Privacy Policy
- DictateMail does not require an account. We do not ask for your name or email address.
- Your brief (typed text or dictated audio) is sent to our server only to generate your email. It is not stored after the response is returned.
- We do not sell your data, do not use it for advertising and do not track your browsing.
- Settings are stored locally in your browser.
1. Who is responsible
The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:
Wimbler GmbH
Königstr. 133
90762 Fürth, Germany
Email: support@wimbler.de
For any questions about privacy or to exercise your rights, please contact us at the email address above.
2. What DictateMail does
DictateMail is a browser extension for Chrome and Edge. You type or dictate a short brief in your own language, and DictateMail turns it into a complete email, optionally translated into another language. The result is shown in the browser side panel so you can copy it into any email client.
The extension does not read or change the content of websites you visit, including your email client. It only communicates with our own server at api.dictamail.app.
3. What data we process and why
3.1 Your brief and generated email
When you click to generate an email, the extension sends the following to api.dictamail.app:
- the text of your brief, or an audio recording if you use dictation;
- your chosen options (for example tone and target language).
Our server forwards the audio to a speech-recognition provider and the text to an AI language-model provider (see section 4), returns the generated email to your browser, and then discards the content. We do not store your briefs, audio recordings or generated emails on our servers.
Legal basis: Art. 6(1)(b) GDPR (providing the service you request).
3.2 Microphone
The microphone is only used while you actively record a dictation after pressing the record button and granting permission in your browser. We never record in the background.
3.3 Anonymous installation token and usage quota
On installation, the extension creates a random identifier (token). It is not linked to your name, email address or Google account. We use it to authenticate requests to our API, to count how many emails have been generated per month (to enforce the free quota) and to prevent abuse. On our server we store only this token, the usage counter and related timestamps.
Legal basis: Art. 6(1)(b) GDPR (providing the service) and Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse).
3.4 Technical connection data
When the extension connects to our server, your IP address and standard technical information (time of request, browser type) are necessarily processed in order to deliver the response. This data is used only for operating and securing the service and is not combined with other data.
Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the service).
3.5 Data stored locally in your browser
Using the browser's storage API, the extension saves your settings (for example preferred tone and languages), the anonymous token and your remaining quota on your own device. This data stays in your browser and is deleted when you uninstall the extension.
3.6 Website dictamail.app
Our website does not use advertising or analytics cookies. The welcome page shown after installation may communicate with the extension only to check whether the extension icon is pinned to the toolbar and to show the matching instructions. Our web server (hosting provider see section 4) processes connection data as described in section 3.4.
4. Service providers
We use the following processors. They process data only on our behalf and only to provide the service.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| netcup GmbH, Karlsruhe | Server hosting for dictamail.app and api.dictamail.app | All data sent to our server | USA |
| Deepgram, Inc. | Speech-to-text for dictation | Audio recordings | USA |
| Anthropic, PBC | AI model (Claude) for writing and translating emails | Text of the brief and options | USA |
Our server is located in a netcup data center in the USA. netcup GmbH is a company based in the EU and processes data on our behalf under a data processing agreement (Art. 28 GDPR). Transfers to the USA are based on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). These providers may retain data for a limited time in accordance with their own terms, for example for security and abuse monitoring. They are not permitted to use your data for advertising.
5. What we do not do
- We do not sell or rent your data to anyone.
- We do not use your data for advertising, profiling or creditworthiness assessment.
- We do not collect your browsing history or read the content of web pages.
- We do not use your data for any purpose unrelated to writing and translating emails.
6. Chrome Web Store User Data Policy
The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
7. Data retention
- Briefs, audio and generated emails: not stored by us; deleted once your request has been processed.
- Anonymous token and usage counter: stored while you use the service; deleted at the latest 12 months after the last use.
- Technical connection data: kept only as long as needed for operation and security, as a rule no longer than 14 days.
- Local browser data: removed when you uninstall the extension.
8. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, contact support@wimbler.de. Requests are handled by email: write to us at this address and describe your request. Because the extension works without an account and we do not know who you are, we will reply by email and agree with you on how to identify the data that belongs to you.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or at our place of business.
9. Children
DictateMail is not directed at children under 16, and we do not knowingly process their data.
10. Security
All communication between the extension and our server is encrypted (HTTPS/TLS). API keys of our providers are stored only on our server and are never shipped in the extension.
11. Changes to this policy
We may update this Privacy Policy when the service changes. The current version is always available at dictamail.app/privacy, and the effective date at the top shows when it was last changed.