Privacy Policy

Who we are

Fulcrum Mail (“Fulcrum”, “we”, “us”) operates the website and service at fulcrumail.app, including Fulcrum Mail, Calendar, Drive, Docs, Meetings, company workspaces, the Fulcrum Wallet and the “Sign in with Fmail” identity service used by other Fulcrum apps. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.

When a company sets up a Fulcrum workspace for its staff, that company controls its workspace and decides who has access. We process workspace content on the company’s behalf.

Information we collect

Information you give us

• Account details: your name, Fmail or company address, contact email, phone number if you add one, password (stored only as a one-way hash), passkeys and two-step verification settings, profile image and language.
• Workspace and domain details: company name, domains, DNS settings, and registrant contact details when you buy a domain through us.
• Content: email you send, receive, draft or import; calendar events and bookings; files, documents, chat messages, meeting recordings and transcripts you choose to create; contacts and folder or label settings.
• Billing: wallet balance, subscriptions and transaction history. Card payments are processed by Stripe; we do not store full card numbers.
• Support: messages you send us and details you provide to resolve an issue.

Information collected automatically

• Security and service logs: sign-in events, IP address, device and browser type, request timestamps, and audit records of security-relevant actions such as connecting or disconnecting an account. Logs are designed not to contain message bodies, file contents, passwords or access tokens.
• Delivery information: technical message headers, delivery status and spam or malware scanning results needed to send and receive mail.
• Public website analytics: only on our public marketing pages, and only if you accept analytics cookies (see Cookies and analytics).

Information from other services you connect

If you connect or import from another account, we receive only the information you authorise. For a Zoho mailbox import, we use the app password you enter only while the import runs and do not store it. Google data is covered in detail in Google user data.

How we use information

• To provide the service: deliver, store, display and search your mail, calendar, files and documents.
• To run features you turn on or ask for, such as importing mail and calendars, email classification, AI message summaries, read-aloud audio, meeting transcripts and booking availability.
• To secure accounts and the service: authentication, fraud and abuse prevention, spam and malware filtering, rate limits and incident investigation.
• To bill for paid features and manage your wallet.
• To communicate with you about your account, security, service changes and support requests.
• To meet legal obligations.

We do not sell your personal information. We do not use the content of your mail, calendar or files for advertising.

Google user data

Fulcrum Mail offers an optional Connect Google import so you can bring your existing Gmail messages, Google Calendar events and documents into your Fulcrum account. It is not used to sign in to Fulcrum. We access Google data only after you start an import and grant permission on Google’s consent screen.

What we access

• Your Google account email address (openid, email), to show you which Google account is connected and to prevent the import from being attached to the wrong Fulcrum account.
• Gmail, read-only (https://www.googleapis.com/auth/gmail.readonly): your messages, including headers, bodies and attachments; labels; read, starred and other state; thread information; and mailbox history identifiers used to find new messages when you choose “Import again”. We cannot send, delete or change anything in your Gmail account.
• Google Calendar, read-only (https://www.googleapis.com/auth/calendar.readonly): the list of your calendars and the events in the calendars you choose, including times, time zones, recurrence and exceptions, attendees, location, description, conference links and reminders. We cannot create, change or delete anything in your Google Calendar.
• Google Drive, read-only (https://www.googleapis.com/auth/drive.readonly), only if you choose to import documents: the file ID, name, file type, size and download permission of the Google Docs and Word documents in My Drive and Shared with me (not files in shared drives, trashed files or other file types), and the content of each of those documents that can be downloaded and is 5 MB or smaller. Google Docs are exported as Word files; Word files are downloaded as they are. Although this permission would let an app read any file in your Drive, we use it only to list and read these documents. We cannot create, edit, share or delete anything in your Google Drive, and Google sharing settings, revision history and folder structure are not copied.

How we use it

• We use Google user data only to provide the import you requested: to copy your messages into your own Fulcrum mailbox with their folders, labels, read and starred state, dates, threads and attachments; to copy the calendars you select into your Fulcrum calendar; to copy those documents into your private Docs folder in Fulcrum Drive, after a malware scan; to skip messages, events and documents you have already imported; to show import progress and a summary; and, when you choose “Import again”, to fetch only new mail.
• Once imported, a message, event or document becomes part of your Fulcrum account and is treated like any other mail, event or document you store with us. You can then use Fulcrum features on it in the same way, for example search or a summary you ask for.
• We do not use Google user data for advertising, including personalised, retargeted or interest-based advertising.
• We do not sell Google user data, and we do not use it to determine credit-worthiness or for lending purposes.
• We do not use Google user data, including data obtained from Google Workspace APIs such as Gmail, Google Calendar and Drive, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.
• Imported mail is not sent to any AI feature unless you use that feature. Email classification, if you turn it on, applies to newly delivered mail, and to existing mail (including imported mail) only if you choose to classify existing messages. AI summaries and read-aloud audio run only when you open them, turn on AI previews in the focus feed, or start Autoplay. When you use one of these features, the text of the messages involved is sent to the provider listed in Sharing and service providers only to produce that result for you. Imported calendar events and documents are not sent to any AI provider.
• If you connect an AI agent or another app to your Fulcrum account and approve Mail, Calendar or Drive permissions for it, that app can read the content those permissions cover, which can include content you imported from Google. This happens only at your direction, within the permissions you approve, and you can remove the app’s access at any time.

Who can see it

We do not allow people to read your Google user data unless you give us explicit permission for specific messages (for example, when you ask support to investigate a problem), it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymised for internal operations. Staff access to customer content is restricted to the people who operate the service.

Sharing and transfer

We transfer Google user data only as necessary to provide or improve the user-facing features described above (including to an app you connect yourself), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you. Imported data is stored on our own infrastructure and with the hosting providers listed in Sharing and service providers, who process it only on our instructions.

How we protect it

• Google sign-in uses OAuth with a unique state value and PKCE. We request only the read-only permissions for what you choose to import (mail, calendars or documents), and only when you start an import.
• We store the Google access and refresh tokens encrypted at rest with an application encryption key, and never write them to logs.
• Every import job and Google connection is tied to your Fulcrum account; other users, including other members of your company workspace, cannot use your connection or see its progress.
• Imported mail, events and documents are stored in our Australian-hosted infrastructure with the same protections as the rest of your account.

Disconnecting and deleting

• Choose Disconnect in Settings at any time. We ask Google to revoke Fulcrum Mail’s access, stop any import in progress and delete the stored tokens immediately. Messages, events and documents already copied into Fulcrum stay in your account until you delete them.
• You can also remove Fulcrum Mail’s access at any time from your Google account at myaccount.google.com/permissions.
• To delete imported data, delete the messages, folders, events or documents in Fulcrum, or ask us to delete your account (see Retention and deletion).

Sharing and service providers

We share personal information only with people you choose (for example, recipients of your email, attendees of your events or people you share a file with), members of a company workspace as configured by its administrators, and the service providers below, who process information for us under contract:

• Hosting and storage: Vultr (servers in Sydney, Australia) and Amazon Web Services (encrypted storage and backups in the Sydney region). Video meetings run on LiveKit media servers that we operate on our own Vultr infrastructure.
• Network and DNS: Cloudflare, which carries traffic to fulcrumail.app and provides DNS, network protection and, if you buy one through us, domain registration.
• Email delivery: SMTP2GO, to deliver outgoing mail and account emails.
• Payments: Stripe, for card payments, subscriptions and top-ups.
• Optional AI features, each used only when you use or turn on that feature: Groq (message summaries and voice command transcription), ElevenLabs (read-aloud audio) and TypeSafe (email classification).
• Meeting assistants: if you invite an AI assistant into a meeting, Deepgram transcribes speech and Fish Audio produces the assistant’s voice. What is said goes to the Fulcrum Sessions assistant you invited, and meeting knowledge is saved to a Fulcrum CRM organisation only if you connect one.
• Phone verification: Twilio, to send SMS verification codes.
• Website analytics: Google Analytics, on our public marketing pages only and only if you accept analytics cookies.

Some providers may process information outside Australia, for example in the United States. Where that happens we take reasonable steps to ensure they protect it consistently with the Australian Privacy Principles. We may also disclose information when required by law or to protect the rights, property or safety of our users, the public or Fulcrum.

Storage, location and security

Our primary servers and storage are in Sydney, Australia. We use encryption in transit (TLS), encryption of stored secrets and backups, access controls that separate company workspaces and personal accounts, malware scanning of attachments, and audit logging of security-relevant actions. No system is perfectly secure; if we become aware of an eligible data breach we will notify affected users and the Office of the Australian Information Commissioner as the law requires.

Retention and deletion

We keep your content for as long as your account is active, or until you delete it. Deleted content is removed from the live service and then from our encrypted backups as those backups expire. Security and audit logs are kept for as long as needed to protect the service and meet legal obligations. Billing records are kept as required by Australian tax law.

To delete your account and its content, email [email protected] from your account address. If you belong to a company workspace, your company administrator may control deletion of workspace content.

Your choices and rights

• You can access, correct and update most account information in Settings.
• You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it, by contacting us.
• You can turn optional features such as classification, AI summaries, read-aloud audio and connected accounts on or off at any time.
• If you are not satisfied with our response to a privacy concern, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in the European Economic Area, the United Kingdom or a similar jurisdiction

Where the GDPR or a similar law applies to you, you also have the right to:

• access your personal data and receive a copy in a commonly used, machine-readable format (data portability);
• have inaccurate data corrected and, in many cases, have your data erased;
• restrict our processing of your data, or object to processing based on our legitimate interests;
• withdraw your consent at any time where we rely on it, for example for a connected account or analytics cookies, without affecting processing that took place before;
• lodge a complaint with your local data protection authority.

We process personal data to provide the service you signed up for (performance of a contract), to secure and improve the service (legitimate interests), to meet legal obligations, and with your consent for optional features such as connected accounts and analytics cookies. To exercise any of these rights, contact us at [email protected]. We may need to verify your identity first, and we will respond within the time the applicable law requires.

Cookies and analytics

The signed-in app uses essential cookies and local storage only, for sign-in sessions, security and your preferences. On our public marketing pages we ask before using Google Analytics. If you accept, it records anonymous page visits with advertising features turned off; if you decline, no analytics cookies are set. Analytics never runs inside your mailbox, calendar, files or account pages.

Children

Fulcrum Mail is not directed at children under 16, and we do not knowingly collect their personal information without the consent of a parent, guardian or the school or organisation providing the account.

Changes to this policy

We may update this policy as the service changes. We will post the new version here with a new date and, for significant changes, tell you by email or in the app before they take effect.

Contact us

Questions, requests and complaints: [email protected]. See also our Terms of Service.