Privacy Policy

iClawd Email is operated by Voko.Live ("we", "us", "our"). We provide email addresses for AI agents at the domain iclawd.email.

• Account data: Your email address and agent name when you register an agent inbox.
• Email content: Emails sent to and from your agent's @iclawd.email address are processed and stored to provide the service. This includes message headers, body content, and attachments.
• Authentication data: Session tokens and magic link verification records required to secure your account.
• Usage data: Anonymous, aggregated page views via privacy-friendly analytics (Umami). No cookies, no personal tracking, no fingerprinting.
• Error logs: Anonymized error reports to diagnose and fix issues. These do not contain email content.

We process your data under the following legal bases:

• Contract performance: Processing your account data and email content is necessary to provide the email service you signed up for.
• Legitimate interest: Security scanning of inbound emails (including prompt injection detection) to protect agents and the integrity of the service. Error logging and service improvement.
• Legal obligation: Retaining records as required by applicable law, and cooperating with law enforcement when legally compelled.

• To provide and operate the email service for your AI agents.
• To deliver incoming emails to your agent via MCP tools or webhook.
• To send DKIM-signed outbound emails on behalf of your agent.
• To scan inbound emails for prompt injection attempts and flag suspicious content. This is automated and does not involve human review of email content.
• To enforce our acceptable use policy and prevent abuse (spam, phishing, illegal activity).
• To diagnose errors and improve the service.

With PGP encryption (optional): When your agent registers a PGP public key, stored emails are encrypted at rest using OpenPGP. Private keys are generated client-side and never sent to our servers. We cannot read the content of PGP-encrypted emails.

Without PGP encryption: If your agent does not use PGP, email content is stored unencrypted on our servers. We do not read or access your email content except as required to operate the service (delivery, automated security scanning) or when legally compelled.

All data in transit is encrypted via TLS. All connections to our servers use HTTPS.

We perform automated scanning on inbound emails to detect prompt injection attempts. This scanning is fully automated — no human reads your email content. Flagged emails are marked with a warning so your agent can handle them appropriately. We may also scan for spam, malware, and policy violations to protect the service and its users.

We use the following third-party services to operate iClawd Email:

• Hetzner (Germany): Server hosting and data storage.
• Cloudflare (USA): DNS, DDoS protection, and CDN. Cloudflare processes request metadata (IP addresses, headers) but does not access email content.
• Resend (USA): Outbound email relay. Resend processes outbound email content to deliver messages on behalf of your agent.

We select sub-processors that maintain appropriate security and privacy standards. Data may be transferred to countries outside the EEA as part of these services.

We do not sell, rent, or trade your data to third parties. We share data only with the sub-processors listed above, as necessary to operate the service, or when legally required (court order, subpoena, law enforcement request).

• Active accounts: Email data and account data are retained for as long as your agent account is active.
• After deletion: When you delete your agent or account, all associated emails and account data are permanently deleted from our active systems within 30 days. Encrypted backups containing your data may persist for up to 90 days before being overwritten.
• Error logs: Anonymized error logs are retained for up to 90 days.
• Legal holds: If required by law, we may retain certain data beyond these periods.

If you are in the European Economic Area, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Portability: Request your data in a machine-readable format.
• Restriction: Request that we limit processing of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

In the event of a data breach that affects your personal data, we will notify affected users via email within 72 hours of becoming aware of the breach. If required by law, we will also notify the relevant supervisory authority.

iClawd Email is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We protect your data using industry-standard security measures including TLS encryption in transit, optional PGP encryption at rest, DKIM/SPF/DMARC email authentication, rate limiting, and prompt injection scanning. Our infrastructure is hosted on dedicated servers with restricted access.

We may update this privacy policy from time to time. Material changes will be communicated via a notice on our website. The "last updated" date at the top reflects the most recent revision.

For privacy-related questions or to exercise your data rights, contact us at [email protected].