Privacy Policy

Last updated: 11 October 2026

This policy covers the Gesand website, account service and desktop email client, including connected Gmail and Outlook mailboxes and the AI assistant.

Who is responsible

Burzinski & Jaenisch GbR, Burgunder Str. 1, 14197 Berlin, Germany, represented by Jan Burzinski and Benoît Jaenisch. For privacy questions and data requests, write to info@bejanic.de.

Account and connection data

We process your account name, email address, sign-in credentials or provider identity, sessions, connected mailbox details, organization membership and invitations to provide account access and administration. Mailbox access credentials are stored encrypted on the server and are not passed to the desktop app window. Organization administrators manage membership; membership does not give them access to another user's private mailbox.

Connecting a mailbox grants the permissions shown by Google or Microsoft. Google access can include Gmail messages and calendar events. Outlook access can include messages, sending, mailbox settings and calendar events. We use these permissions for synchronization, reading, composing, sending, organizing mail and calendar features. You can revoke access through your provider or disconnect the mailbox in Gesand. Without access, the associated features cannot work.

Web sign-in uses necessary session cookies. The desktop main process owns the authenticated session; session cookies and provider tokens are not exposed to the app window.

Mail, calendar and local storage

Gesand processes messages, sender and recipient details, subjects, labels or folders, timestamps, bodies, attachments and calendar data from the accounts you connect. This can include personal data about people who correspond with you. Cloud synchronization continues while the desktop app is closed. Server storage holds account records, mailbox indexes, synchronized mail content and attachments, drafts, pending mail operations and assistant data.

The desktop app keeps downloaded messages and attachments in its local library so they can be read offline. Signing out locks access to that library but preserves its data. Removing the application alone does not necessarily remove its local data directory or cloud records.

When you read a message, the desktop app loads its images through our servers. Senders see our server instead of your IP address, device or cookies. Common invisible tracking images are not loaded. Images are not saved to your account.

AI and speech features

AI features process relevant mail content, user instructions, assistant conversations, selected or uploaded files and saved memories. This supports the assistant, writing help, mail classification, event detection and configured routines. Some processing runs in the background. Assistant messages and uploaded chat files are stored separately from a connected mailbox; saved memories can include mailbox-specific information and account-wide preferences.

Model inference uses Vercel AI Gateway, which routes to model providers. Configured models include OpenAI, Anthropic and Google models; the serving provider can vary with routing. Model requests ask for zero data retention and, where configured, EU inference endpoints. These request controls depend on the provider's available service and enforcement. They do not describe retention of your Gesand chat history, billing records or operational metadata. See Vercel's explanation.

Dictation sends audio to Deepgram's EU speech endpoint with its model-improvement opt-out enabled. Transcripts may then be processed by the writing assistant or saved in the text you compose. See Deepgram's opt-out policy. Web search and page retrieval can send queries or requested URLs to Parallel and Browserbase through AI Gateway. Gesand's tool approval checks restrict disclosure of private mailbox data through these tools.

Services that process data

Cloudflare runs the website and API, synchronization actors, queues and workflows, private R2 mail and chat-file storage, Artifacts memory repositories, transactional email and app update delivery.
PlanetScale provides the PostgreSQL database in Frankfurt, accessed through Cloudflare Hyperdrive. This database location does not determine the location of the other services.
Google and Microsoft provide account authorization, mail and calendar APIs.
Vercel AI Gateway and its serving providers process model requests. Deepgram processes dictation; Parallel and Browserbase handle the web tools described above.

Data processing locations depend on the service. An EU database or inference endpoint does not place all service operations, support, billing or metadata within the EU. Providers may process data in other countries, including the United States. Contact us for information about the recipients and transfer safeguards applicable to your data.

Service logs and product telemetry

Hosting and account services process connection information such as IP addresses, request times and authentication or error events for delivery, abuse prevention and troubleshooting. Gesand's structured AI logs record model identifiers, timings, token counts and outcomes rather than prompt or response content. Requests for desktop updates disclose connection information to the update host.

The public website uses Databuddy in production to measure page visits, performance, JavaScript errors and clicks on links to other sites. Its tracker sends page and referrer information and visitor and session identifiers, and uses browser storage. Requests also disclose IP addresses and browser headers to Databuddy. This public website analytics is separate from the optional collection in the account web app and desktop client. See Databuddy's data policy.

In the account web app, optional page-visit collection through Databuddy is off by default. You can enable or disable it through Privacy. Your choice is saved in this browser, separately from desktop settings. Collection uses temporary visitor and session identifiers without linking your app account, masks private paths and excludes URL parameters, referrers, form values and error reports. It respects Do Not Track and Global Privacy Control. Requests disclose your IP address and browser headers to Databuddy.

The desktop client offers separate usage-sharing and error-reporting choices in Privacy. Both are off by default and saved for your app account on this device. When configured and enabled, PostHog receives app starts, selected completed actions or technical error types and application code locations. Usage sharing links events to an identifier derived from your app account and permits feature-flag evaluation. With only error reporting enabled, reports use a temporary identifier and are not linked to your app account. Mail content, attachments, error messages and screen recordings are excluded. Disabling a choice stops that collection; signing out stops collection for the signed-out account. Requests disclose connection information to PostHog. See PostHog's privacy policy.

Purposes and legal bases

Account access, synchronization and requested mail and assistant features serve the provision of Gesand under Article 6(1)(b) GDPR. Service security and troubleshooting serve our legitimate interest in reliable, secure operation under Article 6(1)(f). Where processing requires your consent, Article 6(1)(a) applies and you may withdraw it. Mandatory legal obligations are covered by Article 6(1)(c). Account information and provider permissions are needed for the corresponding service; you do not have to connect every account or use speech and web tools.

Google API data and Limited Use

Gesand's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google Workspace data is used for the user-facing mail and productivity features described here. It is not sold, used for advertising or used to train general-purpose AI models. Human access to this data is limited to the circumstances permitted by that policy, such as your affirmative agreement to access specific data, necessary security investigations or legal obligations.

Retention and deletion

Connected mailbox content is retained to support synchronization and the local library. Disconnecting stops cloud synchronization, removes the connection credentials and starts background deletion of stored mailbox content and mailbox-specific memories. Cleanup is asynchronous and can take longer if a service is unavailable. It does not delete mail from Gmail or Outlook. Revoking access at the provider alone does not submit a Gesand data-deletion request.

Account records, assistant chats, uploaded chat files, account-wide memories and routine data remain separate from mailbox disconnection. To request deletion of these records or your account, contact info@bejanic.de. Retention is determined by the active service, pending operations, necessary security troubleshooting and applicable legal obligations. Provider logs and backup copies follow their separate retention schedules; mailbox disconnection does not promise their immediate removal.

Your rights

Subject to the GDPR's conditions, you can request access, correction, deletion, restriction and portability of your personal data, object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. Use the contact address above; we may need to verify your identity. You can complain to a data protection supervisory authority, including the Berlin Commissioner for Data Protection. These rights also apply if your data appears in someone else's connected correspondence.

AI classifications and generated suggestions support mail workflows. Gesand does not use them to make decisions about credit, employment or other similarly significant matters. Review generated text and configured mail actions before relying on them.

Changes

We update this page when Gesand's data processing changes. The date above identifies this version.