Last updated: 19 August 2026.
1. Who is responsible?
BYGGAI AS, organisation no. 933 941 116, Øvre Nedmarken 12, 3370 Vikersund, Norway, provides epostAI. Contact [email protected].
BYGGAI AS is controller for the website, customer relationship, subscriptions, access administration, support and secure operation. When an organisation uses epostAI on email or other data in its Microsoft 365 account, that organisation is normally controller and BYGGAI AS is processor under a data processing agreement.
2. Summary
- Core processing is initiated by the user and concerns the email or text opened or selected.
- Content is sent securely through the epostAI backend to the active AI provider. The current production provider is the OpenAI API.
- Optional Microsoft Graph modules may access inbox previews, correspondence, drafts, folders or calendar data after the required user or administrator consent.
- epostAI does not send email automatically and does not use customer content to train its own models.
3. Data we process
Website and enquiries
Hosting logs may include IP address, time, browser and device information. We also process the name, business, email address and message you submit in an order, demo request or support enquiry.
Account, access and security
We process business email, name, Microsoft tenant and object identifiers, roles, modules, access status, masked security events, errors, endpoint and timestamp, plus subscription and billing administration.
Service content
Depending on the function used, processing may include subject, sender, date, email or draft text, selected PDF/image attachments, prompts, tone, templates, style samples and AI output. Optional Graph modules may process inbox metadata and previews, correspondence history, sent style samples, calendar data and necessary Microsoft identifiers. Agent modules may persist metadata such as subject, sender, category, reason, action, message/conversation ID, rules, corrections and follow-up state; email bodies are not stored in the agent log.
Local Outlook storage
Profile choices, language, tone, theme, templates, some working drafts and optional relationship history may be stored in the Outlook add-in's browser storage until the user removes them, clears browser data or uninstalls the add-in.
4. Purposes and legal bases
We process data to provide and secure the service, administer customers and subscriptions, provide support, prevent misuse, troubleshoot and meet legal obligations. Contract data is processed to enter into or perform a contract. Account, employee-user, support and security data is normally processed on legitimate interests in providing and protecting the service. Statutory records are processed to meet legal obligations. Where consent is used for an optional function, it may be withdrawn.
Data you must provide – and what happens if you do not
Business email and Microsoft identifiers are normally required to create and secure access; without them the user cannot sign in. Contact and invoice data are required for a paid agreement. Email content, attachments and optional Microsoft Graph permissions are not statutory requirements: they are processed only when a user selects a function, but that function cannot work without the required content or consent. Other data are voluntary unless Norwegian law requires records.
For email data processed on the customer's behalf, the customer determines the legal basis and purpose. BYGGAI AS follows the customer's documented instructions and the data processing agreement.
5. Microsoft access
The Outlook manifest permits the add-in to read the open item and insert text into the draft being edited. Optional Graph modules may, after consent, use delegated permissions such as Mail.ReadWrite and Calendars.ReadWrite. The Microsoft token may include all delegated scopes consented by the administrator; epostAI then enforces its own per-user module controls. Depending on enabled modules, the service may read inbox and sent items, create reply drafts, move messages to epostAI folders and create tentative calendar events without attendees.
Customer-mailbox functions and the sorting agent do not use Mail.Send and do not automatically send customer email or meeting invitations. A separate administrator invitation service may, when configured, use Microsoft Graph sendMail to send epostAI invitations; it is not used to send ordinary customer email.
6. AI provider and content retention
The production service currently uses the OpenAI API. For ordinary AI calls, epostAI processes content and output in memory and does not persist the full content in its own backend after the response. OpenAI states that API data is not used for training unless the customer explicitly opts in, and that standard abuse-monitoring logs may retain content for up to 30 days. epostAI has not confirmed that Zero Data Retention is enabled.
7. Retention
- Email text, selected attachments, prompts and AI output in ordinary calls: not persisted by the epostAI backend after the request; OpenAI's standard abuse-monitoring period may be up to 30 days.
- Aggregated function/token usage without email content: up to 30 days.
- Agent metadata, rules, follow-up state and historical cutover/backup files: stored per user when agent functions are enabled. Automatic time-based deletion is not implemented in the current solution. Data remain until an administrator deletes them, the environment is retired or the Customer requires deletion under the agreement.
- Account, access, invitation and administration data: retained while necessary for access, security, customer administration and records. The current solution does not enforce one automatic 90-day limit for all these categories.
- Hosting, runtime, sign-in and error logs: retained while necessary for operations, troubleshooting, security or a specific incident, then deleted or anonymised when identifiable data are no longer required. The exact production log period must be agreed with production customers.
- Support records: retained while the matter is handled and as long as documentation is necessary. The current solution does not enforce one automatic 24-month deletion period.
- Accounting records: for the period required by Norwegian law.
- Local Outlook storage: until removed by the user or add-in uninstall/browser-data deletion.
8. Providers and international transfers
- Microsoft – Outlook, Microsoft 365, Entra ID and Microsoft Graph.
- OpenAI API – the active production AI provider at the latest check.
- Infrastructure provider – operation of app.epostai.no.
- Website platform – operation of the public epostai.no website.
- Optional integrations – for example Tripletex or elektroAI, only when configured and enabled.
The final legal provider register – including contracting entity, processing country, subprocessors and transfer mechanism per provider – has not been fully verified in this website package. Before production processing on behalf of a Customer, BYGGAI and the Customer must agree this register and any transfer outside the EEA. We therefore do not claim that SCCs, adequacy or another mechanism has already been verified for every provider.
9. Security
Measures include encrypted transport, Microsoft-based sign-in, per-user and per-module access controls, rate limits, secrets outside client code, masked identities in runtime logs and encrypted provider-key storage. No service is risk-free. Customers must control access and avoid data requiring a higher security level than agreed.
10. Sensitive data
epostAI is designed for ordinary professional email. Do not use it for health data, personnel matters, criminal records, payment-card data, passwords, authentication keys or similarly sensitive content unless the customer has documented the legal basis, risk, data processing agreement and required safeguards with BYGGAI AS.
11. Automated decisions
epostAI produces suggestions, categories and drafts and is not intended to make decisions producing legal or similarly significant effects. Users must review text before sending. When the Customer explicitly enables agent modules, a user-triggered run may automatically move messages, execute rules or create tentative calendar events; actions are logged and may be undone where supported. The Customer controls enabled modules/rules and the required human follow-up.
12. Your rights
Where applicable, you may request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Contact [email protected]. We normally respond within one month and may verify your identity. If your request concerns email controlled by your employer or another customer, contact that organisation first. You may complain to the Norwegian Data Protection Authority.
13. Data processing agreement
A completed data processing agreement and signing process are not documented as part of this website package. Until such an agreement is prepared, reviewed and entered into, epostAI must not be used in production where BYGGAI AS acts as processor for the Customer. Pilot or test use must be separately agreed and use approved test data. Contact us for current status and contractual basis.
14. Changes
We update this notice when data flows, purposes or providers change. Where practicable and legally required, material changes are communicated in the service or to the Customer's contract contact before they take effect.