Privacy policy

Effective October 31, 2026

SkyHelm MailGuard checks email for phishing and fraud. SkyHelm runs it for organizations that use Microsoft 365 or Google Workspace, and for people who protect their own Gmail with it. This page says what MailGuard reads, what it keeps and for how long, who else handles it, and what you can do about it.

What MailGuard reads

• Your email. MailGuard reads each message that arrives in a mailbox it protects: its sender, recipients, subject, text, links and attachments, and the headers that say where it came from. It reads them to decide whether a message is phishing, fraud or spam, and why.
• Your mailbox settings. Its filters, forwarding, delegates and send-as addresses, to notice when someone else set them up to read or redirect your mail.
• Your account. Your name and email address from Microsoft or Google when you sign in. For an organization, MailGuard also reads its directory (people's names, addresses and job titles) and, if the organization allows it, its sign-in and audit logs, to notice accounts that look taken over. Google does not give these for personal Gmail accounts, so MailGuard does not read them there.

MailGuard does not send, delete or forward your mail. With your permission it can move a suspicious message out of your inbox or label it, and you can move it back.

What MailGuard keeps, and for how long

• Verdicts: for each message, its sender, recipients, subject, what MailGuard decided and why. Kept 90 days, longer only while the message is held in quarantine.
• Flagged messages: a copy of each message MailGuard flagged, so it can be looked at again. Kept as long as its verdict. Messages MailGuard did not flag are not kept.
• Who corresponds with whom: which addresses have written to each other, and how often, so that a first message from a stranger stands out. No message content. Kept while the account exists.
• Account security records (organizations only): sign-ins 90 days, security alerts 180 days, closed incidents one year.
• Actions: a log of what MailGuard and people did to messages (moved, labeled, released), kept while the account exists.

Database backups are kept for up to 7 days, then deleted.

Who else handles your data

• Microsoft Azure hosts MailGuard's server and database, in the United States (South Central US).
• SkyHelm AI: when an organization or person turns AI review on, flagged messages are sent to SkyHelm AI for a second opinion. They are processed only to give that opinion and are not used to train AI models.
• SendGrid (Twilio) delivers MailGuard's notification emails.
• Apple and Google deliver push notifications, if you use the MailGuard app.
• Domain registries and DNS: MailGuard asks public registries when the domains in a message were registered, and looks the domains up in DNS. Only domain names are sent, never messages.

SkyHelm does not sell your data, show you ads, or share your data with anyone else, except where the law requires it.

Who at SkyHelm can see it

For an organization, its own administrators decide who sees its mail in MailGuard. For a personal Gmail account, no one at SkyHelm reads your messages unless you report one to us, or the law requires it. Every person's access is logged.

Google user data

MailGuard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. MailGuard uses Gmail data only to protect that mailbox from phishing and fraud and to show you what it found. It does not use it for advertising, does not sell it, and does not use it to train general AI models; people read it only as described above.

Your choices

• Stop at any time. A personal account's owner can delete it in Settings: MailGuard removes its access to your Google account and deletes what it kept at once. You can also remove MailGuard from your Google account's connected apps; MailGuard then pauses, and deletes your data after 30 days unless you reconnect.
• Organizations stop by asking SkyHelm, or by removing MailGuard's access in Microsoft 365 or Google Workspace. SkyHelm then deletes the organization's data.
• Ask us what we keep about you, to correct it, or to delete it, at casey.davis@skyhelm.com. People whose mail an organization protects should ask that organization first.

Security

MailGuard reaches Microsoft and Google only through a gateway that allows the calls it needs and nothing else. Tokens that give access to your mail are encrypted. Connections are encrypted in transit.

Children

MailGuard is not meant for children under 13, and SkyHelm does not knowingly protect their accounts.

Changes

If this policy changes in a way that matters, we will say so here, with the new date, before it takes effect, and email people with a personal account.

Contact

SkyHelm · casey.davis@skyhelm.com