Privacy policy

LAST UPDATED 16 SEPTEMBER 2026

Golgi is an email client for commercial real estate professionals. To do its job it connects to your existing mailbox and reads your email. This policy explains exactly what we access, what we do with it, where it lives, and how you get rid of it.

The short version. We read your email so we can show it to you and identify the properties being marketed in it. We also organise your mailbox: Golgi automatically files listings out of your inbox as it identifies them, and archives a message in your mail account when you press Archive. We do not sell it, we do not use it to train machine learning models, we do not share it with advertisers, and we do not use it for anything other than providing Golgi to you.

Who we are

Golgi is operated by ZN Labs, LLC (DBA Golgi), Maryland, United States. You can reach us at hello@golgimail.com about anything in this policy.

For individuals in the European Economic Area and the United Kingdom, ZN Labs, LLC is the data controller for account data, and acts as a processor for the mailbox content you direct us to read on your behalf. Business customers may request a data processing agreement at the address above.

What we access, and why

Data	Why we need it
Message headers — sender, recipients, subject, date	To display your mailbox and identify who is marketing a property
Message bodies	To display messages and identify property details in marketing email
Attachments — offering memoranda, flyers, rent rolls	To display them and extract property information such as size, price and physical attributes
Folder and label structure, read and flag state	Read to mirror your mailbox accurately. Written back only when Golgi files a listing or you archive a message; other changes you make in Golgi, including flagging, stay inside Golgi.
Your name and email address	To create your account and send from your address
Contacts you correspond with	To provide address autocomplete and link brokers to properties
Technical logs — IP address, device and browser, timestamps	Security, abuse prevention and diagnosing faults

We do not ask for, and do not want, special categories of personal data. Email is unstructured, so such data may incidentally appear in a message; we do not seek it out or use it.

Why we are allowed to process it

Where European or United Kingdom law applies, we rely on: performance of a contract with you, to provide the service you signed up for; our legitimate interests in securing the service, preventing abuse and diagnosing faults, balanced against your rights; and your consent where we ask for it specifically, which you may withdraw at any time by disconnecting the mailbox.

Google user data specifically

If you connect a Gmail or Google Workspace account, Golgi requests Gmail scopes that allow it to read, compose, send and modify mail in that account. We use that access solely to provide the Golgi email client and its property-intelligence features to you.

Golgi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger or acquisition. The providers we use for that purpose are named below.
We do not use Google user data for advertising.
We do not allow humans to read Google user data except in the narrow circumstances described under Human access below.
We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine learning models.

How we use artificial intelligence

Golgi uses automated processing to determine whether a message is marketing an available property and to extract details such as address, size, price and asset class from that message and its attachments. That processing runs on a schedule, whether or not you have Golgi open.

Message content and attachments are sent to our AI provider for that purpose and are processed only to return a result to your workspace. Under our agreement with that provider, your content is not used to train their models and is not retained beyond what is needed to process the request.

This processing produces records only in your own workspace. Your email content is not pooled with other customers' data and does not improve any system outside your account.

Automated processing is not always right, and it does not make decisions that produce legal or similarly significant effects about you. You can correct any property record, and you can ask us to explain how a particular record was produced.

Human access

No person at Golgi reads your mail as a matter of course. There are three exceptions, and they are narrow:

With your explicit permission, for a specific message or problem you have asked us to look into.
Where it is necessary for security — investigating abuse, a suspected breach, or a threat to the service.
Where the law requires it.

Access under any of these is limited to the people who need it and is logged.

Who we share it with

We do not sell your data, we do not share it for cross-context behavioural advertising, and we do not give it to advertisers. We use these service providers to operate Golgi:

Provider	What they do	Where
Supabase Inc.	Database, file storage and authentication	United States
Lovable	Application hosting and delivery	United States
Anthropic PBC	The AI processing described above	United States
Microsoft and Google	Only the mailbox you connect, as its provider	Per their own terms

Each is bound by contract to use the data only to provide that service to us. We will keep this list current; material additions are notified under Changes below.

We may disclose data if legally required to do so, and would notify you unless prohibited.

If Golgi is acquired or merged, your data may transfer with the business. You would be told before it became subject to a different privacy policy.

International transfers

We store and process data in the United States. Where data is transferred from the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where applicable, together with the safeguards our providers maintain.

Where your data lives, and how it is protected

Golgi stores data on infrastructure operated by Supabase Inc. in the United States. Data is encrypted in transit and at rest. Each customer's data is isolated at the database level, enforced by the database itself rather than by application code. Mailbox credentials are held in storage that the application front end cannot read.

No service is perfectly secure, and we do not claim otherwise.

If a breach affects your personal data, we will notify you and any regulator required to be told, without undue delay and within the time limits the applicable law sets.

How long we keep it


Your account and its data	While your account is active
Mail from a mailbox you disconnect	Deleted within 30 days
Property records built from that mail	Kept, unless you delete them or your account — see below
Everything, after you delete your account	Deleted within 30 days
Encrypted backups	Purged on their own cycle, within 90 days
Technical logs	Up to 12 months

Property records are treated differently from mail, deliberately. A property record is what Golgi built for you; it is not a copy of your mailbox. Disconnecting a mailbox stops us reading it and removes the mail we hold from it, and your property database survives. If you want the property records deleted too, ask us, or delete your account.

We keep records we are legally required to retain, for as long as the law requires.

Your controls

Disconnect a mailbox at any time from account settings. Golgi immediately stops accessing it.
Revoke access from your provider — for Google at myaccount.google.com/permissions, for Microsoft at myapps.microsoft.com.
Get a copy of your data, in a machine-readable format, by writing to hello@golgimail.com.
Delete your account and all its data by writing to hello@golgimail.com.
Correct anything that is wrong, in the app or by writing to us.

Self-service export and deletion are being built into account settings. Until they ship, we do both on request, within 30 days.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, obtain a portable copy, object to or restrict certain processing, withdraw consent, and not be discriminated against for exercising any of these.

Write to hello@golgimail.com. We will verify your request against the email address on the account, and respond within 30 days, or 45 days where United States state law allows and we tell you why. An authorised agent may act for you with written proof.

If we refuse a request, you may appeal by replying to our decision. We will respond to an appeal within 45 days. Residents of the European Economic Area and the United Kingdom may also complain to their supervisory authority; residents of some United States states may contact their Attorney General.

We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under United States state privacy law, and have not done so in the preceding twelve months.

Children

Golgi is a business product and is not directed to anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we delete it.

This website

golgimail.com sets no cookies, runs no third-party analytics, and embeds no advertising or social media trackers. Fonts and scripts are served from our own domain, so loading this site does not reveal your visit to any other company. Our hosting provider keeps standard access logs, including IP addresses, for security and diagnostics.

Signing in to the Golgi application itself requires a session cookie. Its only purpose is to keep you signed in.

Changes

If we make a material change to this policy we will notify account holders by email before it takes effect, and update the date at the top.

Contact

hello@golgimail.com