1. Who we are
Sunup Mail is operated by Yangzhou Lu (卢洋洲), an individual based in Foshan, Guangdong, China, assisted by technical support personnel subject to confidentiality and data-processing obligations. Contact us at support@sunupmail.com.
This policy covers the Sunup Mail website, Chrome extension and supporting cloud services. Sunup Mail is intended for users aged 18 or older. If you believe we have collected a minor's personal information, contact us. We will investigate and take action under applicable law, including deletion where required.
2. Information we process and why
Website signups and support. We process the email address, messages, optional survey responses and support correspondence you provide to arrange access, deliver notifications you choose and respond to you. Signing up on our website does not grant access to Gmail.
Local email features. The extension processes email within Gmail and through interfaces you authorize. It stores account-specific email indexes, reading caches, contacts, categories, rules, notes, projects and preferences in your browser to provide organization and reading features. The website and extension use browser local storage for necessary preferences and feature state. Clearing local storage may reset settings and does not automatically delete cloud data.
Gmail and cloud AI. When you choose and authorize these features, we process relevant message identifiers, subjects, senders and recipients, dates, labels, snippets, bodies, conversations, and attachment names, types and sizes. The cloud stores the mail copies, AI inputs and outputs, contact relationships, tasks and settings needed for selected features, including categorization, summaries, reminders, search, maps, reading and reply assistance. Processing is not limited to the email currently open.
AI requests may include related emails and conversation context, drafts, selected text and writing instructions. Ordinary text AI requests do not send attachment file contents. The reader may retrieve and cache email HTML and inline images. If you choose to load external images, the image host may receive the corresponding network requests. You review AI reply suggestions and decide whether to send an email.
Accounts, operation and security. We process email verification, login and device credentials, Google authorization tokens, consent records, subscription and quota status, and necessary network request, operational and diagnostic information to verify accounts, provide features, troubleshoot and prevent abuse. Network information may include IP addresses, status and timing. Diagnostics primarily contain redacted operation, status and error metadata. Local diagnostic uploads are off by default and may be enabled through support configuration. Google authorization tokens are not sent to AI providers.
3. Authorization and controls
Relevant Gmail features request the gmail.modify scope to support reading, organizing, drafts and sending. Google authorization, consent to cloud AI and storage, and background offline authorization are managed separately. Authorized background tasks may continue processing email after your browser closes.
We provide disclosures and request consent before the relevant processing starts. You can decline or withdraw consent, stop relevant tasks or request deletion. Turning off AI, signing out, pausing synchronization, uninstalling the extension or only revoking Google access does not delete information already stored.
Depending on applicable law, we process information based on your consent, the need to provide services you request, necessary interests in operating and securing the service, and legal requirements. Google data remains subject to the additional limits in Section 5.
4. Service providers, AI and international processing
We use Alibaba Cloud services in the United States for our backend and database, Netlify to host the website and receive signup forms, and Resend to send verification codes and other account emails. Website forms may send email notifications to the operator.
Depending on the AI feature and service configuration, email content, context and related metadata needed to fulfill a request may be processed by Alibaba Cloud Model Studio (Qwen), Volcengine Ark / BytePlus ModelArk (Doubao), OpenAI (GPT), Google (Gemini commercial API services), and Anthropic (Claude commercial API services).
Requests are routed by feature and configuration; each email is not necessarily sent to all providers. A fallback after a failed request may send necessary input to more than one provider in sequence. Some features or providers may be unavailable because of regional, age or other applicable conditions.
We use only commercial API arrangements whose applicable terms prohibit using customer email and related derived data to train or improve general-purpose models. We do not enable training permissions, training-data sharing or training incentive programs for this data. No training does not mean zero retention: providers may retain requests, outputs or limited records to provide the features used, perform necessary security and abuse monitoring, or meet legal requirements. We do not promise uniform zero retention or a single retention period across providers.
Providers process data only as necessary to perform their services and as permitted by law and Google's policies. We may also disclose relevant information where legally required or necessary for security, fraud prevention or protecting legal rights, always subject to the applicable Google data-use restrictions.
Our backend and database are in the United States, and our operator and technical support personnel are in China. AI providers and their subprocessors may process data in China, the United States, Singapore or other applicable service regions, so data may cross national borders. We take necessary data-protection and international-transfer measures under applicable law. We do not represent that all processing takes place exclusively in the United States.
5. Google data and model-training restrictions
Sunup Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace user data and developer policy. Our handling of extension user data also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.
We do not sell or rent personal data or use Google user data for advertising. We do not use your Gmail data or related derived data to train or improve general-purpose AI models, and we do not allow AI providers processing this data on our behalf to do so. De-identification or anonymization does not remove these restrictions.
Human access to Google user data is limited to your explicit agreement to access specific data, necessary security investigations, legal requirements, and other circumstances permitted by Google's policies. Being a technical support provider does not itself authorize unrestricted access to your emails.
6. Retention, protection and deletion
We retain information only as needed to provide features you choose, fulfill requests, perform necessary security processing or meet legal requirements. We consider whether the purpose continues, the nature and sensitivity of the data, your authorization and deletion choices, and applicable legal requirements.
Mail copies, AI outputs and related settings are retained as needed to continue providing selected features, until no longer needed or removed in response to your deletion request. Reading caches support temporary access and are handled through cache-validity and cleanup mechanisms; this does not impose one retention period on all service emails. Operational, diagnostic, security and usage records are retained only for their respective operational, security and reconciliation needs. Signup and support records are retained as needed to arrange access, provide notifications or resolve requests. You can unsubscribe from relevant notifications or request deletion.
After an account-deletion request, we stop relevant processing, invalidate corresponding credentials and use background processing to remove account and linked data from active service systems we control, retrying failures. Tokens temporarily retained in encrypted form to revoke Google access are used only for revocation. After processing ends, minimal deletion receipts and identifiers preventing continued use of old credentials are generally retained for 30 days. Records necessary to complete pending requests remain until that work is done. See Data Deletion.
Backups, necessary provider records and offline-device copies may take longer to clear. Backups expire through applicable rotation or secure deletion, with remaining copies restricted to necessary recovery, security and legal purposes. If a restoration includes data for a deleted account, we apply the relevant deletion requests to prevent renewed use in normal service. Legally required records are retained only to the extent needed for that obligation.
We use HTTPS, server-side encryption and access restrictions to protect information. Sensitive backend database fields, including email bodies, AI request records and Google tokens, use server-side encryption. Local data is held in browser extension storage. The server can decrypt content needed to provide features; this is not end-to-end encryption. No safeguards guarantee absolute security. We provide incident notifications where required by applicable law.
7. Your requests
Request deletion in the extension under Management/Configuration → System configuration → Disconnect authorization and delete data, including after your subscription expires. If you cannot use this option, contact support@sunupmail.com. Full account deletion covers all mailboxes linked to that Sunup Mail account and does not delete original Gmail messages, drafts or labels.
Depending on applicable law, you may request access, a copy, correction or deletion of personal data, withdraw consent, or restrict or object to relevant processing. Withdrawal does not affect lawful processing based on consent before withdrawal. We verify account ownership, handle requests under applicable law and explain progress or retention reasons where needed. Applicable law may also give you the right to complain to a supervisory authority. Support will not ask you to disclose Google passwords, authorization tokens or verification codes.
8. Notices and policy updates
We may send necessary notices about major versions, privacy, security and service changes. Marketing messages require a separate subscription and provide an unsubscribe option.
We update this policy and its date on this page. For material changes to data uses or recipients, we provide necessary notice and obtain renewed consent where required before starting the new processing.