• Account data. Your email address, name, workspace details, and billing information needed to operate your account.
• Email content processed on your behalf. Messages sent to and from your agent inboxes — bodies, headers, and attachment metadata — which we must process to route, store, and deliver mail. HermesAgentMail is not a zero-knowledge system.
• Usage metrics. Inbound and outbound message counts, API request logs, and webhook delivery records used for quotas, rate limits, and audit logs.

• Message bodies are encrypted at rest with application-layer AES-256-GCM, and all traffic is encrypted in transit.
• Workspaces are isolated with Postgres row-level security, so one workspace can never read another workspace’s mail.
• Sensitive actions are recorded in audit logs, and webhook deliveries are HMAC-signed so you can verify they came from us.
• We never sell email data, and we never train public models on customer email.

Stored messages are retained for the window included in your plan, after which they are deleted from live systems.

We rely on a small set of infrastructure providers to run the service. Each processes data only as needed to provide their function.

• Vercel. Application hosting and edge network.
• Supabase. Postgres database and authentication.
• Resend. Inbound email receiving and outbound email delivery.
• Stripe. Subscription billing and payments.

You can request an export of your workspace data or the deletion of your account and stored messages at any time by contacting support. We honor deletion requests promptly and confirm when they are complete.

Contact support@hermesagentmail.com for export and deletion requests.

Questions about this policy or how we handle data? Email privacy@hermesagentmail.com.