Privacy Policy

Effective date: July 14, 2026
Last updated: October 11, 2026
Policy version: 2.5

1. Scope and identity

This Privacy Policy applies to PressedMail, pressedmail.com, PressedMail Free and Pro, the installed PressedMail WordPress plugin, customer accounts, purchases, licensing, updates, support, newsletters, and related services operated by CurbSoftware Tech Innovations ("CurbSoftware," "we," "us," or "our").

PressedMail is a WordPress email client. This policy covers both information handled by CurbSoftware-operated services and information processed by a customer's own WordPress installation. It does not replace the policies of Google, a customer's hosting provider, payment providers, or an optional AI provider selected by a customer.

2. Responsibility for information

CurbSoftware is responsible for personal information under its control through the PressedMail website, customer accounts, purchases, licensing, support, newsletters, and the PressedMail-operated OAuth relay.

A customer or organization operating a WordPress site normally controls the email accounts and mailbox information processed inside that PressedMail installation. CurbSoftware supplies the software, but the WordPress site owner determines which accounts are connected, who may use the mailbox, which local storage settings apply, and whether optional integrations are enabled. A person whose information appears in a customer's mailbox should normally contact that WordPress site owner about access, correction, export, or deletion of the mailbox information.

CurbSoftware's Privacy Officer is accountable for our privacy program and can be contacted at support@pressedmail.com. CurbSoftware Tech Innovations operates from British Columbia, Canada. A verified business mailing address will be provided in response to a legitimate privacy or regulatory request.

3. Information provided directly

Depending on the services used, we may receive:

• Name, email address, organization, login credentials and account preferences.
• Survey responses, newsletter subscriptions, marketing preferences and consent records.
• Contact-form and support messages, screenshots, logs and diagnostics a person chooses to provide.
• Purchase, billing and tax information described below.
• WordPress site details supplied for licensing, activation, updates or support.

Do not send mailbox content to support unless it is necessary for the support request and you are authorized to disclose it.

4. Website and customer-account information

Our website and account services may process IP address, browser and device type, operating system, referring page, timestamps, login and session records, cookie or local-storage identifiers, account activity, security events and approximate location inferred from IP address. We use this information to operate the site, authenticate users, remember preferences, measure consented website usage, prevent abuse and investigate security or reliability problems.

5. Licensing and plugin information

Depending on the edition and action, licensing and update services may receive a license key, plan, license status, WordPress site URL or domain, activation status, plugin version, WordPress version, PHP version and update-check information. These fields are required when needed to validate a Pro license, allocate site activations, enforce authorized site quotas, detect unauthorized license sharing or resale of activations, provide licensed downloads or determine update compatibility.

PressedMail does not send mailbox content as licensing telemetry. Optional diagnostics are sent to CurbSoftware only when an administrator deliberately includes them in a support request or enables a separately disclosed diagnostic feature.

6. Payments

Payments may be processed by Stripe, BitCart, and crypto payment services or another payment provider shown at checkout. The provider handles full payment-card or wallet credentials under its own policy. CurbSoftware does not store full payment-card numbers.

We may receive and retain customer and transaction identifiers, billing name and address, payment status, tax information, currency and amount, invoice or receipt data, subscription status, limited card details such as brand and last four digits when supplied by the processor, or crypto wallet and network-confirmation details needed for reconciliation and refunds.

7. Mailbox information processed by the WordPress plugin

When a site owner or authorized user connects an email account, PressedMail may process the connected address, account settings, mailbox folders and labels, message headers and metadata, senders, recipients, dates, subjects, message bodies, conversation content, attachments, read or unread state, starred and other flags, drafts, sent messages, archive or trash state, search indexes and synchronization state. PressedMail processes only what is needed for enabled email-client features.

The plugin communicates directly from the customer-controlled WordPress site to the selected mail provider using IMAP and SMTP. Message bodies and attachments do not pass through the PressedMail OAuth relay. Mailbox metadata and synchronization state are stored in the customer's WordPress database. Depending on the user's email-body cache setting, sanitized message bodies may also be stored in that database; when server body persistence is disabled, bodies are retrieved for the active session and cached body rows are removed. Attachments are retrieved from the mail provider when requested and may be temporarily handled by the browser, WordPress, server or hosting caches involved in that request.

An attachment preview follows the same path. When someone opens a preview of an image or PDF, the plugin fetches that file from the mail provider and shows it in their browser. PressedMail does not store the file for the preview, and it does not send the file to CurbSoftware or to any other service.

Google OAuth is available only in PressedMail Pro. PressedMail Free does not include the Google OAuth integration; site owners may connect Gmail to Free using Google's supported app-password flow. Both editions process mailbox data on the customer-controlled WordPress site.

PressedMail includes locally managed contacts and calendar features, but the PressedMail Pro Google OAuth flow does not request or use the Google Contacts API or Google Calendar API. Google contact and calendar permissions are future features and will require updated disclosures and consent before release.

8. OAuth credentials and authentication path

PressedMail never receives or stores a user's Google password.

For the one-click Gmail connection in PressedMail Pro, the customer starts authorization in the plugin and Google displays its consent screen. The authorization callback goes to the PressedMail relay on pressedmail.com. The relay receives the temporary authorization code, exchanges it with Google, verifies the connected Google email identity, and places the access token, refresh token, granted scope, mailbox address, customer site URL and authorization nonce in a service-role-only transfer record. The random browser transfer code is stored only as a SHA-256 hash. The transfer is valid for no more than five minutes, is single-use and is redeemed server-to-server by the originating WordPress site.

After redemption, the PressedMail plugin stores access and refresh tokens encrypted in the customer-controlled WordPress database. Token refresh requests pass directly from the WordPress server through the PressedMail relay to Google over HTTPS; the relay processes the refresh token to complete that request and does not add it to a customer profile or mailbox-content store.

Removing the connected email account from PressedMail deletes the locally stored OAuth credentials and that account's local mailbox mirror. A user may also revoke PressedMail from the third-party connections area of their Google Account. Revocation at Google immediately prevents future token use; already synchronized local data remains under the WordPress site owner's control until it is deleted, purged or the plugin is uninstalled.

9. Google Workspace and Gmail data

This section applies to the Google OAuth connection shipped only in PressedMail Pro. PressedMail Free does not request these Google OAuth permissions.

Google permission requested

The current centralized Google OAuth flow requests openid, email and the restricted Gmail scope https://mail.google.com/. PressedMail does not currently request Google Contacts or Google Calendar scopes. The Gmail scope is used because PressedMail is a full email client that connects through Gmail IMAP and SMTP and lets the authorized user read, compose, send and manage mail.

Google data accessed

After authorization, PressedMail may access:

• The connected Google email address and verified account identity.
• Mailbox folders and labels.
• Message headers, metadata, senders, recipients, dates and subjects.
• Message bodies, conversation content and attachments.
• Read, unread, starred, archived, deleted and other mailbox state.
• Draft and sent-message data.
• OAuth access and refresh tokens and the granted scope.

How Google data is used

Google user data is used only to provide or improve visible PressedMail email-client features chosen by the site owner or authorized mailbox user, including:

• Synchronizing and displaying email.
• Searching, filtering and organizing messages.
• Reading messages and requested attachments.
• Managing folders, labels, flags and mailbox state.
• Creating drafts and sending user-composed messages.
• Archiving, trashing, restoring or permanently deleting messages when the user requests that action.
• Providing optional AI summaries, drafting, rewriting, classification, phishing analysis or tag suggestions when an administrator has enabled the relevant feature.

Google Limited Use commitment

PressedMail's use and transfer of information received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

In particular, Google user data is not:

• Sold, rented or traded.
• Transferred to data brokers, information resellers or advertising platforms.
• Used for personalized advertising, retargeting or interest-based advertising.
• Used to determine creditworthiness or for lending.
• Used for unrelated profiling.
• Used by CurbSoftware to create, train or improve a generalized or foundational artificial-intelligence or machine-learning model.

Transfers are limited to providing a user-facing PressedMail feature with the user's consent, protecting security, complying with applicable law, or a corporate transaction after any explicit prior consent required by Google's policy.

Human access

CurbSoftware personnel do not read Gmail message content. Human access is permitted only when the user gives documented, explicit consent for specific data needed to resolve a support request; when access is necessary to investigate abuse or a security incident; when required by applicable law; or for internal operations using data that has been aggregated and anonymized in accordance with applicable law. Site administrators and other users authorized by the WordPress site owner may access mailbox content according to that site's permissions.

10. Optional AI processing

PressedMail Pro includes optional AI-assisted features. Core email-client functionality does not require AI: mail, contacts and calendar work fully with AI off. An administrator must enable an AI feature before PressedMail offers it to users or runs it on new mail on its own, apart from the Email rules described under Controls and automatic processing. A site-wide Enable AI features switch turns the AI features off in the interface and in automatic processing, and each feature also has its own enable switch, which is off by default. The plugin asks an administrator to confirm once, per provider, before turning on checks of every user's new mail with that provider, and keeps only a fingerprint of that provider. It keeps no other AI consent record.

PressedMail Free does not send email content or email metadata to an AI provider. PressedMail Free contains no AI code. PressedMail Pro AI features are separately distributed.

PressedMail Pro has two AI engines. For each feature that offers a choice, the administrator picks one.

Your own provider (the default engine)

Drafting, replies, rewriting, subject suggestions, summaries and composer suggestions always use the administrator's own provider. Auto-tagging, phishing checks and spam checks use it unless the administrator chooses PressedMail AI. Supported configurations include OpenAI-compatible endpoints, Google Gemini, Anthropic and compatible local or self-hosted endpoints. The default base URL is https://api.openai.com/v1.

These requests are sent directly from the customer's WordPress installation to the administrator-configured provider endpoint using credentials stored encrypted in WordPress. The request does not pass through a CurbSoftware AI proxy and does not use a CurbSoftware-managed model account.

When an authorized user invokes an AI action, or when an enabled automatic check runs, the plugin may send the subject, sender and recipient information, the relevant message body or conversation context, available tags and the user's instructions to the configured provider solely to return the requested result. Drafting and summaries are limited to 10,000 characters of content. Phishing and spam checks send more, because they weigh evidence: a body excerpt of 2,000 to 20,000 characters (an administrator setting, 20,000 by default), up to 12,000 characters of raw message headers, SPF, DKIM and DMARC results, links, each attachment's file name, type and size, and facts the site worked out about the sender, including the findings of its own checks. PressedMail does not send attachment contents or extracted attachment text to the AI provider.

PressedMail AI (optional, uses credits)

For auto-tagging, phishing checks and spam checks only, a Pro administrator can choose PressedMail AI instead of their own provider. It needs a valid license and spends credits. These requests go from the customer's WordPress site to a CurbSoftware service at https://ai.curb.software/v1/pressedmail/, which runs on Cloudflare Workers. That service sends part of the content on to TypeSafe (https://api.typesafe.ai), the company whose AI model produces the answer, using a CurbSoftware account. Drafting, replies, rewriting, subject suggestions, summaries and composer suggestions never use PressedMail AI. They are not sent to CurbSoftware or TypeSafe.

For each email, the site sends CurbSoftware:

• the sender address, sender name and subject;
• an excerpt of the message text with hidden text removed: for auto-tagging, at most 20,000 characters of the newest message; for phishing and spam checks, at most the first 3,000 and last 1,500 characters of the whole message. In the excerpt, email addresses are replaced with [email] and runs of nine or more digits with [number], on a best-effort basis;
• for auto-tagging, each tag's ID, name and description;
• for phishing and spam checks, up to ten links (link text, domain and where the link sits), the sender's domain, the link domains and attachment file names.

For auto-tagging, quoted reply history, signature blocks and confidentiality notices are removed first. Phishing and spam checks send every message whole, including quoted replies, forwarded text, signatures and footers, because a sender can write their own quote markers. With each request the site also sends the license key, site ID, site domain, plugin version and a request ID, so the right credit balance is charged. The site does not send raw headers, SPF, DKIM or DMARC results, recipients, attachment contents, mailbox passwords, sign-in tokens or provider API keys.

While PressedMail AI is chosen, the AI Tools and License screens, an hourly check while credits are exhausted, and an administrator clicking Refresh also read the credit balance from the same service. Those requests carry the license key, site ID, site domain and plugin version and no mail.

CurbSoftware's service sends on only the first 3,000 and last 1,500 characters of the excerpt to TypeSafe. Only the sender address, sender name, subject, that excerpt, the links, the attachment file names and, for tagging, the tags go to TypeSafe. The license key, site ID, site domain and plugin version are not forwarded.

Early test builds of the plugin, from before 1.4.0, use an earlier request format that the service still answers. A site on one of them can send the whole cleaned message (up to 20,000 characters), its SPF, DKIM and DMARC results and a short list of its own findings about the message, and the service passes the excerpt and those results on to TypeSafe in full. Updating the plugin ends this.

CurbSoftware's service stores no message content. Its database holds credit balances, a credit ledger and credit spends, and each spend record is keyed by a one-way SHA-256 hash computed from the account, the request ID and the batch. The hash cannot be turned back into text, and the text itself is not stored. The service writes one usage log line per request with the model name, counts and token numbers, and no message text. Cloudflare may also keep its own request logs for the service, which hold request details such as the sending address and headers but not the body.

TypeSafe's public privacy policy says, as checked on October 10, 2026, that its services are hosted in the United States and that it will not train or fine tune AI or machine learning models on customer prompts or other input. No EU-only processing is currently offered for PressedMail AI, and the service may process content in the United States and elsewhere. These descriptions apply to mail from every connected account, including a Gmail account. Mail from a Gmail account reaches CurbSoftware and TypeSafe only if an administrator has chosen PressedMail AI for a feature.

Controls and automatic processing

Automatic checks of new mail are off by default. Phishing and spam checks run when mail arrives only if the feature is enabled and one of these is true: the administrator has turned the check on for everyone, the user has turned it on for their own mail, or the user has set up an Email rule that runs the check. Auto-tagging on arrival needs the site-wide switch, the administrator's auto-tagging setting, the user's setting, the mailbox's setting and the setting that stores email on the site, unless an Email rule runs the auto-tagger. On a team, an administrator can turn PressedMail AI off for a user, or give them a monthly credit limit, on the Team credits tab.

Summaries, drafts, rewrites and suggested replies are returned for user review and are not sent as email until the user separately approves sending. Classification, security analysis and tag suggestions may be applied automatically only where the site administrator has enabled that behavior. AI output can be incomplete or inaccurate and should not be treated as professional advice or used for consequential decisions without human review.

When an administrator uses their own provider, CurbSoftware does not retain the prompt or response because it does not proxy the request. That provider may log or retain requests under its disclosed retention terms. For Google-originated email data, the site owner must select a provider and account configuration that must not use Google-originated email data to create, train, or improve a generalized or foundational model. The plugin does not ask the administrator to confirm this, so the responsibility rests with the site owner. Disabling an AI feature prevents future requests from that feature but does not erase information already processed by a provider; deletion requests must also be directed to that provider where applicable.

AI provider configurations

PressedMail contacts one of these providers only after the administrator has configured it and enabled the feature, and an authorized user requests an AI feature or an enabled automation runs.

For an arbitrary administrator-supplied endpoint, CurbSoftware cannot identify or control the operator. The administrator must evaluate that operator's terms, retention, security, data location and model-training behavior. The plugin does not ask the administrator to affirm that the provider and account configuration prohibit using Google-originated email data to create, train or improve generalized or foundational AI models, so that duty sits with the site owner. If the site owner cannot be sure of it for a provider, AI should stay disabled for that provider.

11. Purposes of processing

12. Service providers and disclosures

We disclose only the information needed for the described service:

• Google: for PressedMail Pro Google OAuth, account identity, OAuth authorization and Gmail email-client operations requested by the user.
• Customer hosting and WordPress infrastructure: mailbox data, tokens, settings, logs and local plugin records controlled by the site owner.
• Supabase and CurbSoftware hosting infrastructure: website accounts, licensing, PressedMail AI credit balances and ledger entries, and the temporary five-minute OAuth transfer record.
• Cloudflare: runs CurbSoftware's license service at curb.software and its PressedMail AI service at ai.curb.software on Cloudflare Workers, so license requests and PressedMail AI requests pass through its network. It also fronts pressedmail.com.
• Stripe, BitCart and displayed payment providers: checkout, transaction, tax, fraud and refund data.
• Transactional email and support providers: delivery addresses and the content needed to send service notices or respond to support.
• **Listmonk at news.pressedmail.com:** newsletter address, subscription status and consent or suppression records.
• Umami: website analytics events, an account identifier once you are signed in, and associated technical data. Advertising trackers are not used for Google user data.
• The administrator-configured AI provider: only the content required for an enabled AI action, sent directly by the customer's WordPress site. This is the default engine for every AI feature.
• TypeSafe: only when an administrator chooses PressedMail AI for auto-tagging, phishing checks or spam checks. It receives the excerpt and fields described in section 10 from CurbSoftware's PressedMail AI service, not from the customer's site. TypeSafe's privacy policy says it may share input with its own service providers and does not name them.
• Professional advisers, authorities or courts: information required for legal, tax, accounting, security or compliance purposes.

We may disclose business records during a merger, acquisition, financing, restructuring or asset sale, subject to applicable law and any explicit consent required for Google user data.

13. International processing

CurbSoftware operates from Canada. Our providers, customers and connected services may process information in Canada, the United States or other countries where they operate. Information may therefore be subject to the laws and lawful-access rules of those jurisdictions. A WordPress site owner's hosting location and selected AI or mail provider determine where most mailbox processing occurs.

PressedMail AI is the exception. Its requests pass through Cloudflare's network to CurbSoftware's service and on to TypeSafe, whose public privacy policy says its services are hosted in the United States. No EU-only processing is currently offered for PressedMail AI, and the service may process content in the United States and elsewhere. A site owner who needs mail content to stay in a particular region can use their own provider in that region, or leave AI off.

14. Retention and deletion

We limit retention to the period needed for the identified purpose, applicable law, security, accounting, fraud prevention and dispute resolution. The following criteria apply:

Deleting a PressedMail website profile does not delete data controlled by an independently operated WordPress site. Removing an email account from the plugin deletes its locally stored credentials and local mailbox mirror. Uninstalling the plugin always deletes locally stored PressedMail data; deactivation preserves it.

15. Security

Safeguards include HTTPS for external transfers, encrypted storage for OAuth and AI credentials in the WordPress plugin, restricted service-role access to temporary OAuth transfer records, hashed one-time transfer codes, single-use and expiry controls, authorization and capability checks, administrative access restrictions, logging, backups, dependency and security review, and incident-response procedures.

No service can guarantee absolute security. WordPress site owners are responsible for securing their hosting, WordPress administrators, databases, backups and connected provider accounts.

16. User choices and controls

Users and administrators can:

• Decline Google authorization and use another supported connection method, including the Gmail app-password connection available in PressedMail Free, where available.
• Remove a connected Google email account in PressedMail to delete its local credentials and mailbox mirror.
• Revoke PressedMail access from the Google Account third-party connections page.
• Disable synchronization or email-body persistence and clear locally cached bodies.
• Delete messages or attachments through the connected mailbox, subject to the mail provider's behavior.
• Turn the AI features off in the interface and in automatic processing with the site-wide Enable AI features switch, or enable and disable each AI feature separately. Each feature is off by default, and mail, contacts and calendar work fully with AI off.
• Choose, for auto-tagging, phishing checks and spam checks, whether they use your own provider or PressedMail AI, and reconfigure or remove the locally stored provider key.
• Choose a local or self-hosted AI endpoint where supported.
• Turn PressedMail AI off for a user, or set a monthly credit limit for them, on the Team credits tab.
• Leave automatic checks of new mail off, which is the default.
• Uninstall PressedMail to remove its locally stored plugin data; deactivation alone preserves that data.
• Request a WordPress personal-data export for locally stored PressedMail records. Credentials, passwords, access tokens, refresh tokens, API keys and encrypted provider configuration are excluded from the export.
• Request WordPress personal-data erasure to remove locally owned PressedMail accounts, mailbox mirrors, preferences and related plugin records. This local erasure does not delete messages from the remote mail provider and does not delete the WordPress user account.
• Reject optional website analytics cookies or change browser storage settings.
• Unsubscribe from marketing email using the link in each message.

17. Privacy rights and complaints

Depending on location and applicable law, a person may have privacy rights to request access, correction, deletion, portability, restriction, objection or withdrawal of consent for personal information controlled by CurbSoftware. Contact the Privacy Officer at support@pressedmail.com. We respond to verifiable privacy requests within 30 days or statutory timeframes. We may need to verify identity before processing a request, and we may retain certain records where legally required for tax, accounting, or fraud prevention obligations.

For mailbox data controlled by a customer's WordPress site, contact that site owner first. CurbSoftware generally cannot access or delete content held only on an independent WordPress installation.

Where supported by the site owner, WordPress personal-data export and erasure tools provide access to or deletion of local PressedMail records. They do not reach into Google, Microsoft, another mail provider, or an AI provider. Requests for data retained by those providers must be directed to the applicable provider.

Canadian users may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. We will investigate privacy complaints and explain the outcome or available escalation route.

18. Cookies, analytics and marketing

Essential cookies and local storage support authentication, security, checkout, consent preferences and required website operation.

Umami browser analytics loads only after you accept optional cookies, on public signed-out pages. It sets no cookies and stores no persistent tracking identifier of its own. It records page views and product interactions and honours Do Not Track and Global Privacy Control. Cookie settings in the footer lets you change or withdraw consent. First-party attribution stores campaign summaries and permitted ad click references for up to 30 days. Confirmed checkout, purchase and license-activation events may be measured separately on our servers using eligible saved attribution. Optional advertising adapters, including OpenAI, may receive ad click references, event timestamps and actual purchase amounts and currencies. These analytics payloads never include email addresses, raw account identifiers, mailbox contents, contacts or credentials. We do not enable advanced matching automatically. PressedMail does not use Google user data for advertising.

For details, see the Cookie Policy. Newsletter and marketing messages are sent with consent or another lawful basis, identify the sender and include a working unsubscribe method. We retain the minimum suppression record needed to prevent further marketing after an opt-out.

19. Children

PressedMail is a business and professional WordPress administration product and is not directed to children under 16. We do not knowingly create customer accounts for children under 16. Contact the Privacy Officer if you believe a child has provided personal information to CurbSoftware.

20. Security incidents

We maintain procedures to assess, contain, document and respond to security incidents involving information under CurbSoftware's control. We will notify affected individuals and regulators where required by law. Under PIPEDA, this can include reporting and notification when a breach of safeguards creates a real risk of significant harm.

For a security incident involving Google user data, CurbSoftware will notify Google at security@google.com before making public statements where the Google Workspace API User Data and Developer Policy requires that notice, and will cooperate with any requested investigation or audit.

A WordPress site owner remains responsible for incident duties relating to information under that site's control, including incidents involving its hosting, administrators or local PressedMail database.

21. Policy changes

We may update this policy as PressedMail, its providers or legal requirements change. The current version and update date will remain at https://pressedmail.com/privacy. Material changes will be communicated through the website, account service, plugin or direct notice as appropriate. We will obtain renewed consent before using Google user data for a materially different purpose where required.

22. Contact

Privacy questions, rights requests and complaints may be sent to:

• Privacy Officer
• CurbSoftware Tech Innovations
• British Columbia, Canada
• Email: support@pressedmail.com
• Web: PressedMail Contact

People whose information exists only in a customer's mailbox should contact that WordPress site owner. CurbSoftware will assist with information under its control and explain when a request must be directed elsewhere.