Privacy policy
Last updated: November 5, 2026 · URL of this policy: https://www.mail-vex.com/en/privacy · Reference language: this is the English version; the Spanish version has the same content.
0. Who we are
MailVex is a product by AutomatLabs, a trading name of Víctor Gutiérrez Nogués (Spanish tax ID / NIF 09087078P), based at Vía Complutense 62, 28805 Alcalá de Henares, Madrid, Spain. Contact for any privacy question: info@mail-vex.com.
MailVex is not affiliated with Shopify, Inc. or any of its trademarks. It is an independent tool that a merchant installs in their own browser.
1. What the extension does and what stays inside your browser
MailVex is a Chrome extension. When you use it from your own store's Shopify Email screen (already signed in), all processing happens inside your browser:
- it reads the list of your email campaigns and their metrics (sent, delivered, opens, clicks, unsubscribes, complaints, attributed sales, sessions and landing pages) directly from the endpoints your own Shopify session already uses;
- it stores those emails (with full HTML, if requested) and their metrics in the browser's local storage (
IndexedDB), not on any AutomatLabs server; - it builds the dashboard, rankings and charts from that data, also inside the browser;
- it generates the CSV/JSON files you download, also inside the browser.
If you use the extension (free or paid) without subscribing to the Pro plan, AutomatLabs does not see, receive or store on any server of its own the emails, metrics or any data from your store. Nothing leaves your browser except what's described in point 2. If you also subscribe to the Pro plan and choose to import your history, point 10 describes what happens to that content: it no longer stays only in your browser.
2. The only thing that leaves your browser: license validation
If you activate a paid license key, the extension sends a validation request containing only these three fields: { key, instance_id, version } — the license key, a random identifier for that installation (it does not identify your store or you), and the extension version. Never your store's domain, any email, any metric or any other data. This is guaranteed by the licensing module's own design, checked by an automated test — not just a promise in this text.
Without a key, the extension works in free mode and sends no license request at all.
3. What data AutomatLabs processes as direct seller (Stripe + our own backend)
AutomatLabs is the seller of the license and the data controller for your data as a buyer — there is no merchant of record in between. If you buy a paid license:
- Stripe processes the payment itself (card data, billing) as AutomatLabs' data processor to process the charge, and, for its own legal purposes (fraud prevention and regulatory compliance), it may also act as an independent controller of that same data, under its own services agreement. AutomatLabs never sees or stores your card number.
- AutomatLabs' own licensing backend receives the payment notification from Stripe, creates your license key and emails it (via Amazon SES, see point 4). That backend never receives emails, HTML, metrics or any data from your store — only your license key and your buyer account data (email,
stripe_customer_id, payment status). This is a design requirement of that backend, not just a statement.
What AutomatLabs processes about you as a buyer is: your email address, your payment/subscription relationship (via Stripe) and your license key(s). Never any data about your store's own customers or the content of your email campaigns.
4. Processors and sub-processors
| Processor/sub-processor | Purpose | Data accessed |
|---|---|---|
| Stripe | Process the payment (also an independent controller for its own legal purposes, see point 3) | Buyer's email, payment data, subscription status |
| Hetzner (Nuremberg, Germany, European Union) | Host the licensing backend and the rest of AutomatLabs' services | The backend: email, stripe_customer_id, hashed license key, activation state. This page: usual technical access data of any hosting (IP, user-agent) — no third-party tracking or analytics |
| Amazon SES (EU region for storage) | Send the email with your license key and transactional notices about your purchase (failed payment, refund) | Your email address and the content of that transactional email — never data from your store |
| Zoho Mail (EU region) | Support email | Buyer's email and the content of support messages |
No backend of ours receives data about your store (emails, metrics, HTML) — see points 1 and 2: the licensing backend only processes your purchase data.
5. Where data is hosted and how long it is kept
- What you process with the extension (emails, metrics, HTML) never reaches AutomatLabs: it stays in your own browser until you delete it.
- What Stripe processes (payment data) is kept under its own privacy policy and applicable tax regulations.
- What AutomatLabs' own licensing backend processes (email,
stripe_customer_id, hashed license key, activations) is kept for as long as your purchase/subscription relationship lasts, plus any additional time required by applicable tax regulations (invoicing). Hosting region: European Union (Nuremberg, Germany).
6. Your rights
AutomatLabs, as data controller for your data as a buyer (directly and through Stripe as processor), recognizes your right to access, rectify, erase, object to, restrict and port it, under the General Data Protection Regulation (GDPR) and applicable Spanish law. You can exercise these rights by writing to info@mail-vex.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).
7. No automated decisions are ever made about you
AutomatLabs does not use purchase data to build profiles or make automated decisions that legally affect you.
8. Changes to this policy
If what the extension sends or what Stripe or the own licensing backend process changes, this policy is updated and announced visibly in the extension and on this page before the change takes effect.
9. Contact
info@mail-vex.com.
10. The web platform (MailVex Pro)
This section only applies if you subscribe to the Pro plan and use the web platform (app.mail-vex.com). If you only use the free or paid extension without the Pro plan, none of this section applies to you: only points 1 to 9 above still apply.
If you subscribe to the Pro plan, you import your email history (by uploading the file the extension exports) to see more analytics than fit in the dashboard and to generate email drafts with AI assistance.
10.1. AutomatLabs' role with this data. For your Pro plan account and billing data (email, Stripe customer ID, subscription status, acceptance of this agreement), AutomatLabs is the data controller, the same as for the extension's license (point 3). For the content you import (your emails, their HTML, their metrics, the generated drafts), AutomatLabs is the data processor: you remain the controller of that content, and AutomatLabs only processes it to provide the service you subscribed to, never for its own purposes. The full data processing agreement governing this is the DPA (version 2026-11-05).
10.2. What personal data this content may contain. Usually none of your own customers': your store's subscribers are never uploaded, because the file the extension exports does not include them. What may appear incidentally is whatever is already written in your own emails: your store's phone or email in a footer, names in testimonials, segment names. Before any of your content reaches an AI provider, detected email addresses and phone numbers are automatically masked.
10.3. Platform sub-processors. The full list, with sources, is on the sub-processors page. In summary:
| Sub-processor | Purpose | Region |
|---|---|---|
| Hetzner | Hosting the platform's database and service | European Union (Nuremberg, Germany) |
| OpenAI | Generating email drafts | United States, with standard contractual clauses (SCC) — the EU data-residency endpoint is not enabled today |
| Amazon SES | Sending your own account's emails (sign-in link, payment or retention notices) | United States, EU region for storage |
| Stripe | Processing your Pro subscription payment, as AutomatLabs' data processor (and as an independent controller for its own legal purposes, see point 3) | — |
Neither AutomatLabs nor OpenAI train any model with your content. Your content is also never used to compare or improve the experience of other merchants: every account is isolated from the others.
10.4. How long your content is kept. While your Pro subscription is active, you keep all your content. If your subscription falls behind on payment, you get a 14-day grace period with full access and, after that, read-only and download access until 30 days from the non-payment have passed. If you cancel directly (with no prior non-payment), read-only and download access lasts the 30 days following the cancellation. In both cases, on day 30 all content is automatically deleted: emails, HTML, metrics, drafts and files. You can request deletion of your account and all your data at any time, without waiting for those periods, from your account settings.
10.5. AI-generated text — transparency. The email drafts the platform generates are generated by artificial intelligence and are identified as such in the interface itself ("Generated with AI. Review it before using it."), under Article 50 of the EU AI Act (Regulation (EU) 2024/1689), applicable since 2 August 2026. No email is sent to your subscribers without you reviewing it and deciding to use it.
10.6. Your rights and contact are the same ones already described in points 6 and 9 above, also for your Pro plan account data.
11. Session cookie, local storage and other technical data
This only applies to anyone using the web platform (app.mail-vex.com):
- Session cookie. When you sign in with the access link, the platform stores a technical cookie (protected: only readable by the server, only sent over an encrypted connection, and never sent to another site) that lasts up to 30 days or until you sign out. It is strictly necessary for the platform to remember that you signed in — it is not a tracking or advertising cookie, so it does not require your consent (Spanish LSSI, art. 22).
- Browser local storage (
localStorage). The platform stores there, in your own browser, the language you chose (until you change it) and, very briefly, which page you wanted to see right after signing in with the access link (to take you there instead of the generic screen). Neither ever leaves your browser. - No third-party cookies or local storage are used for tracking or advertising purposes.
12. Legal basis and retention periods (summary, GDPR art. 13)
| What is processed | Purpose | Legal basis | Retention | Who processes it |
|---|---|---|---|---|
Email, stripe_customer_id, hashed license key, payment status | Manage your extension purchase | Performance of a contract (GDPR art. 6.1.b) | For as long as your purchase/subscription relationship lasts, plus any period required by tax regulations | AutomatLabs' licensing backend (Hetzner), Stripe |
| Card and billing data | Process the charge | Performance of a contract | Per Stripe's own retention policy | Stripe |
| Email with your license key or payment/retention notices | Send you those notices | Performance of a contract | However long Amazon SES already retains deliveries | Amazon SES |
| Content of your support messages | Answer your query | Performance of a contract / legitimate interest in assisting you (art. 6.1.b and 6.1.f) | As long as needed to resolve the query | Zoho Mail |
| Technical access data for this page (IP, user-agent) | Hosting security and operation | Legitimate interest (art. 6.1.f) | Usual hosting logs, no third-party analytics | Hetzner |
| Emails, HTML, metrics, drafts you import in Pro | Provide the platform's features (analytics, draft generation) | Performance of a contract (you are the controller of that content, AutomatLabs is your processor — see point 10 and the DPA) | While the Pro subscription is active; up to 30 days from non-payment or cancellation (point 10.4) | Hetzner (storage), OpenAI (draft generation) |
| Platform session cookie and language preference | Keep you signed in and remember your language | Necessary to provide the service you requested (exempt from consent, LSSI art. 22) | 30 days or until sign-out (cookie); until you change it (language) | None (stays in the browser or in the platform itself) |
| Email address and language of whoever joins the waitlist | Notify you when the extension license or the Pro plan go on sale (point 13) | Explicit consent (GDPR art. 6.1.a) | Until the sale opens and we notify you, or at most 12 months from when you join (whichever comes first); you can unsubscribe at any time | AutomatLabs' licensing backend (Hetzner) |
13. Waitlist ("notify me when available")
If the extension license or the Pro plan still has no confirmed price or isn't on sale yet, you can join a waitlist on /pro/ or /pricing so we notify you when the sale opens.
- What we store: only your email address and the language you used to fill in the form. Never your name, your store, or any other data.
- What we use it for: exclusively to notify you, once, when the extension license or the Pro plan go on sale. We never use it for any other campaign, and we never share it with third parties.
- Legal basis: your explicit consent — the form sends nothing unless you first check the box accepting this policy.
- How long we keep it: until the sale opens and we notify you, or at most 12 months from when you join, whichever comes first.
- How to unsubscribe: by writing to info@mail-vex.com at any time, without waiting for the sale to open — we remove your email from the list right away.
- Who processes it: the same AutomatLabs licensing backend that manages your purchase (Hetzner, European Union), described in points 3 and 4. No third-party email marketing provider is used for this list.