AI email assistants and GDPR: 6 questions to ask before installing one
Contents
Connecting an AI to your inbox means handing it a copy of your whole working life. For a European business, the GDPR requires you to know who processes that data, where and how. Here are six questions to ask any tool before you install it. This isn't legal advice: when in doubt, involve your DPO.
1 and 2: access and hosting
Is access read-only? When you connect Gmail or Outlook, the consent screen lists the permissions requested. Reading isn't the same as sending or deleting. A tool that helps you prioritise doesn't need to send messages on your behalf: fewer permissions, less risk.
Where is the data stored? The GDPR regulates transfers of personal data outside the EU. EU hosting doesn't settle everything, but it makes the conversation with a client or a DPO much simpler. Also ask where the AI model that reads your messages runs, not just where the database is.
3 and 4: the contract and the subprocessors
Is there a data processing agreement (DPA)? When a vendor processes personal data on your behalf, Article 28 of the GDPR requires a contract setting out its obligations: purpose, security, confidentiality, what happens to the data at the end. A serious vendor makes it available without weeks of negotiation.
Who are the subprocessors? Host, AI model provider, email delivery service: each one sees part of the data. The list should be public, with each one's role and country.
5 and 6: training and deletion
Are my emails used to train a model? It's the question clients ask most. The answer should be written plainly in the privacy policy or the DPA, not only in a sales FAQ.
Can I really delete everything? Deleting the account should erase imported emails, search indexes and derived data (summaries, tasks, the assistant's memories). Ask how long it takes and what, if anything, remains, for example in backups.
Virtus Lever's answers
Virtus Lever connects to Gmail, Outlook or IMAP read-only. Data is hosted in the EU. A data processing agreement (DPA) is available and the subprocessor list is public.
No email is used to train an external model, and deleting your account erases your data. Lever reads your messages for one reason only: to pull out the actions to take, rank them and tell you which one to start with.
Ask these six questions of every tool, not just ours. To compare the assistants themselves, read our guide to AI email sorting.
Read next
Which AI should sort your email? A 2026 guide to choosing
Gemini, Copilot, SaneBox, Superhuman… Email AI tools don't all do the same job. Three families of tools, four questions to ask, and how to choose without switching inboxes.
Read the article →
Fyxer alternative: which AI should sort your email?
Fyxer sorts your inbox and drafts your replies. What it does well, what it costs, what to check, and when a European alternative that picks your priority of the day makes more sense.
Read the article →
AI personal assistant: Muse, Grok Bot and the one that knows your files
Meta launched Muse, xAI launched Grok Bot: the AI personal assistant is becoming an agent. What these tools do, what to check, and why the assistant that knows your files matters as much as the one that acts.
Read the article →