FiloMail

GDPR overview

FiloMail's privacy policy names the GDPR and UK GDPR and cites its legal bases: contract, legitimate interests and consent. Articles 15 to 20 are named for access, correction, export and deletion, with a stated 30-day response time and the right to complain to a local supervisory authority. Transfers outside the EU rely on Standard Contractual Clauses and the UK IDTA, which matters because nothing is hosted in the EEA or the UK: European users' data is processed in the United States. Regulators are notified within 72 hours where applicable, and consent is collected before optional analytics or marketing cookies where law requires it. Three things are missing: no Article 27 representative is designated, no Data Protection Officer is named (requests go to support@filomail.com), and no Data Processing Agreement is published. The terms promise a maintained sub-processor list, but no such list is reachable from the site.

Who owns the data?

FiloMail's privacy policy splits the publisher's role in two: FILO AI PTE. LTD. is controller for account data, telemetry, website analytics, security records and billing, and processor for connected-app content, which it handles on the user's instructions. Trademarks and the content of the service remain the property of Filo or its licensors, with users granted a non-exclusive, non-transferable license to use it. Ideas and feedback sent to the team grant Filo a worldwide, perpetual, irrevocable and royalty-free license. Sharing is limited to contractually bound providers, legal obligations and business transfers such as a merger or acquisition. Filo states that it does not sell personal information and never uses it for advertising.

Reuse rights

Users keep control of what they put into FiloMail and of what it produces. Summaries, drafts, to-dos and memories are kept only to power the features and can be removed at any time through Settings > Filo Account > Delete Account, or mailbox by mailbox through Settings > Mailboxes > Remove. GDPR articles 15 to 20 give access, correction, export and deletion rights, with a stated 30-day response time. AI drafts are meant to be reviewed and edited before sending, and the terms place no restriction on reusing the resulting text: a summary, a reply or a translation can be sent, published or reused without asking permission. The limits sit elsewhere. Model outputs may not be used to build malware, spam or fraud under section 3.1 of the terms, and the license to use the service itself is non-exclusive and non-transferable, so copying, modifying or building derivative works from FiloMail requires written agreement.

Data retention & training

Hosting summary

FiloMail's core production infrastructure runs on Amazon Web Services, with the United States as the primary region. Nothing is hosted or stored in the EEA or the UK, so data belonging to European and UK users is transferred to and processed in the United States, under Standard Contractual Clauses and the UK IDTA addendum. The publisher is FILO AI PTE. LTD., and the terms of service place the contract under Singapore law and jurisdiction. The technical measures named are TLS 1.3 in transit, AES-256 at rest, key management through AWS KMS, least-privilege access with IAM, network segmentation, service isolation and logging of sensitive access. AWS is cited as holding recognized certifications: ISO/IEC 27001, SOC reports and PCI DSS for the relevant services. FiloMail itself is CASA Tier 3 verified by Google for restricted Gmail scopes. Third-party providers are involved for payment, analytics, diagnostics, connected apps and the AI features. The terms of service state that a sub-processor list is maintained with a change log, but no such list is reachable from the site, so the identity of those providers is not public.