1. Who this notice covers
This notice explains how the Zmail service at zmail.my, operated as part of TalkToAI.org, handles personal data when you visit the site, create an account, subscribe, use Zmail Workspace or contact support.
2. Data we handle
- Account identity: your Zmail address, Google account subject identifier, verified email address and display information returned by Google sign-in.
- Mailbox data: messages, attachments, folders, contacts and settings needed to provide email service.
- Workspace data: ZNotes content, checklist items, labels, colours and version history; calendar events, attendees, alarms and scheduling data; and contact records used for CardDAV access. ZNotes documents are encrypted twice at rest. Calendar and contacts remain server-readable so sync, scheduling and reminders can work.
- zSign data: separate account credentials, uploaded and completed documents, templates, signer contact details, signatures, field values, timestamps, IP/device evidence and audit history needed to perform and evidence a signing workflow.
- Subscription data: PayPal subscription identifiers, plan, status, timestamps and payment-event references. PayPal handles your underlying funding details.
- Security and operations: IP-derived security signals, device/browser information, authentication events, rate-limit records, abuse reports and audit logs.
- Support data: information you provide when asking for help.
3. Why we use it
We use data to provide and secure Zmail, verify subscriptions, prevent spam and fraud, recover accounts, support users, comply with law and improve reliability. We do not request Gmail message, Google Drive or Google Contacts access for portal sign-in.
4. Optional AI and ChatGPT connections
If you choose to connect Zmail to ChatGPT, Zmail uses an OAuth permission flow so ChatGPT can act only for the authenticated Zmail account. When you invoke a connector tool, the selected message content and metadata, ZNote content, or calendar fields needed to fulfil that request are returned to ChatGPT and therefore disclosed to OpenAI. ZNotes are decrypted by the authenticated Zmail service only when needed for an authorised note operation. Zmail does not give ChatGPT your mailbox password, Google password, PayPal credentials, ZMath keys or refresh token.
Webmail AI Assist is separate. You may store your own OpenAI or Groq API key, encrypted at rest with AES-256-GCM. Zmail must decrypt that key on the server when you explicitly request assistance, so this is not zero-knowledge key storage and an authorised root operator could technically recover it. Only the subject, compose body and instruction you submit by clicking AI Assist are sent to the selected provider. Zmail does not scan your inbox in the background, and generated text is never sent as email automatically.
You can revoke the ChatGPT connection or remove your AI Assist key. Revocation stops new access but does not remove information already disclosed to a provider; that information is governed by your account and the provider's applicable terms and privacy notice.
5. Providers and disclosures
We use infrastructure and specialist providers where necessary, including Google for identity, PayPal for subscriptions and Cloudflare Turnstile for human verification. OpenAI receives selected Zmail data only when an account holder enables and invokes ChatGPT or OpenAI AI Assist. Groq receives explicitly submitted AI Assist content only when the user selects Groq and adds a Groq key. Mail necessarily passes to other mail operators when you send or receive external messages. We may disclose limited data when legally required or to investigate serious abuse and security incidents.
6. Retention
We keep account, mailbox, Workspace and zSign data while service is active and for limited closure, recovery, dispute and security periods afterwards. ZNotes may retain bounded encrypted version history to support recovery. Completed zSign documents and audit evidence may be retained until the sender deletes them or the account closes, subject to legal, dispute and backup periods. Payment and audit records may be retained longer where needed for accounting, fraud prevention or legal claims. Backups expire on their own rotation rather than being edited item by item.
7. Your choices and rights
You can update mailbox and Workspace data, disconnect ChatGPT, cancel renewal and request access, correction or deletion where applicable. Some information must be retained for security, legal or transactional reasons. Privacy rights vary by location.
8. Security, encryption and operator access
Zmail uses technical and organisational safeguards, but no online service can promise absolute security. For eligible Zmail-to-Zmail messages, ZMath Mail encrypts the body twice in the sender's browser; the service stores and transports armoured ciphertext and opens that body in a ready recipient browser. Subject lines, addresses and routing metadata, drafts, attachments, external-provider messages and ordinary email are outside that protection. Email sent through the ChatGPT connector uses standard JMAP mail and is not automatically ZMath protected.
Zmail does not claim that the operator is technically unable to access all service data. Normal email, metadata, attachments, ZNotes after authorised decryption, calendar, contacts and zSign documents/audit records remain accessible to the authenticated services, and an authorised root operator could technically access server data when necessary for service operation, support with permission, security, abuse investigation or legal obligations. Access should be limited, logged where applicable and never used to profile users for advertising.
ZNotes documents use two independent authenticated AES-256-GCM layers at rest but are decrypted by the authenticated service for normal use, recovery and authorised connector requests. Calendar and contacts are server-readable for CalDAV/CardDAV sync, scheduling and reminders. zSign documents are protected by access controls, TLS and infrastructure storage controls; they are not ZMath protected and are not end-to-end encrypted. ZMath Shield can separately protect a selected note or file with independent passphrase and visual-pattern layers entirely in the browser.
9. Contact
For privacy questions, contact admin@zmail.my. Do not send passwords, recovery patterns or payment credentials.
Contact admin@zmail.my.