Your agent's inbox is personal data
An AI agent with an email address receives names, addresses, order histories, invoices and whatever else people choose to write. For a company in Europe, or one selling to European customers, that inbox is personal data under the GDPR from the first message, and where it lives and who processes it is a question a customer's procurement team will ask.
Pidgeon is built so the answer is short.
Stored in the EU, on every plan
Your mail is stored in the EU: raw originals, attachments, message bodies and metadata. The API and the dashboard that serve it run in the EU too, and mail sent and received through the API is processed in the EU. That holds on every plan, the free one included; there is no region to pick and no upgrade to unlock it.
The subprocessor list names every company that touches your data, what each one does and where it runs. Several of them are US companies running in EU regions, covered by Standard Contractual Clauses, and the two transfers that leave the EEA are named there with their legal basis.
For comparison: AgentMail lists its EU region under its Enterprise plan only, as a separate environment with its own API host (pricing and security FAQ, checked 26 October 2026).
An EU company
Pidgeon is operated by PCN Labs OÜ, a company registered in Estonia. The contract, the processing terms and the company that answers for them are all in the EU.
The DPA applies automatically
Our data processing agreement applies from the moment you use Pidgeon for personal data you control, with no signature and no request. It includes the Standard Contractual Clauses by reference where a transfer needs them, and gives 30 days' notice before a new subprocessor. If your procurement process needs a countersigned copy, write to legal@pidgeon.ai.
Deletion is yours
You can read, search, export or delete anything through the API, and any IMAP client can take a whole inbox with it. Permanently deleting a message erases it and its raw original at once; encrypted backups taken before the deletion age out on their own schedule, and we do not restore one to bring deleted mail back. The privacy policy lists how long everything else is kept.
Not used to train models
We never use the content of your mail to train a model, ours or anyone else's. Our Firewall learns from how it judged a message, never from what the message said. AgentMail's terms, last updated 12 October 2026, license customer content to "develop, improve and train" its technology, including AI models (terms, §7(c)(ii)).
Start
Sign up and your first address is hosted in the EU like every other. The security page covers what reaches your agent and what it can reach; the legal pages have the terms, the DPA and the subprocessor list in full.