 rue Amiral Nielly, 29200 Brest, France. We reply within one month. If we have reasonable doubts about your identity, we may ask you to confirm it. Every marketing email contains an unsubscribe link that works immediately.

If, after contacting us, you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL: cnil.fr/fr/plaintes, or with the authority of your country of residence.

12. Minors

SymbioMail is intended for professionals and adults. The service is not meant for people under 15, who must not create an account.

13. Changes to this policy

This policy may change, in particular to follow the law or a new SymbioMail feature. The update date appears at the top of the page. Any significant change is announced by email or in the application before it takes effect.

14. Governing law

This policy is governed by French law and written in French; in case of translation, only the French text prevails. Any dispute falls under the courts with jurisdiction over SYMBIOTEK's registered office, subject to the rules that protect consumers.