Privacy Policy

As a controller, we decide how to use information about the people who sign up for, administer, pay for, or visit Aftercomm. Sections 2 and 4–11 describe that information.

As a processor (a “service provider” under US state privacy laws), we process email information on behalf of the organisation that monitors those mailboxes — our customer, who is the controller. We use it only to provide the Service to that customer, under our Terms of Service and Data Processing Addendum. Section 3 describes it.

When a customer connects Microsoft 365 and selects mailboxes, we process:

• Message bodies and attachment names — in memory only. They are read from the customer’s tenant, reviewed, and discarded. They are never written to a database, log, or backup. Attachment contents are never fetched.
• Stored as the customer’s audit trail: sender and recipient addresses, subject line, sent time, attachment count, the AI verdict (flagged or not, severity, categories, and an explanation), and the actions reviewers take. For messages the policy clears, the subject line, recipients and explanation are erased after 30 days, leaving only a record that the message was reviewed and cleared.
• Monitored mailbox addresses, a count of the days each was monitored, and the number of AI tokens each mailbox’s reviews used (counts only, never content), used to calculate the customer’s invoice.

How the AI review works. Each message, with the customer’s compliance policy, is sent to a Claude model from Anthropic for a verdict. By default this runs on Aftercomm’s Anthropic account, where Anthropic acts as our sub-processor under its commercial terms: it does not use the data to train models, it retains API inputs and outputs for up to 30 days to detect abuse and then deletes them, and it may retain requests its safety systems flag as possible misuse for up to 2 years. Aftercomm has no access to that copy. A customer may instead provide an API key from its own Anthropic account, in which case the review runs under the customer’s agreement with Anthropic, and what Anthropic retains is governed by that agreement.

No automated decisions about people. Aftercomm does not make decisions that have legal or similarly significant effects on anyone. A verdict is advice to the customer’s reviewers, and our Terms require that any decision about a person be made by a human at the customer.

If you work for one of our customers and your mailbox is monitored, your employer decides what is monitored and why, and is the right first contact for questions or requests about that information. If you contact us, we will refer your request to your employer and help them respond.

• To provide the Service and your account — performance of our contract with you.
• To bill you — performance of contract, and our legal obligations to keep financial records.
• To keep the Service secure — for example, limiting sign-in attempts and recording access to message content — our legitimate interest in protecting our customers and our systems.
• To communicate with you about your account, alerts, billing, and changes to these policies — performance of contract.
• To improve the Service using aggregated, de-identified metrics — our legitimate interest. We never use message content for this, and never train AI models on customer data.

The console sets a single cookie, er_session, which keeps you signed in. It ends after 30 minutes without activity, and 12 hours after sign-in regardless. It is strictly necessary for the Service to work and is not used for tracking. The console also keeps a few small values in your browser’s local storage (when you were last active, so every open tab signs out together, and whether you dismissed a setup notice). They never leave your browser.

Our public website pages (not the console, and not the sign-in or password pages) use Google Analytics, which sets the _ga cookies to tell new visitors from returning ones. They contain a random identifier, not your name or email address, and are not used for advertising. Visitors from the European Economic Area, the United Kingdom and Switzerland get no Analytics cookies: visits there are counted without them. You can block these cookies in your browser, or with Google’s opt-out add-on, without affecting the Service.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only with:

• Our sub-processors: Anthropic (the AI review, for customers using Aftercomm’s Claude account), Render (application hosting and database, United States), Stripe (payments and invoicing), and Postmark (delivery of alert and account emails). The current list, and exactly what each can see, is on our Trust & Security page. We will give customers notice before adding a sub-processor that receives Customer Data.
• Google, as our analytics provider for visits to our public website pages only. It never receives Customer Data or anything from the console. We have turned off Google’s options to use this data for its own products, benchmarking or advertising.
• Providers the customer chose: Microsoft (where the email already lives) and, for a customer that provides its own Anthropic API key, Anthropic under that customer’s own account. These are the customer’s vendors, not ours.
• Authorities, where the law requires it. We will notify the affected customer unless we are legally prohibited from doing so.
• A successor in a merger or sale of our business, which would remain bound by this policy.

We store information in the United States (Render, US East region in Virginia). The AI review is processed by Anthropic, whose standard global routing may run it outside the United States; Anthropic does not store it beyond the retention described above. Where information about people in the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, incorporated in our Data Processing Addendum.

• Message bodies: not kept at all by Aftercomm. Anthropic, which performs the AI review, retains API inputs and outputs for up to 30 days (requests its safety systems flag as possible misuse for up to 2 years) unless the customer uses its own Anthropic account, whose terms then apply. Aftercomm has no access to Anthropic’s copy.
• AI usage records (token counts per mailbox per day, never content): for the life of the workspace, as the basis of its invoices.
• Messages the policy cleared: subject line, recipients and the AI’s note are erased 30 days after review. A record that the message was reviewed and cleared (mailbox, time, message identifier, policy version) is kept for the life of the workspace.
• Flagged messages, the rest of the audit trail, and account information: for the life of the workspace. A workspace owner can delete the workspace and everything in it at any time.
• Backups: deleted information can persist in encrypted backups for up to 7 days, until those backups are overwritten.
• Server logs: up to 90 days.
• Invoices and payment records: held by Stripe for as long as tax and accounting law requires.

Information is encrypted in transit. Passwords are stored as one-way hashes, and each customer’s own AI provider key, where one is used, is encrypted before it is stored; Aftercomm’s servers authenticate to Anthropic with short-lived tokens rather than a stored key. Access to message content through the console is limited to flagged messages, rate-limited, and recorded. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you without undue delay. The full detail is on our Trust & Security page.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict how we use it; and to withdraw any consent you have given. Residents of the EEA, UK, and Switzerland may also complain to their data protection authority. California and other US state residents have the right to know, delete, and correct their information, and to not be discriminated against for exercising these rights.

To make a request, email info@aftercomm.com. We will verify your request and respond within one month, or within 45 days where US state law provides for it. For information we process for a customer (Section 3), we will pass your request to that customer, who decides how to respond.

The Service is for organisations and is not directed at anyone under 16. We do not knowingly collect information from children.

If we make a material change, we will notify workspace owners by email and in the console at least 30 days before it takes effect. The date at the top of this page shows when the current version took effect.

Aftercomm, LLC, 119 South Western Avenue, Unit 1 #508, Chicago, IL 60612, USA. Privacy questions and requests: info@aftercomm.com.