Per My Last Email Privacy Policy
Effective date: 11 November 2026
Last updated: 11 November 2026
The short version
- Per My Last Email is an app for people aged 16 and over. It turns blunt messages into polished corporate email, and decodes corporate email back into plain language.
- There are no accounts. We never ask for your name, email address, phone number, contacts or location.
- To make a translation, the text you type or dictate is sent over an encrypted connection to our server (run on Cloudflare) and from there to Scaleway, a French cloud provider that runs the AI model in its Paris data centres. We do not store your text, and neither does Scaleway. It is used to produce the translation and is then discarded.
- Your history of translations stays on your device. We cannot see it. You can delete it at any time in Settings.
- The app creates a random device id (not linked to your name or to the phone's hardware). Our server uses it to count your daily free translations, to know if you have Premium, and to credit rewarded ads. To limit abuse, the server also keeps a one-way hash of your IP address combined with the date, never the IP address itself, and deletes it within 4 days. You can delete your server records at any time with Delete my data in Settings (section 10).
- Free users see ads from Unity LevelPlay. Ads are only personalised if you choose Allow in the app (and, on iPhone, also allow tracking in Apple's prompt). You can change this at any time with the Personalised ads switch in Settings.
- Premium subscriptions are sold by Apple or Google and managed through RevenueCat. We never see your payment details.
- We do not sell your personal information, and we do not use your text to train AI models.
- If you are in the United States, see the Notice for US residents (section 17).
The rest of this page explains each point in detail.
1. Who we are
Per My Last Email ("the app") is published by:
- Publisher: Zero & One FZCO, Sobha Ivory Tower 1, Office 603, Business Bay, Dubai, United Arab Emirates. Zero & One FZCO is managed in full by NTAM GLOBAL S.L., Plaza Europa, 9, Planta 15, Puerta D, 08908 L'Hospitalet de Llobregat, Barcelona, Spain.
- Contact email: games@ntam.es
In this policy "we", "us" and "our" mean the publisher above. We decide how and why your personal data is used in the app, which makes us the "controller" under data protection law such as the EU General Data Protection Regulation (GDPR).
2. Who the app is for
The app contains strong language and adult workplace humour and is meant for people aged 16 and over. When you first open it, the app asks you to confirm that you are 16 or older. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has used the app and you want any related data removed, write to us at games@ntam.es.
If you are in the United States, see also section 17: we do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA), and we do not sell or share personal information of anyone we know is under 16.
3. What happens to the text you translate
What is sent. When you tap to translate, the app sends to our server: the text you entered (up to 4,000 characters), the mode (polish or decode), the persona and the "spice" level you chose, your device id (section 4) and your time zone offset (used to work out when your day starts).
Where it goes. Our server runs on Cloudflare Workers. It checks your daily allowance, checks the text against a filter for hate speech and threats, and sends the text, the persona instructions and the settings to Scaleway Generative APIs, which runs the language model that writes the translation in Scaleway's data centres in Paris, France. Your device id and your IP address are not sent to Scaleway. The result comes back to the app through our server.
What we keep. Nothing of the text. Our server does not save the text you send or the translation it returns, and our error messages are written so that they never contain your text. Scaleway processes the text on our behalf under a data processing agreement. Its terms for this service say it does not keep or log requests or results after processing, does not use them to train or improve AI models, and does not give the model makers access to them. If Scaleway detects malicious activity or a problem affecting its service, it may keep the content of a request temporarily to find the cause.
Please do not paste confidential information. The app reminds you of this when you first open it. Do not enter client data, trade secrets, anything covered by a non-disclosure agreement, passwords, or sensitive personal data about yourself or anyone else (for example health information). The text has to leave your device to be translated.
Information about other people. Emails you paste often contain other people's names, email addresses and what they wrote. We process that text in the same way as your own: only to produce your translation, without storing it. We do not use it to contact those people, to build profiles or for advertising. The latest version of the app shows the reminder "Don't paste other people's private details." under the text box, and our Terms of Use make you responsible for having the right to submit what you paste. If you are someone whose information was pasted into the app, we hold no copy of it after the translation is returned; you can still contact us at games@ntam.es.
On your device. The app saves your last 50 translations (your text and the result) in its private storage on your device so you can find them again in the Saved tab. This history is never sent to us. It may be included in your device's own backups (for example iCloud or Google backup), which are controlled by Apple, Google and your device settings.
4. The device id, your allowance and abuse limits
Device id. On first launch the app creates a random identifier (a UUID) and stores it in the device's secure storage (the Keychain on iPhone and iPad, the Keystore on Android). It is not your phone's advertising identifier and it is not derived from your hardware. We use it instead of an account.
What our server stores (in a Cloudflare D1 database located in Western Europe):
| Record | What it contains | Why |
|---|---|---|
| Device record | Device id, the time it was first seen, the date your Premium access ends (if any), and the time of the last subscription update | To know whether you have Premium |
| Daily usage | Device id, the local date, and how many free, Premium and courtesy translations were used that day | To apply the daily allowance |
| Ad credits | Device id and the number of extra translations earned from rewarded ads | To give you the translations you earned |
| Rewarded ad codes | A one-time code, the device id, when it was created and when it was used | To make sure each rewarded ad earns exactly one credit |
| Rewarded ad events | The ad network's id for a reward event and when it was received | To stop the same reward being credited twice |
| New device count per network | A one-way hash (SHA-256) of your IP address combined with the date, the date, and how many new device ids were created from that address that day | To stop people creating many device ids to get unlimited free translations |
We do not store your IP address itself. Our server also uses your IP address for a short-lived rate limit (a limited number of requests per minute), which Cloudflare holds in memory and which we do not store.
Request logs. Cloudflare keeps technical logs of requests to our server, which we can view in our Cloudflare dashboard. They contain things like the address that was requested and whether the request succeeded. They never contain the body of a request, so they never contain your text. Some addresses include your device id (for example when the app checks your remaining allowance). These logs are kept for 3 days.
5. Dictation, Listen, notifications and sharing
Dictation (microphone). If you tap the microphone, the app asks for permission to use the microphone and speech recognition. Your speech is turned into text by your phone's speech recognition service, not by us:
- On iPhone and iPad, recognition runs on the device when the device supports it. If it does not, Apple's speech recognition service may process the audio on Apple's servers, under Apple's privacy policy.
- On Android, the app uses the device's speech recognition service (usually Google's), which may process the audio on Google's servers, under Google's privacy policy.
We never receive your audio. The recognised text appears in the text box, and it is only sent to our server if you then tap to translate. You can turn off microphone and speech recognition access at any time in your device settings.
Listen (read aloud). Reading a translation aloud uses your device's built-in text-to-speech voice. We do not receive anything from it.
Phrase of the Day. If you allow notifications, the app schedules a daily notification on your device at the time you choose. To get each day's phrase, the app asks our server for the content of a given date. That request does not include your device id. The notification itself is created on your device; we do not use a push notification service and do not collect a push token. You can turn it off in Settings or in your device settings.
Share cards and copy. When you share a card or copy a translation, the image or text is created on your device and goes only where you choose, through your device's share sheet or clipboard. We do not receive it. The app the content goes to (for example a messaging app) handles it under its own policy.
Other data on the device. Your settings (default persona, spice level, voice style, notification time, whether you finished the first-run screens, and your personalised ads choice) and your Bingo card are saved on the device only.
No analytics of our own. The app does not include an analytics or crash reporting tool of ours. The ad service and RevenueCat (sections 6 and 7) receive the technical data described below.
6. Ads
Free users see ads, which pay for the free translations. Premium subscribers see no ads. We use Unity LevelPlay, a service from Unity that works with the ad networks Unity Ads and ironSource Ads (both part of Unity). There are two kinds of ads:
- Rewarded videos (optional). When you run out of free translations, you can choose to watch a short video to earn one more translation. You never have to.
- Full-screen ads. Occasionally, after a translation, a free user may see a full-screen ad.
Your choice about personalised ads. During setup the app asks whether you allow personalised ads. You can change your answer at any time with the Personalised ads switch in Settings, Privacy and legal.
- If you choose Allow: we tell LevelPlay and the ad networks that you consent to personalised advertising. Ad partners may use your device's advertising identifier (the IDFA on iPhone, the Android advertising ID) and other information from your device to choose ads that match your interests and to measure them. On iPhone and iPad, the app then shows Apple's App Tracking Transparency prompt; the advertising identifier is only available if you also allow tracking there.
- If you choose Not now (or have not answered yet): we tell LevelPlay and the ad networks that you do not consent to personalised ads, and we set the "do not sell or share my personal information" signal used under California law. You still see ads, but they are not personalised.
What the ad companies receive. To show an ad, count it, prevent fraud and limit how often an ad repeats, the ad SDK connects to the ad companies' servers from your device. They may receive technical information such as your IP address, device type, operating system version, app name and version, language, and whether an ad was shown or tapped, and, only if you allowed it, the advertising identifier. The app also gives LevelPlay your app device id (section 4) and, for each rewarded video, a one-time code. LevelPlay sends these back to our server to confirm that you finished a rewarded video, so we can credit the extra translation. What the ad companies collect and how they use it is set out in Unity's privacy policy (section 11). Tapping an ad can open a web page or an app store page.
On Android you can also reset or delete your advertising ID in the device's settings (Settings, Google or Privacy, Ads). On iPhone you can change tracking permission at any time in Settings, Privacy and Security, Tracking.
7. Premium subscriptions
Premium is an auto-renewing subscription (monthly or yearly) sold through the App Store or Google Play.
- Apple or Google process the payment. We never see or store your card number, billing address or store password.
- RevenueCat is the service the app uses to manage subscriptions. The app gives RevenueCat your device id as its user id, and RevenueCat receives your purchase records from Apple or Google (such as the product, purchase and renewal dates, store transaction ids, price, currency and country). RevenueCat tells our server when your Premium access starts, renews or ends; our server keeps only the end date and the time of the update (section 4).
- We may see sales reports from Apple, Google and RevenueCat. We use them for accounting, customer support and to understand how the app is doing.
8. Why we use your data (legal bases)
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Producing a translation | The text you send, mode, persona, spice level | Contract: it is needed to provide the service you asked for (GDPR article 6(1)(b)) |
| Applying the free daily allowance, ad credits and Premium | Device id, time zone offset, usage counts, Premium end date, rewarded ad codes and events | Contract (article 6(1)(b)) |
| Selling and managing subscriptions | Device id, purchase records | Contract (article 6(1)(b)), and our legal obligations to keep accounting records (article 6(1)(c)) |
| Preventing abuse and keeping the service secure | Hash of IP address and date, rate limit by IP address, request logs | Legitimate interests: keeping the free service available and protecting it from misuse and fraud (article 6(1)(f)) |
| Showing ads that are not personalised | Technical data the ad SDK needs to show an ad | Legitimate interests: funding the free version of the app (article 6(1)(f)) |
| Personalised ads and access to the advertising identifier | Advertising identifier and the data described in section 6 | Consent: your Allow choice in the app and, on iPhone, Apple's tracking prompt (article 6(1)(a)). You can withdraw it at any time with the Personalised ads switch |
| Phrase of the Day notifications, dictation | Notification and microphone permissions | Your choice in the app and in your device's permission prompts, which you can change at any time |
| Answering your emails | Your email address and message | Legitimate interests: helping you (article 6(1)(f)) |
Where we rely on legitimate interests, you can object (section 10).
9. How long we keep data
| Data | Where | How long |
|---|---|---|
| Text you send for translation | Our server and Scaleway | Not stored: discarded once the translation is returned. Scaleway does not keep or log it, except that it may keep a request temporarily to investigate malicious activity or a service problem (section 3) |
| Translation history, settings, Bingo card | Your device only | Until you delete them in the app or delete the app |
| Device id | Your device | Until you delete the app. On iPhone and iPad, items in the Keychain can remain after an app is deleted, so a reinstall may reuse the same id |
| Device record (device id, when first seen, Premium end date, time of the last subscription update) | Our server | Until you use Delete my data or ask us to delete it. If you have Premium when you delete, we keep only the Premium end date and the time of the last subscription update until that period ends, so the subscription you paid for keeps working |
| Daily usage counts | Our server | Deleted by a daily job once they are dated more than 2 days ago (so within 4 days of their date), or at once with Delete my data |
| Ad credits (number of extra translations earned) | Our server | Until they are used, or until you use Delete my data |
| Rewarded ad codes | Our server | 2 days after they are created, or at once with Delete my data |
| Rewarded ad event ids | Our server | 8 days, then deleted automatically |
| Hash of IP address and date (new device count) | Our server | Deleted by a daily job once dated more than 2 days ago (so within 4 days of their date). They contain no IP address and no device id |
| Subscription events from RevenueCat | Our server | We do not store the events. Each event only updates the Premium end date and the update time in the device record (above) |
| Request logs | Cloudflare | 3 days |
| Purchase records | RevenueCat, Apple, Google | Under their own policies and as needed for tax and accounting law |
| Data received by the ad companies | Unity | Under Unity's privacy policy |
| Emails to us | Our mailbox | Deleted 6 months after we have answered, unless we need them longer to deal with a legal claim |
10. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy,
- correct it if it is wrong,
- delete it,
- restrict or object to how we use it (including where we rely on legitimate interests),
- data portability (receive data you gave us in a common format),
- withdraw consent at any time, for example by turning off Personalised ads in Settings, without affecting what happened before,
- complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (https://www.aepd.es/). You can also complain to the authority where you live or work.
How to use your rights. Email games@ntam.es. We answer within one month (this can be extended by two more months for complex requests, and we will tell you if so).
Things you can do yourself in the app:
- Delete the records our server holds for your device: Settings, Privacy and legal, Delete my data (in the latest version of the app). This deletes your device record, daily usage counts, ad credits and rewarded ad codes on our server and your saved translations on the device. Unused ad credits are lost. A Premium subscription is not cancelled by this: if one is running, we keep only its end date until it ends. Cancel a subscription in your Apple or Google account.
- Delete only your translation history: Settings, Privacy and legal, Delete local history, or delete single items in the Saved tab.
- Stop personalised ads: turn off Personalised ads in Settings.
- Stop notifications, microphone or speech recognition access: in Settings or your device settings.
- Remove everything stored on the device: delete the app.
About records on our server. Because there are no accounts and the app does not show your device id, the quickest way to delete your server records is Delete my data in the app. If your version of the app does not have it yet, or you no longer have the app, email us; if you have bought Premium, sending us the order number from your Apple or Google receipt helps us find the records linked to that purchase. We may ask for information to make sure a request really comes from you; we will not ask for more than we need. If we cannot link any data to you, we will tell you.
United States. See the Notice for US residents (section 17).
11. Third-party services
Cloudflare, Scaleway and RevenueCat process data on our behalf (as our processors or service providers), under agreements that limit them to providing their service to us. Unity decides itself how it uses the data its ad SDK collects, as a separate controller, under its own privacy policy. Apple and Google are separate controllers for the store purchases and the speech recognition they provide. The links below always show each company's current privacy policy.
| Service | What it does in the app | Data it receives | Privacy policy |
|---|---|---|---|
| Cloudflare (Workers, D1 database, logs) | Runs our server and its database and keeps request logs | The data sent to our server (section 3 and 4), your IP address | https://www.cloudflare.com/privacypolicy/ |
| Scaleway Generative APIs (Scaleway SAS, France) | Runs the AI model that writes the translation, in Paris | The text, persona instructions and settings of each translation; not your device id or IP address | https://www.scaleway.com/en/privacy-policy/ |
| Unity LevelPlay, with the ad networks Unity Ads and ironSource Ads (Unity Technologies) | Shows ads and confirms rewarded videos | Technical device data, the app device id, a one-time code per rewarded video, and the advertising identifier only if you allowed it | https://unity.com/legal/privacy-policy |
| RevenueCat | Manages Premium subscriptions | Device id, purchase records | https://www.revenuecat.com/privacy |
| Apple (App Store, speech recognition, text-to-speech) | Sells and bills subscriptions on iPhone and iPad; may process dictation when on-device recognition is not available | Purchase and payment data; audio for dictation in that case | https://www.apple.com/legal/privacy/ |
| Google (Google Play, speech recognition) | Sells and bills subscriptions on Android; usually provides the speech recognition service on Android | Purchase and payment data; audio for dictation | https://policies.google.com/privacy |
If we add or change a service, we will update this policy before the change goes live.
International transfers. Our server's database is in Western Europe and the AI model runs in Paris, France, so the text you translate is processed in the European Union (it passes through Cloudflare's network, which may route it through the data centre nearest to you). Some of the other companies are based in the United States or process data in several countries. Where the GDPR applies, transfers outside the European Economic Area are protected as follows:
| Service | Safeguard |
|---|---|
| Cloudflare | EU-US Data Privacy Framework (Cloudflare is certified, including the UK extension and the Swiss-US framework) and the European Commission's Standard Contractual Clauses in Cloudflare's Data Processing Addendum |
| Scaleway | No transfer: Scaleway processes the text in France under its data processing agreement, which also requires the Standard Contractual Clauses if data ever had to leave the EU |
| RevenueCat | The European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in RevenueCat's Data Processing Addendum |
| Unity | Unity is a separate controller and is responsible for its own transfers, which it describes in its privacy policy |
| Apple, Google | Separate controllers, under their own policies |
You can ask us for a copy of the safeguards at games@ntam.es.
12. Security
All communication between the app and our server uses encrypted HTTPS connections. Our server does not store your text, stores no IP addresses, and keys its records to a random id rather than to your identity. Data on your device is kept in the app's private storage, and the device id is kept in the device's secure storage. No system is perfectly secure, so please keep your device up to date and protected with a passcode, and do not send anything through the app that you would not want to leave your device.
13. Our web pages
This policy, our terms and our support page are plain web pages. They use no cookies, trackers or analytics. The web server may keep basic server logs (such as IP address, time and page requested) for security, for a short period.
14. Contacting us by email
If you email us, we receive your email address and whatever you write. We use it only to reply and help you, and we delete support emails 6 months after we have answered them.
15. Changes to this policy
If we change the app in a way that affects your privacy (for example a new service or new data), we will update this policy before the change goes live and change the "Last updated" date above. If a change needs your consent, we will ask for it in the app. For a material change we will also tell you in the app or in the update notes before it applies.
16. Contact
Questions, requests or complaints about privacy: games@ntam.es.
Postal address: Zero & One FZCO, Sobha Ivory Tower 1, Office 603, Business Bay, Dubai, United Arab Emirates. Managed by NTAM GLOBAL S.L., Plaza Europa, 9, Planta 15, Puerta D, 08908 L'Hospitalet de Llobregat, Barcelona, Spain.
17. Notice for US residents
This section adds to the rest of this policy for residents of the United States, including under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), the California Online Privacy Protection Act (CalOPPA), and the consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with similar laws. Whether or not a particular state law applies to us, we offer the rights below to all US residents.
Personal information we collect (in the last 12 months and going forward):
| Category (CCPA) | What it is in this app | Source | Purpose | Kept |
|---|---|---|---|---|
| Identifiers | The app's random device id; your IP address, used for a short rate limit and stored only as a one-way hash with the date; the advertising identifier, only if you allowed personalised ads | You, your device | Providing the service, the daily allowance, Premium, rewarded ads, security and fraud prevention; advertising | Device id: section 9. IP hash: within 4 days. Advertising identifier: not stored by us |
| Commercial information | Purchase records (product, dates, store transaction ids, price, currency, country) | Apple or Google, through RevenueCat | Providing Premium, accounting | Our server keeps only the Premium end date (section 9); RevenueCat, Apple and Google under their policies |
| Internet or other electronic network activity | Ad requests and whether an ad was shown or tapped, collected by the ad SDK; request logs | Your device | Showing and measuring ads, preventing ad fraud; security | Request logs 3 days; ad data under Unity's policy |
| Contents of messages you enter | The text you type, paste or dictate for translation, which may include an email you received | You | Only to produce the translation you asked for | Not stored (section 3) |
| Inferences | Interests that ad partners may infer for personalised ads, only if you allowed them | Ad partners | Personalised advertising | Under Unity's policy |
Sensitive personal information. The contents of an email or message are "sensitive personal information" under the CCPA when we are not the intended recipient. We use that text only to perform the service you request (the translation), which the CCPA allows without a right to limit, and we never use it to infer characteristics about you or anyone else. Please do not enter other sensitive information (section 3).
Who receives it. We disclose personal information for business purposes to our service providers Cloudflare (hosting), Scaleway (the AI model) and RevenueCat (subscriptions), and to Apple and Google as the stores. Unity receives device and ad data through its ad SDK in the app.
Sale, sharing and targeted advertising. We do not sell personal information for money. If you choose Allow for personalised ads, Unity and its ad networks may use your advertising identifier and device data to show you ads based on your activity across other apps. Some state laws call this "selling", "sharing" (cross-context behavioural advertising) or "targeted advertising".
- Personalised ads are off until you choose Allow. While they are off, the app tells the ad companies that you opt out of the sale and sharing of your personal information, and ads are not personalised.
- To opt out at any time, turn off Personalised ads in Settings, Privacy and legal. On iPhone you can also turn off tracking in Settings, Privacy and Security, Tracking; on Android you can delete your advertising ID.
- Global Privacy Control. The app is not a web browser, so browser privacy signals such as Global Privacy Control do not reach it; the Personalised ads switch is the opt-out in the app. Our web pages use no cookies, trackers or advertising, so there is nothing on them to opt out of, and we do not respond to "Do Not Track" signals because our pages do not track you across sites.
- We do not disclose personal information to third parties for their own direct marketing (California "Shine the Light").
How long we keep it. See the table above and section 9.
Your rights. Depending on your state, you have the right to:
- know and access the personal information we hold about you and how we use and disclose it, and get a copy in a portable format,
- delete it (the quickest way is Delete my data in Settings in the latest version of the app),
- correct inaccurate personal information,
- opt out of the sale or sharing of personal information and of targeted advertising (the Personalised ads switch), and of profiling that produces legal or similarly significant effects (we do not do such profiling),
- not be treated differently for using these rights: you get the same prices and service.
How to make a request. Email games@ntam.es with the subject "US privacy request", or use the in-app controls above. Because there are no accounts, we verify a request by matching the information you give us (for example the order number of a Premium purchase) with the records we hold, and we will ask for no more than we need. You can use an authorised agent: we may ask the agent for your signed permission and ask you to confirm your identity directly. We confirm receipt within 10 business days and answer within 45 days; if we need more time (up to another 45 days), we will tell you why.
Appeals. If we decline your request, you can appeal by replying to our answer or emailing games@ntam.es with the subject "Privacy appeal" within a reasonable time. We will answer the appeal in writing within 45 days (60 days in Colorado if we need the extra time and tell you) and explain our decision. If you are not satisfied, you can contact your state attorney general (for example in Virginia, Colorado, Connecticut, Texas or Oregon).
Children. The app is for people aged 16 and over. It is not directed to children, we do not knowingly collect personal information from children under 13 within the meaning of COPPA, and we do not sell or share the personal information of anyone we know is under 16. If you believe a child has used the app, contact games@ntam.es and we will delete any related records.
Contact. games@ntam.es, or by post at the address in section 16.
This policy is available at: https://games.ntam.es/per-my-last-email/privacy/