AI-CSD 1 Email Policy

1. About This Privacy Policy

1.1 Purpose and Scope: This Privacy Policy is a privacy notice describing how the applicable Silence AI contracting company handles personal data in connection with Email Security. For UAE customers, the contracting company is Silence AI LLC; for Kazakhstan customers, it is ТОО "Silence AI". The company identified in your order, account registration, or other agreement is responsible for the relevant account data it processes as controller. This notice also describes the company's separate role as processor of customer email data on the customer's documented instructions.

1.2 Introduction: This Privacy Policy describes how Silence AI collects, uses, processes, and protects your personal information when you use the AI-CSD 1 Email Protector subsystem, including the secure webmail client. It does not apply to the Web Security & Traffic Management component or any other Silence AI service operated on a separate domain.

This Privacy Policy is incorporated into the Email Security Terms of Service. The Email Security Terms of Use also applies. The DPA in the Terms of Service prevails where the documents conflict about processing customer data on the client organization's behalf.

1.3 Controller Information: The applicable contracting company acts as controller for personal data relating to the customer account and administration of the service. UAE: Silence AI LLC, licence number 2539365.01, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE. Kazakhstan: ТОО "Silence AI", БИН 250840004804, КАЗАХСТАН, АСТАНА обл, АСТАНА г, АЛМАТЫ мкр, Проспект Ракымжан Кошкарбаев, 10/1, G-3 блок; D6 этаж.

1.4 Service Domain and Scope: For customers contracting with ТОО "Silence AI" in Kazakhstan, the CMC administrator panel is at kz.mail.csd.silenceai.net and the employee email workspace is at kz.mail.silenceai.net. For customers contracting with Silence AI LLC in the UAE, those interfaces are at mail.csd.silenceai.net and mail.silenceai.net, respectively. Administrators use the CMC for company configuration, domains, accounts and security settings; employees use the workspace to read, compose, send and manage mail. This notice covers the Email Security service in provider-connected and hosted modes through the applicable domain pair. The domain names do not establish physical server location.

1.5 Component-Specific Processing: The Email Security service processes email data and metadata for the selected mail mode, workspace and security functions, and for optional AI drafting or automatic responses when requested or enabled.

2. Information We Collect

2.1 Account and Registration Information: Email address and account credentials, Company or organization information (if applicable), Billing and payment information, User profile and configuration settings.

2.2 Service Usage Data: Sender, recipient, subject, timestamps and other email metadata; message content and attachments received through authorized provider access or hosted mail transport; security classification results; mailbox configuration data; and, where optional AI assistance is used, configured AI context files and generated drafts or responses.

2.3 Analytics and Performance Data: Platform usage statistics, User activity patterns (for demonstrating service traction to customers), System performance metrics, Error logs and diagnostic information.

3. How We Use Your Information

3.1 Service Delivery: We use this information to provide the selected provider-connected or hosted mail mode and workspace, receive or synchronize mail, store and send messages, perform applicable security checks and classification, and provide optional AI-assisted drafting or automatic-response actions when requested or enabled.

3.2 Optional AI Assistance: A user-requested reply draft may use the selected sender, subject and up to approximately 2,000 characters of the body to generate text for review. Enabled auto-response or draft settings may process eligible incoming mail, including a raw message or metadata and body plus configured AI context files, and may save a draft, send a reply, forward mail or perform another supported mailbox action. This assistance is separate from the email security checks. Security results and generated content may be stored for the relevant service function.

3.3 Platform Operations: Maintain and improve our services, Provide customer support, Process billing and payments, Monitor service performance and availability.

3.4 Analytics and Business Intelligence: Track user growth and platform adoption, Generate anonymized usage statistics, Improve service functionality and user experience.

4. Third-Party Services and Data Sharing

4.1 Email Provider Integration: In provider-connected mode, Microsoft incoming mail is fetched through Microsoft Graph and Gmail incoming mail is synchronized using OAuth-authorized IMAP; sending uses the respective authorized provider APIs. The provider remains the mail server. In hosted mode, the platform receives inbound mail and provides SMTP submission through its own mail infrastructure.

4.2 Security Scanning Services: ClamAV may scan accessible email attachments for malware when the scanner is enabled and configured; not every attachment is necessarily scanned. URLScan.io: We submit eligible email links to URLScan.io for security analysis.

4.3 URLScan.io Data Storage: When we submit links to URLScan.io: Scan results are stored in URLScan.io's database, No email account information, sender details, recipient information, email content, or attachments are shared, Only the URL itself is submitted for analysis.

4.4 Payment Processing: For services contracted with Silence AI LLC in the UAE, online purchases are handled by Paddle.com as merchant of record. Paddle handles checkout and payment data under its Buyer Terms and Privacy Notice. For services contracted with ТОО "Silence AI" in Kazakhstan, payments are handled by ТОО "ФинCeрвисы". The applicable checkout or invoice identifies the payment recipient and terms. Silence AI may receive transaction status and limited billing details needed to administer the service. For a planned change of payment gateway provider, the initial notice must be emailed to every affected customer at the address used to sign in to Silence AI Email Security no later than three calendar months before the planned change date. If the customer has not responded within seven calendar days after that email is sent, Silence AI may also notify the customer organization's administrators through the Email Security administrative panel. This additional notice does not replace the initial email or change the three-calendar-month advance notice period, as set out in Section 3.3.3 of the Email Security Terms of Service.

4.5 Cloud Infrastructure: We may use cloud service providers for data storage and processing. All third-party processors are contractually bound to protect your data in accordance with this Privacy Policy.

4.6 Optional AI Assistance Providers: Requested reply drafts and enabled automatic-response or draft settings may send a selected sender, subject, message body or raw message, configured company/user AI context files and generated content to a configured AI provider. An automatic-response fallback may use an external AI provider if a fallback API key is configured; otherwise it may generate an offline response. Not every draft uses an external provider. These functions have separate settings from the phishing detector, so turning that detector off does not turn them off. No specific AI provider or processing region is promised by this notice.

5. Data Storage and Retention

5.1 Email Data: Email data is retained until you delete the mailbox from our service or as required by law. Security classification results and scan metadata are stored to support mailbox protection and reporting.

5.2 Default Retention Periods: Email data: Retained until you delete the mailbox from our service or as required by law, User activity logs: Stored for analytics and service improvement purposes, Account information: Retained while your account is active.

5.3 Data Deletion: You can request deletion of your data at any time. Upon account termination, we will delete your personal data within a commercially reasonable period. Legal retention requirements may apply in certain circumstances.

6. User Rights and Control

6.1 Your Data Rights: You have the right to: Access your personal data, Rectify inaccurate information, Request deletion of your data, Restrict processing activities, Data portability where applicable, Object to certain processing activities.

6.2 User Responsibilities: You are solely responsible for: Maintaining the security of your account credentials, Ensuring that you have authorization to connect any third-party mailbox to our service, Compliance with applicable laws when using our services.

7. Security Measures

7.1 Technical Safeguards: TLS encryption for data in transit, Encryption of stored data where feasible, Role-based access control (RBAC), Multi-factor authentication (MFA) for administrative access, Centralized secrets management, Comprehensive logging for security purposes.

7.2 Organizational Measures: Regular security assessments, Employee training and access controls, Incident response procedures, Backup and recovery systems, Vulnerability management processes.

8. International Data Transfers

8.1 Service Locations: Kazakhstan customer data under a Kazakhstan company agreement is stored in Kazakhstan. The Email Security service under a UAE company agreement runs on a server in either the United States or the European Union; a fixed country or customer-selected region is not promised. Access domains and contracting company do not establish every backup, log, support or subprocessor location. When personal data is transferred across borders, we: Rely on legally permitted transfer mechanisms, Implement appropriate safeguards as required by law, Use TLS encryption for all data transfers, Ensure compliance with applicable data protection regulations.

8.2 User Responsibilities: You remain responsible for any local authorizations or restrictions required for data transfers you initiate through our services.

9. Cookies and Tracking Technologies

Our use of cookies is governed by our separate Cookie Policy, available at /en/policies/cookies/. We primarily use technical cookies necessary for platform functionality.

10. Legal Basis for Processing

We process your personal data based on: Contract performance: To provide the services you have requested, Legitimate interests: For service improvement, security, and analytics, Consent: Where explicitly provided for specific processing activities, Legal obligations: To comply with applicable laws and regulations.

11. Data Breach Notification

In the event of a confirmed personal data breach affecting your information, we will: Notify you without undue delay, Provide available technical details, Offer reasonable assistance to help you assess and comply with your obligations, Report to relevant authorities as required by law.

12. Webmail Client / Email Protector Additional Notice

The Email Security service includes an employee email workspace in both provider-connected and hosted modes. Eligible newly received mail may receive security checks and classification. Optional AI drafting and automatic-response processing serves a separate purpose and is triggered by a user request or the applicable enabled setting.

Historical Gmail/Outlook mailbox imports do not receive the normal security classification. Imported incoming mail may appear in Unfiltered and retain an Inbox or source-folder association; sent and trash imports follow their own folder rules. Attachment content may still be scanned during migration. Newly received mail follows the applicable settings and check conditions.

12.1 Email Security Functions: The customer-facing functions below are conditional and are not a guaranteed sequence. A content-threat result may stop later checks.

12.2 Folder Classification: Applicable results may place newly processed messages in the following user-visible folders:

• Spam: Spam findings and messages identified only as spoofed.
• Dangerous Links: Messages classified by the dedicated link check.
• Malware in attached files: Messages classified by attachment malware analysis.
• Possibly Phishing: Messages classified by applicable phishing checks.
• Secure: Messages with no detected threat from applicable checks.
• Unfiltered: Imported incoming mail, subject to its source-folder association.

When the combined phishing detector is effectively off for a mailbox, dedicated known-phishing-domain, domain fraud-risk and dangerous-link checks are skipped. Spoof, spam and eligible antivirus checks are separate and may continue, but no other check is guaranteed to catch the same threat. Only CMC administrators can change the phishing-detector setting; employees cannot disable it. This setting does not stop separately enabled AI assistant, reply-draft or automatic-response features. A folder label does not prove that every check ran.

12.3 Administrator Access and Data Privacy: Email content may be accessible to the organization administrator that created or manages the user account within the CMC. Automated systems process it for the selected mail mode, workspace, applicable security checks and separately enabled optional AI assistance. The restriction on human Silence AI personnel access is stated in Section 13.

13. Prohibition on Human Access to User Email Content

Personnel of Silence AI LLC and ТОО "Silence AI", including employees and contractors, must not read, access, copy or review client organization email content, attachments or metadata except under the limited exceptions below.

Email scanning, classification, threat detection and optional AI drafting or automatic-response processing are carried out by automated systems and programmatic pipelines, with no human Silence AI personnel involved in processing or reviewing email content except under the stated exceptions.

The client-authorized exception requires prior explicit permission by email from an authorized representative of the client organization, specifying the purpose and scope of access. Access must stay within that scope, be logged and end when the authorized purpose is complete. Separately, access or disclosure required by a binding lawful demand is limited to what the law requires; we notify the client organization where legally permitted. This restriction is a contractual commitment under the Email Security Terms of Service and its DPA.

14. Changes to This Privacy Policy

Silence AI may amend this Privacy Policy without prior client approval. We will notify clients by email to the registered administrator address or by an in-service notification at least seven calendar days before the stated effective date. An email is sent when transmitted; an in-service notice is sent when made available in the account. We will publish the updated text and effective date. If the contracting company changes through an assignment permitted by the Terms of Service, the notice will identify the successor responsible for relevant data and its contact details. Clients may cancel future subscription renewals in the system or delete their account under the Terms of Service; an objection does not itself delay the change or require account deletion.

15. Contact Information

15.1 Data Protection Inquiries: For questions about this Privacy Policy, data processing, or to exercise your rights, contact the applicable contracting company at info@silenceai.net. UAE: Silence AI LLC, licence number 2539365.01, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE. Kazakhstan: ТОО "Silence AI", БИН 250840004804, КАЗАХСТАН, АСТАНА обл, АСТАНА г, АЛМАТЫ мкр, Проспект Ракымжан Кошкарбаев, 10/1, G-3 блок; D6 этаж.

15.2 Data Subject Requests: To make a data subject request (access, rectification, deletion, etc.), please contact us using the information above. We will respond to your request within the timeframes required by applicable law.

16. Governing Law

The parties will first try to resolve disputes relating to this Privacy Policy through mutual negotiation. If negotiation fails, disputes under agreements with Silence AI LLC shall be submitted to the competent courts in Sharjah, UAE, and disputes under agreements with ТОО "Silence AI" shall be submitted to the competent courts of Kazakhstan. Nothing in this notice excludes mandatory rights or court jurisdiction that the parties cannot exclude by contract.