מדיניות פרטיות — Mailo

Privacy Policy — Mailo (English)

Mailo is a product of Vamos Investments Ltd. (Hebrew: וומוס אינווסטמנטס בע"מ), a company registered in Israel, company number 516891967, of Shlomzion HaMalka, Jerusalem. The company is the data controller for the information described in this policy.

Mailo is a financial workspace for small businesses. When you connect Gmail, Mailo requests read-only access (gmail.readonly). Mailo reads message details (such as identifiers, sender, subject, and date), message content and structure, and attachments only as needed to identify and import supported business documents, perform the initial sync, process new mail, and recover missed syncs. Mailo does not send, delete, label, or modify messages or labels in your mailbox.

Mailo stores only business documents selected for import, source metadata, and accounting data derived from them; it does not persist full Gmail message bodies or short-lived access tokens. The refresh token is encrypted on the server and isolated by workspace. Disconnecting stops the Gmail watch, removes stored authorization credentials, and attempts to revoke them with Google. Previously imported documents and derived accounting records are not automatically deleted on disconnect; they remain subject to the deletion and legal-retention rules below.

Limited Use: Mailo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is never sold, never used for advertising, and never read by humans except with your explicit consent, for security purposes, or as required by law.

Stored data includes imported business-document attachments, source metadata (including message and attachment identifiers, sender, subject, and date), extracted accounting fields, documents you issue, customer/supplier records you enter, and your business profile. Authorization controls and database Row-Level Security isolate workspaces, and relevant activity is audited.

When you set up a business, Mailo collects your first and last name, email address, phone number, and whether you own the business or act for it — to know who we work with and to contact you about the account. The email address is confirmed with a one-time code that is stored only as a hash, expires after ten minutes and is never written to logs. Confirming an email proves control of that mailbox only; it is not identity verification and not proof of business ownership.

If you ask to issue official documents, a person on the Mailo team reviews the business details before issuing is enabled, and may ask for an ID number and/or a business registration document. The ID number is stored encrypted and only ever displayed masked; verification documents are stored separately from accounting documents, are not machine-read and are not used for learning. A business that does not ask to issue is not asked for this information. Verification decisions — who made them and on what basis — are kept in a log that cannot be edited and are deleted with the workspace. None of these personal details are shared between businesses or included in the shared knowledge Mailo learns.

Issued accounting documents are retained per Israeli record-keeping law (at least 7 years). Collected documents can be archived and deleted. During the beta, contact us to request deletion of Google data, an account, or a workspace; data will be deleted or anonymized unless continued retention is legally required.

Mailo does not sell Google user data or use it for advertising. Data is transferred only to infrastructure processors acting for Mailo where necessary to provide or secure the service, where legally required, or at your direction (for example, sharing an imported document with an accountant you invited). Human access to Google user data is limited to cases permitted by the Limited Use requirements.

Contact, privacy requests and exercising your rights: ronen1774@gmail.com