MailGuard privacy policy

Who operates MailGuard

The current operator is Denis Iana, using the SecOpsLife name. Contact: mailguard@secopslife.ro. No incorporated company, certification or appointed data protection officer is asserted in this draft.

Data in the Gmail reporting flow

1. Your verified Google email address and account identifier, account approval and identity-binding records.
2. The original email you choose to report: sender and recipient fields, subject, message body, headers, attachments and embedded URLs.
3. Derived investigation data, such as extracted domains, attachment names and hashes, report references, verdicts and analyst comments.
4. Operational records needed to authorize and process reports, enforce limits, investigate errors and audit access. Network providers also handle connection and request metadata.

Why the data is used

MailGuard uses reported data to preserve the selected evidence, let authorized security analysts investigate it, return a verdict and support safe operation of the reporting service.

Choosing Report to MailGuard asks SecOpsLife’s security team to review that specific message. It is not permission to read unrelated mailbox contents. We do not automatically import the Inbox or collect the Google password.

Who can access it

The authorized operator and security analysts can inspect the reported original, attachments and derived findings for the investigation. Access is subject to application authorization and client separation.

Google supplies account authentication and selected-message access. Cloudflare carries the reporting traffic. SecOpsLife-operated infrastructure processes and stores the evidence. Microsoft handles notification sending, including the reporter’s address, report details and public verdict comment. Vercel hosts the public website; it is separate from the evidence store.

Analyst-initiated external reputation checks can disclose an attachment’s SHA-256 hash or a base domain to configured lookup providers, such as CIRCL hashlookup or domain-registration services. The implemented lookup adapters do not upload the email original, attachment bytes or full URL paths for scanning. Applicable providers and the client disclosure policy must be confirmed before enabling them for external clients.

Google data and permitted use

MailGuard’s use and transfer of information received from Google APIs must follow the Google API Services User Data Policy, including its Limited Use requirements.

The policy for this release prohibits sale of reported data, advertising or data-broker use, and training general-purpose AI models on reports. The current release does not provide AI investigation. A future feature that changes data use requires a separate disclosure and authorization review.

How evidence is protected

Reporting uses HTTPS. Stored original email objects are encrypted by the application, and access to the analyst console is restricted. These measures reduce risk; they do not guarantee that unauthorized access or loss is impossible.

Traffic passes through service providers. This is not an end-to-end encryption claim, and encryption of originals does not mean every database field or operational log is separately encrypted.

Retention and deletion — decision required

Current behavior: reporting preserves evidence and does not automatically delete it when a case is closed, the add-on is removed or Google access is revoked.

Before this notice can become effective, the operator must approve retention periods or meaningful criteria separately for originals and attachments, case metadata, approvals and identity bindings, audit records, notification records and backups. There is no approved deletion schedule in this draft.

A verified request and an authorized deletion workflow must cover retained copies and backups, including justified exceptions and the treatment of a later restore. No fixed deletion deadline or automatic erasure is promised by this draft.

Your requests

Contact mailguard@secopslife.ro to ask about your data, obtain access, request correction or deletion, withdraw permission, or ask to restrict or object to processing where applicable. Requests require appropriate identity verification.

You can uninstall MailGuard and revoke Google authorization. This stops future authorized access but does not itself erase evidence already submitted. Applicable rights and the option to complain to a supervisory authority must be set out in the approved notice.

Before this draft can be published

This page is intentionally a review draft. It is not ready to submit as the effective Google privacy policy.

1. Confirm the operator’s legal role and contact details, the legal basis for each processing purpose, and handling of third-party or sensitive information in a report.
2. Approve and implement the category-specific retention, erasure and backup-expiry process.
3. Confirm actual processing locations, provider roles and safeguards for any international transfers.
4. Confirm the rights-request, incident and policy-change procedures, and add the applicable supervisory-authority contact.

• Contact the operator ↗