Privacy Policy

Last updated: June 20, 2026

This Privacy Policy explains how Mylo Prime LLC, a Utah limited liability company ("Maili", "we", "us", "our") collects, uses, shares, and protects information when you use the Maili mobile application (the "App"), our website at maili.ai (the "Site"), and related services (together, the "Services").

Maili is an iPhone-first AI executive assistant. It helps you plan your day, manage your inbox and calendar, capture meetings, and draft communications. A core principle governs everything Maili does: Maili proposes; you approve. Maili drafts and proposes outward actions (emails, texts, calls, calendar invites, payments) and never sends, transmits, schedules, or pays without your explicit, per-action confirmation.

1. Who we are and what this policy covers

The Maili App and Site are operated by Mylo Prime LLC, a Utah limited liability company. References to "Maili," "we," "us," or "our" mean Mylo Prime LLC. Our mailing address and contact details are in the Contact us section below.

This policy applies to all personal information we collect through the App, the Site, and our customer support channels. It does not cover the practices of third parties we do not control, including Apple, Google, and any websites or services you reach through links in our Services. Those third parties have their own privacy policies.

This policy works together with our Terms of Service and our Subscription and Auto-Renewal Terms.

2. A note on where we offer the Services

Maili is offered to users in the United States. We do not currently offer the Services in the European Economic Area (EEA) or the United Kingdom, and the Services are not directed to individuals located there. Because of this, this policy does not carry the full set of disclosures and mechanisms required by the EU General Data Protection Regulation (GDPR) or the UK GDPR. If we expand to those regions in the future, we will update this policy and provide the additional disclosures and rights those laws require before doing so.

3. Information we collect

We collect information in three ways: information you give us, information we receive from services you connect (with your consent), and information collected automatically.

3.1 Information you give us

Account and profile information — such as your name, email address, and preferences you set in the App.
Payment information — for consumer subscriptions, billing is handled by Apple through your Apple Account; we do not receive or store your full payment card number. For Enterprise or web invoicing, payment is processed by Stripe, which receives your payment details directly. See How we share information.
Content you provide — anything you type, dictate, or otherwise enter into Maili, including instructions, drafts, notes, and the content of communications you ask Maili to help with.
Support communications — the messages, attachments, and contact details you share when you contact us for help.

3.2 Information from connected services (with your consent)

Maili only accesses the following after you grant permission, and you can revoke that permission at any time in your device settings or by disconnecting the relevant account:

Gmail (via Google OAuth restricted scopes) — the contents and metadata of your email, accessed so Maili can read, organize, summarize, and draft messages for your review. See the Google API Services Limited Use section for the specific Google scopes we request and the strict limits on how we use this data.
Calendar — your calendar events and availability, so Maili can summarize your schedule and propose times and invitations for your approval.
Contacts — your contacts, so Maili can identify and address the right people when it drafts communications for you.
Precise location — your device's precise geolocation, used to provide location-aware assistance such as travel-time and timing suggestions, when you enable it.
Microphone — audio you capture for voice mode, dictation, and meeting capture.
Camera — images you capture when you choose to use camera-based features.

3.3 Information collected automatically

Device and identifier information — such as device type, operating system version, and app version.
Usage and diagnostic information — such as feature usage, crash reports, and performance data that help us keep the Services reliable.
Network information — such as your IP address.
Website information — on the Site we use privacy-friendly, cookieless analytics. We do not use advertising cookies or sell or share data collected through the Site.

4. On-device processing versus cloud processing

Maili is designed to keep as much of your information on your iPhone as practical, and to send to our servers and our AI processor only what is needed to deliver the feature you are using.

On-device — certain processing happens locally on your iPhone and does not leave your device. For example, meeting capture and some analysis of your local data are performed on-device wherever feasible. Your connected-account credentials are protected by the device's secure storage.
Cloud — when you use AI features, the content needed to fulfill your request (for example, the text of an email you ask Maili to summarize or the instruction you type) is transmitted to our backend and to our AI processor, xAI, to generate a response. See AI processing and our xAI sub-processor.

5. How we use information

We use the information described above to:

Provide, operate, and maintain the Services, including planning, inbox assistance, calendar assistance, meeting capture, and drafting communications for your review.
Generate AI responses, drafts, and proposals that you can then review, edit, approve, or discard.
Personalize and improve the user-facing features you use.
Process subscriptions and, for Enterprise or web customers, billing and invoicing.
Provide customer support and respond to your requests.
Maintain the security, integrity, and reliability of the Services, including detecting and preventing fraud and abuse.
Comply with legal obligations and enforce our terms.

We do not use your information to serve you third-party advertising, and we do not sell or share your personal information. We do not use information received from Google APIs, or your other content, to train generalized AI or machine-learning models. See the Google API Services Limited Use and AI processing sections.

6. AI processing and our xAI sub-processor

Maili uses xAI's "Grok" models to generate AI responses. When you use an AI feature, the content needed to fulfill your request is transmitted to xAI, which processes that content on our behalf as a sub-processor (service provider) under contract.

Your content is not used to train xAI's models by default. We use xAI's API/business tier. Under that tier, customer content sent through the API is not used to train xAI's models by default. This is different from the consumer Grok app, which Maili does not use for your content.
Operational use and retention. xAI may process and retain content on its servers to provide and secure the service and may use de-identified operational data to maintain and improve its service, as described in its terms. xAI does not receive your content for its own independent marketing or advertising purposes.
Limits that still apply. Content received from Google APIs is subject to the additional restrictions in the Google API Services Limited Use section — including that it is never used to train generalized AI or machine-learning models.

You can review xAI's practices in its privacy policy and Data Processing Addendum.

7. Google API Services Limited Use

Maili's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Because Maili connects to your Gmail using restricted scopes, we make the following specific commitments about Google user data:

We use Google user data only to provide or improve user-facing features that are prominent in the Maili experience (for example, reading, organizing, summarizing, and drafting your email for your review).
We do not sell Google user data.
We do not use Google user data for advertising of any kind.
We do not use Google user data, or transfer it, to train generalized artificial intelligence or machine-learning models.
We do not transfer Google user data to others except as necessary to provide or improve the user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
We limit the humans who can read Google user data to the narrow cases permitted by Google's policy — namely with your consent, for security purposes, to comply with applicable law, or where the data is aggregated and de-identified for internal operations.

7.1 Restricted Gmail scopes we request

Maili requests the following Google scopes, and only for the user-facing purposes described:

https://www.googleapis.com/auth/gmail.readonly — to read your messages and metadata so Maili can summarize, search, and organize your inbox.
https://www.googleapis.com/auth/gmail.modify — to apply labels, mark as read, and organize messages at your direction.
https://www.googleapis.com/auth/gmail.compose — to prepare and save email drafts for your review. Consistent with our Maili proposes; you approve principle, drafts are saved for you and are never sent without your explicit, per-action confirmation.

7.2 New data types and re-consent

If we begin using a new type of Google data, we will update this policy and request your consent again before accessing it.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only to the service providers and in the circumstances described below.

Recipient	What they receive	Purpose	Their policy
Apple	Subscription and billing data for consumer purchases	Processes consumer In-App Purchase billing, cancellations, and refunds; provides the app platform	Apple Privacy Policy
xAI	The content needed to fulfill your AI requests	AI processing sub-processor (Grok); generates AI responses on our behalf	xAI Privacy Policy
Google	Authorization tokens and requests to your account	Source of Gmail, calendar, and contacts data you connect, via Google OAuth	Google Privacy Policy
Stripe	Payment details for Enterprise and web invoicing	Processes Enterprise/web payments (not used for consumer subscriptions)	Stripe Privacy Policy
Google Cloud (Cloud Run hosting)	Data transmitted to and processed by our backend	Hosts our backend infrastructure	Google Cloud Privacy Notice

We may also disclose information to comply with law or valid legal process, to protect the rights, property, or safety of our users or others, or in connection with a merger, acquisition, or sale of assets (with notice to you as required).

9. Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, after which we delete or de-identify it. Specific timelines depend on the type of data:

Account and profile information — kept while your account is active and deleted within a reasonable period after you close your account or request deletion.
Connected-account data (Gmail, calendar, contacts) — accessed to deliver features; cached only as needed for performance and removed when you disconnect the account or delete your account.
Content you provide and AI request content — retained only as long as needed to deliver the Services and support; content sent to xAI is retained per xAI's terms.
Diagnostic and usage data — retained for a limited period for reliability and security.
Billing records — retained as required for tax, accounting, and legal obligations.

10. Your California privacy rights (CCPA/CPRA)

This section applies to California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). It serves as our notice at collection and our full California privacy notice.

10.1 Categories of personal information we collect

CCPA category	Examples we collect
Identifiers	Name, email address, device identifiers, IP address
Customer records	Account details; billing information (processed by Apple or Stripe)
Commercial information	Subscription tier and transaction history
Internet or network activity	App and feature usage, diagnostics
Geolocation data	Precise geolocation (when enabled) — also Sensitive Personal Information, below
Audio and visual information	Microphone audio and camera images you capture
Contents of communications	Email contents and messages you connect or provide — also Sensitive Personal Information, below
Inferences	Preferences derived to personalize user-facing features

We collect these categories from the sources described in Information we collect (you, your connected services, and automatically), and we use and disclose them for the purposes described in How we share information.

10.2 Sensitive Personal Information

We collect the following Sensitive Personal Information:

Precise geolocation (when you enable it), and
The contents of your email and messages (through the Gmail access you connect and content you provide).

We use Sensitive Personal Information only to perform the Services you request and for the purposes permitted by the CCPA — not to infer characteristics about you. You have the right to limit the use of your Sensitive Personal Information to those permitted purposes. To exercise this right, use the Limit the Use of My Sensitive Personal Information request or any method in How to exercise your rights.

10.3 We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. Because we do not sell or share, we do not offer a separate "Do Not Sell or Share My Personal Information" opt-out — there is nothing to opt out of — but you may still contact us with any questions about this commitment.

10.4 Your California rights

Right to know / access — to request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
Right to delete — to request deletion of personal information we have collected from you, subject to legal exceptions.
Right to correct — to request correction of inaccurate personal information.
Right to opt out of sale or sharing — we do not sell or share personal information, so this right is satisfied by default.
Right to limit the use of Sensitive Personal Information — as described above.

10.5 How to exercise your rights

You can submit a request using either of these methods:

Email us at support@maili.ai, or
Use the in-app privacy controls in Maili's settings.

We will verify your identity before fulfilling a request, typically by confirming details associated with your account. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may verify your identity directly. We will confirm receipt and let you know the outcome of your request, including when a request has been honored.

10.6 Non-discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you the Services, charge you a different price, or provide you a different level or quality of service because you exercised your rights.

10.7 Retention

We retain each category of personal information only for as long as reasonably necessary for the purposes for which it was collected, as described in Data retention, and not longer than permitted by law.

11. Children's privacy

The Services are intended for users who are at least 16 years old. They are not directed to, and we do not knowingly collect personal information from, anyone under 16. If you believe a person under 16 has provided us personal information, please contact us at support@maili.ai and we will take steps to delete it.

12. Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit, protected storage of connected-account credentials on your device, and minimization of the data we access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice in the App or by email. If a change involves accessing a new type of Google data, we will request your consent again before accessing it, as described in the Google API Services Limited Use section. Your continued use of the Services after an update means you accept the revised policy.

14. Contact us

If you have questions about this policy or our privacy practices, or to exercise your rights, contact us:

Mylo Prime LLC, a Utah limited liability company
Bountiful, UT 84010
Brand contact: support@maili.ai
Entity contact: support@myloprime.com