Updated 12 November 2026
Who handles data for us
These are the companies that handle data on our behalf, where, what each does and what it gets. We update this page before a new one receives any data.
| Company | Where | What it does | What it gets | Status |
|---|---|---|---|---|
| Amazon Web Services | United States (Ohio) for the service; worldwide for this website | Runs the service: the Nitro Enclave it runs in, storage (S3, DynamoDB), keys (KMS) and the mail we send you (SES). Also serves this website and the docs (Amplify, CloudFront). | Account data; sealed data, which it can’t read in storage; the mail we send you, which it can read and, under its terms, store and scan for spam and abuse; an access log of each visit to this website (time, page, IP address, browser), kept until we remove the site. | In use |
| Cloudflare | Worldwide | DNS for permaily.com, and the DNS lookups the service makes to check where a message came from. | Host names, and, once mailboxes open, the domains of the senders of mail you receive. Never mail. | In use |
| Let’s Encrypt | United States | The service’s TLS certificates. | Our host names. No personal data. | In use |
| OpenAI | United States | Deciding whether text is about a topic, for rules and requests that depend on meaning, and turning a rule written in plain words into conditions. | The subject, the body text or sentences of a message, only when exact conditions can’t settle it and you turned such a rule or request on; the text of a rule. OpenAI doesn’t train on it. Until it approves zero data retention for us, which we’ll ask for, its abuse-monitoring logs may hold that text for up to 30 days, and it may keep flagged text and a sample of requests for automated safety review, for a time its page doesn’t state. | Planned, not used yet |
Services you choose
These aren’t our subprocessors: they act for you, or on their own account, and only because you chose them. They’re here so the list of who sees what is complete.
| Who | Why | What they get |
|---|---|---|
| Google, GitHub, Facebook (Meta), Microsoft | Only if you sign in with one: it tells us it’s you. | It learns that you signed in to Permaily, and when. It tells us its identifier for you, an address and usually your name; we keep the identifier, and the address only if it becomes your contact address. |
| Your mail provider | Will forward your mail to us, once mailboxes open. | It already holds your mail; it learns your Permaily forwarding address. |
| Apps and agents you connect | Will receive what you approve, once connections open. | Only the part of your mail you approved, under their own policies. |
More on each in the privacy policy. Questions: privacy@permaily.com.