MailGuardian – Privacy Policy

MailGuardian

Privacy Policy

Safe Online ApS · CVR 38589962 · bysafeonline.com

Last updated 11 October 2026

Introduction

Thank you for using MailGuardian. This cookie and privacy policy govern the MailGuardian add-in and the website provided by bysafeonline.com ("Website") owned and operated by Safe Online ApS ("Safe Online") located at Nørrebrogade 47, 1, 2200 Copenhagen N, Denmark.

In the following, the term "Add-in" will refer to the use of MailGuardian's add-in, which is available as a Microsoft Outlook Add-in.

MailGuardian checks an email for Danish personal identification numbers (CPR-numre) and other personal identifiers before it is sent, and warns the person writing it. Because it reads what you are about to send, we think you are entitled to a precise account of what happens to it. That is what this page is.

Cookie Policy

What are cookies?

When you visit Safe Online's Websites you will automatically receive one or more cookies. Cookies are small text files that are stored on your browser or device. Cookies are used to recognize users and to remember you from time to time.

Does the Add-in use cookies?

No. The MailGuardian Add-in sets no cookies and performs no tracking of your behaviour. It runs inside Outlook, does the check described below, and stops. The cookie section of this policy concerns our Website only.

What type of cookies do we use on the Website?

1. Necessary cookies: placed in order to make sure that the Website works properly.
2. Preference cookies: used to remember your preferences from previous sessions.
3. Statistical cookies: used to measure, understand and improve the Website.
4. Marketing cookies: used to market our products and measure the impact of advertisements.

How long do we store cookies?

Some cookies remain on your device for a set period specified in the cookie and are reactivated each time you visit. Others are temporary and stored only during a browser session; once you close the browser, all session cookies are deleted.

How to avoid and delete cookies

Most browsers offer private browsing, and all browsers allow you to delete cookies individually or all at once, in the browser's settings. If you use more than one browser, remember to do so in each.

Cookies from third parties and business partners

When you visit our Website, we place cookies on behalf of third parties and business partners, including analytics and advertising services. None of these operate in the Add-in.

Privacy Policy

Introduction

This privacy policy describes how Safe Online collects and processes the personal data you provide, and the data we collect when you use our Website and the MailGuardian Add-in.

Safe Online respects all wishes for the confidentiality of personal data and we strive to ensure that all personal data is processed securely and appropriately.

Who is responsible for your data

MailGuardian is deployed by an organisation for its own staff. That organisation decides why and how the Add-in is used and is the data controller. Safe Online operates the service on its instructions and is the data processor. The terms are set out in a Data Processing Agreement between Safe Online and your organisation.

In practice this means that if you want to see, correct or object to data held about you through the Add-in, the request goes to your employer, not to us. We assist them in answering it.

For the Website, and for the contact details you give us directly, Safe Online is the controller.

What is personal data?

Personal data is any kind of information that can be attributed to a natural person, even though this requires knowledge of, for example, a personal identification number or an address.

A distinction is made between "Sensitive Personal Data", "Personal Data" and "Personal Data About Criminal Offences and Convictions". Sensitive Personal Data is information about race or ethnic origin, political, religious or philosophical beliefs or union affiliation, genetic or biometric data used to identify a person, health data, and sexual orientation.

When the Add-in runs, and what it changes

The Add-in activates automatically at the moment you press Send in Outlook, and at no other time. It does not run while you are writing, it does not run in the background, and it does not run on mail you receive. This is what Microsoft calls event-based activation: Outlook starts the Add-in in response to the send event, the Add-in performs the check described below, and it stops.

The Add-in changes nothing in your message. It does not add, alter, remove or reformat any content, any recipient, any attachment or any header. It writes nothing into the body and inserts no text, disclaimer, tag or footer.

If something is found, Outlook shows you a MailGuardian dialog before the message is sent, listing what was found and in which part of the message. This is a Smart Alert. You can review the findings, go back and edit the message, or send it anyway. The Add-in never blocks a message and never sends one on your behalf. If the check cannot complete — the sign-in fails, or the service does not answer in time — the message is sent and the dialog tells you the check did not finish.

What the Add-in reads

At the moment you press Send, and only then, the Add-in reads:

• the body of the message you are sending, and
• the contents of its attachments.

It does not read your inbox, your other messages, your calendar, or anything you have already sent. It does not run when you are not sending.

What leaves your device

The text of the message body and of its attachments is sent to Safe Online's service for analysis. That service runs in the European Union (Stockholm, Sweden). The text is analysed in memory and discarded when the answer comes back. It is not written to storage, and it is not written to our logs.

Where a possible health detail is found, a short extract of the message text is sent to a second Safe Online service for a confirming check. This is the special-category check required by Article 9 of the GDPR. The extract is at most about 600 characters of the surrounding text, it is sent to a named-entity model that Safe Online operates itself, and that service runs in the European Union (Frankfurt, Germany) on infrastructure supplied by Render Services, Inc. The extract is analysed in memory and discarded when the answer comes back. It is not written to storage and it is not written to our logs. No third party reads it: Render supplies the machine, not the analysis.

Attachments that cannot be read as text — a scanned document or a photograph — are additionally sent to Microsoft's Azure AI Document Intelligence service (European Union — West Europe region, which Microsoft operates in the Netherlands) to convert the image into text. Word documents (.docx), plain text files and PDFs that contain a real text layer are read directly on our own service and do not go through this step. Microsoft retains a submitted document for up to 24 hours, encrypted and in the same region, in order to return the result, and states that customer data is not used to train Microsoft's models.

The formats that are read are: Word documents (.docx), PDFs, plain text (.txt), comma-separated files (.csv), Markdown (.md), web pages (.html, .htm, .xhtml) and images. For a web page, the tags are stripped and only the visible text is checked.

Some attachment formats are not checked at all. Spreadsheets (.xlsx), legacy Word files (.doc) and any format not listed above are not opened by the Add-in, are not sent anywhere, and are not scanned for personal data. The message is sent normally and no warning is shown for their contents.

What never leaves your device: the subject line of the message, its message identifier, and the filenames of its attachments. None of these is sent to us, and none is stored.

The recipients are a limited exception, and only when you send feedback. If you choose to tell us that a detection was right or wrong, the display names on the To, Cc and Bcc lines — and your own display name — are sent with that feedback for one purpose: so that the server can blank those names out of the extract of message text before it is stored. The addresses are never sent, the names are never stored, and they are used for nothing else. If you send no feedback, no recipient information leaves your device at all.

What Personal Data do we collect and keep?

If no warning appears, nothing is kept. A check that finds nothing leaves no record of any kind.

Where a warning is shown, we keep:

• Warning Data: the category of what was detected — for example "CPR number" — and a placeholder in place of the value, such as [CPR:6-4]. Never the number itself, and no part of the surrounding message. Also the team, an internal identifier for the user, and the time.
• Feedback Data: where a user chooses to send feedback on a detection — telling us it was right or wrong — we keep that verdict together with a short extract of the surrounding message text, up to about 600 characters, so that the detection can be judged in context. Detected identifiers inside that extract are replaced by placeholders where the software recognises them; recognition is not guaranteed, and the remaining words of the message are kept as written. The extract is stored against the internal identifier for the user who sent the feedback. Feedback is never sent automatically: it is kept only when a user actively submits it.
• Acknowledgement Data: where a user acknowledges a specific finding, that action and the placeholder form of the finding. No surrounding text.
• Coverage Data: where a message was sent without being checked — because a sign-in failed or the check timed out — the fact that it happened and why, so your organisation can tell whether the protection was working. This contains no message content of any kind.
• Profile Data: for the Website and for support, the name and email address you provide.

Warning Data records that a warning was displayed. It does not record what you then chose to do. If you corrected the message, sent it anyway, or cancelled, the record is identical. The Add-in cannot observe that choice and we do not infer it.

Why do we collect personal data?

To provide the Add-in; to enable your organisation to measure how often warnings occur and report on it internally; to tell your organisation whether the protection was working; and to improve detection accuracy for your organisation.

What we do not do

• We do not use these records to build a profile of you or to assess your performance.
• We do not use your organisation's data to improve detection for any other customer.
• We do not sell data, and Warning, Feedback and Coverage Data are never used for advertising.
• We do not deliberately store any personal identifier in unmasked form. Where our software detects an identifier — a CPR number, a telephone number, an email address — it replaces it with a placeholder before anything is written down. Detection is not guaranteed, and masking is therefore not absolute. An identifier our software fails to recognise, or recognises in the message but not in the surrounding extract, is stored as written; this has happened in testing and been corrected. Words of your message that are not an identifier at all are not masked, and where you submit feedback they are retained in the extract described above.

Who do we share your personal data with?

1. Hosting and storage: all Add-in data is stored and processed by Supabase Pte. Ltd, in the European Union — Amazon Web Services region eu-north-1, Stockholm, Sweden.
2. Optical character recognition: attachments that cannot be read as text are processed by Microsoft (Azure AI Document Intelligence), European Union — West Europe region, which Microsoft operates in the Netherlands. That service runs under Safe Online's own Microsoft subscription, not inside your organisation's Microsoft tenant.
3. Special-category confirmation: where a possible health detail is found, an extract of up to about 600 characters is processed on Safe Online's own named-entity service, hosted on Render Services, Inc., European Union — Frankfurt, Germany. Render provides the hosting; it does not analyse the text and does not retain it.
4. Sign-in: the Add-in authenticates you against your own organisation's Microsoft Entra directory. That is your employer's Microsoft environment under their own agreement with Microsoft, not ours.
5. Legal compliance or dispute: we may share data where required by applicable law, regulation, legal process or governmental request.

No external artificial-intelligence provider analyses your message for personal data. Your message is never sent to OpenAI, Anthropic, Google or any comparable service. The detection is performed by Safe Online's own software, including a named-entity model that Safe Online trains and operates itself on the hosting described above. Microsoft's role is limited to turning a scanned image into text, and only for attachments that cannot be read any other way.

Legal basis

For data processed through the Add-in, your organisation determines the legal basis as data controller, and states it in its own information to staff. For the Website and for direct contact with us, Safe Online processes your personal data on the basis of your consent or where processing is necessary to perform a contract to which you are a party.

How long do we keep personal data?

For Warning Data, Coverage Data and pane answers, after 90 days no record identifies you. The internal user identifier is permanently removed and the time of the event is reduced to a date, so what remains says only that a warning of a given category was displayed somewhere in your organisation on a given day.

Two kinds of record keep the internal user identifier for longer, and you should know which. Where you tell the Add-in to stop flagging a particular number, we keep that instruction — which records who gave it — for up to 730 days, because the suppression has to outlast the warning that prompted it. It holds no message text and no personal data beyond the internal user identifier and a one-way fingerprint of the number. Feedback and acknowledgement records keep the internal user identifier for their whole life and are deleted in full after 90 days.

Feedback Data and Acknowledgement Data work differently. They keep the internal user identifier for their whole life and are not de-identified part-way through; instead the entire record, including the extract of message text, is deleted after 90 days.

Your organisation may configure shorter periods than the ones above, but not longer ones. All personal data is deleted when it is no longer relevant for the purpose for which it was collected.

Protection of personal data

Personal data is encrypted in transit using TLS 1.2 or above, and at rest using AES-256.

Access to the optical character recognition service is authenticated by Microsoft Entra ID credentials only. Shared-key authentication is switched off on that resource, so there is no static API key for it that could be disclosed or misused.

Every record is scoped to the team that produced it, and that scoping is enforced by the database itself rather than by application code alone. The identity a record belongs to is established by our service from a verified sign-in token — it cannot be asserted by the Add-in. Access to production data is limited to named Safe Online personnel under confidentiality obligations, reviewed periodically.

Pseudonymisation is applied by design: detected identifiers are replaced by placeholders before storage, and for Warning and Coverage Data the internal user identifier is removed entirely after 90 days. It is not applied to the free text of a feedback extract, which is retained as written for up to 90 days; where a user's message itself describes, for example, sickness absence, those words are kept. Access to that data follows the controls in this section.

Cross-border transfers

All Add-in data is stored in the EU. Supabase Pte. Ltd is established in Singapore, for which the European Commission has not issued an adequacy decision; where its staff access the hosting environment from outside the European Economic Area for support, that access is covered by the EU standard contractual clauses in Supabase's own Data Processing Addendum.

Your rights as a MailGuardian user

• You are entitled to insight into what personal data we process about you, and to request an extract.
• You are entitled to have inaccurate data about you corrected.
• You are entitled to have your personal data deleted, subject to any legal obligation on us to retain it or to defend a legal claim.
• You are entitled to have your data transferred to another data controller.
• You are entitled to object to, or request restriction of, the processing.

Because your organisation is the data controller for Add-in data, exercise these rights with your organisation; we assist them. Once a record has been de-identified after 90 days we can no longer tell which records relate to which person, and Article 11(2) GDPR applies.

After deletion we may not immediately remove residual copies from active servers or from backup systems; backups are deleted on their own cycle.

Notification of breach of the protection of your personal data

In case of a security breach that may compromise personal data, Safe Online will notify the affected organisation without undue delay, and in any case within 48 hours of becoming aware of it, with information about the extent of the breach, what data is affected, and what has been done to limit possible harm.

Inquiries about personal data

If you want to know more about the personal data we hold or have questions about the processing, please contact Safe Online's privacy officer, Sebastian Allerelli, at sal@safeonline.dk.

Complaint

If you wish to complain about Safe Online's processing and/or use of your personal data, you can do so by contacting the authorities. In Denmark, the relevant government body is Datatilsynet, Borgergade 28, 5, 1300 Kbh K, tel. +45 33 19 32 00. See more at https://www.datatilsynet.dk

Changes to our Cookie and Privacy Policy

Safe Online reserves the right to change or update this Cookie and Privacy Policy. The latest update will always be displayed at the bottom of this page. Where a change materially alters what the Add-in records or for how long, the affected organisations are notified in advance under the Data Processing Agreement.

Contact

Safe Online ApS

Nørrebrogade 47, 1

2200 Copenhagen N

Denmark

Phone: +45 27772737

E-mail: support@safeonline.dk

CVR-no.: DK38589962

Last updated 10 October 2026.