Privacy Policy

CelEpi is an email application that brings your mailboxes into one place, organised around the people you talk to. This policy explains what information CelEpi collects, how it is used, and the choices and rights you have. CelEpi is operated by Etheria Labs Ltd, a company registered in England and Wales (company no. 16833519) ("CelEpi", "we", "us").

If you have any questions about this policy, contact us at hello@celepi.app.

Information we collect

• Account identity. When you sign in with Google, we receive your name, email address and your Google account identifier.
• Your email and contacts. When you connect a Gmail or IMAP mailbox, CelEpi accesses your messages and contacts and can send mail on your behalf, so it can show you your inbox and let you reply. To make the app fast, recent message content is cached on our server.
• Credentials. Gmail access is granted through Google's OAuth — we store the resulting tokens encrypted (AES-256-GCM). For IMAP mailboxes (such as BT, Sky or Yahoo) we store your mail app password encrypted (AES-256-GCM). We never store credentials in plain text.
• Settings and activity within CelEpi. For example your signature, AI preferences, approved and blocked senders, snoozed conversations, scheduled emails, and which attachments you have opened.
• Waitlist. If you join the beta waitlist, we store the email address and any message you choose to add.
• Technical data. Standard server logs needed to run and secure the service.

Google user data and Limited Use

To provide its features, CelEpi requests permission to read your Gmail messages, send mail on your behalf, modify message state (for example marking as read or moving to trash), and read your contacts to power address autocomplete.

CelEpi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing email features in CelEpi.
• We do not transfer Google user data except as needed to provide those features (see "Service providers" below), for security or legal reasons, or with your consent.
• We do not use Google user data for advertising, and we do not sell it.
• No human reads your email except where you specifically ask us to, where necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

AI features

CelEpi uses AI to power several features. When one runs, the relevant message text is sent to an AI provider to generate that result and nothing else. By default these features run on CelEpi's own provider accounts (Anthropic for text, Groq for voice transcription) with usage limits; if you add your own API key in Settings, your key and chosen provider are used instead. Neither we nor our providers use your email to train any model.

• On demand — Smart Reply, AI drafting, voice dictation and the "Summarise" action run only when you use them.
• Automatic summaries. When you open a conversation, CelEpi may generate a short summary of it to save you reading time.
• Automatic fraud screening. CelEpi checks incoming mail for signs of payment fraud (for example "we've changed our bank details"). A local check runs first; only when a message trips it is the message text sent to the AI provider to assess the risk, and a supplier's company name may be checked against the UK Companies House public register. The result is only ever a warning banner shown to you — CelEpi never blocks mail or acts on a payment.

Read receipts on mail you send

CelEpi has an optional "read receipts" feature, off by default. When you turn it on, emails you send include a tiny invisible tracking image; when the recipient opens the email, that image loads from our server and CelEpi shows you the message has been read. What we record is the open event (time and message) — it is visible only to you, and it is deleted with your account. If you'd rather not send mail that reports opens back to you, leave the setting off.

How we use your information

We use your information to operate CelEpi: to sign you in, display and send your mail, provide the features you choose, keep the service fast and secure, and respond to you. We do not sell your data and we do not show advertising.

Our lawful bases under UK GDPR are: performing our agreement with you (to provide the service), your consent (for optional features such as AI), and our legitimate interests (to keep the service secure and working well).

Service providers

We rely on a small number of trusted providers to run CelEpi. They process data only on our behalf and under contract:

• Vercel — application hosting.
• Neon — encrypted database.
• Upstash — encrypted cache and backup.
• Google — when you connect a Gmail account.
• Anthropic — AI text features (summaries, drafting, fraud screening), as described above.
• Groq — voice transcription, when you use dictation.
• Companies House — public register lookups of supplier company names during fraud screening.
• ntfy.sh — operational error alerts to the operator (a one-line technical description of a failure; never your message content).
• Your own AI provider — instead of ours, if you add your own API key.

Data retention

We keep your information for as long as your CelEpi account is active. Cached message content expires automatically over time. When you delete your account, we delete your stored credentials, settings, cached data, read-receipt records and any waitlist entry for your address, and revoke CelEpi's access to your Google account; backups and logs are cleared within a short period afterwards. CelEpi never deletes mail held in your own Gmail or IMAP mailbox.

Security

All credentials are encrypted at rest with AES-256-GCM, and traffic is encrypted in transit. Access is limited to what is needed to run the service. No system can be guaranteed perfectly secure, but we work to protect your data and to hold as little of it as possible.

Your rights

Under UK GDPR you have the right to access, correct, delete or export your personal data, and to object to or restrict certain processing. You can delete your account and associated data at any time from Settings, and you can disconnect a mailbox or revoke CelEpi's Google access from your Google account permissions. To exercise any other right, contact hello@celepi.app. You also have the right to complain to the UK Information Commissioner's Office (ICO). Etheria Labs Ltd is registered with the ICO as a fee payer, registration ZC229912.

International transfers

Our providers may process data outside the United Kingdom or European Economic Area. Where they do, appropriate safeguards (such as standard contractual clauses) apply.

Children

CelEpi is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy as CelEpi develops. We will change the "last updated" date above and, for significant changes, let you know in the app.

Contact

CelEpi — operated by Etheria Labs Ltd, a company registered in England and Wales (company no. 16833519). Email hello@celepi.app.