# An EU email API for AI agents

> An agent’s inbox is personal data from its first message. Pidgeon stores it in the EU on every plan, is run by an EU company, and applies its DPA automatically.

## Your agent's inbox is personal data

An AI agent with an email address receives names, addresses, order histories, invoices and whatever else people choose to write. For a company in Europe, or one selling to European customers, that inbox is personal data under the GDPR from the first message, and where it lives and who processes it is a question a customer's procurement team will ask.

Pidgeon is built so the answer is short.

## Stored in the EU, on every plan

Your mail is stored in the EU: raw originals, attachments, message bodies and metadata. The API and the dashboard that serve it run in the EU too, and mail sent and received through the API is processed in the EU. That holds on every plan, the free one included; there is no region to pick and no upgrade to unlock it.

The [subprocessor list](https://pidgeon.ai/legal/subprocessors) names every company that touches your data, what each one does and where it runs. Several of them are US companies running in EU regions, covered by Standard Contractual Clauses, and the two transfers that leave the EEA are named there with their legal basis.

For comparison: AgentMail lists its EU region under its Enterprise plan only, as a separate environment with its own API host ([pricing](https://www.agentmail.to/pricing) and [security FAQ](https://agentmail.to/docs/knowledge-base/security-compliance.md), checked 26 October 2026).

## An EU company

Pidgeon is operated by PCN Labs OÜ, a company registered in Estonia. The contract, the processing terms and the company that answers for them are all in the EU.

## The DPA applies automatically

Our [data processing agreement](https://pidgeon.ai/legal/dpa) applies from the moment you use Pidgeon for personal data you control, with no signature and no request. It includes the Standard Contractual Clauses by reference where a transfer needs them, and gives 30 days' notice before a new subprocessor. If your procurement process needs a countersigned copy, write to <legal@pidgeon.ai>.

## Deletion is yours

You can read, search, export or delete anything through the API, and any IMAP client can take a whole inbox with it. Permanently deleting a message erases it and its raw original at once; encrypted backups taken before the deletion age out on their own schedule, and we do not restore one to bring deleted mail back. The [privacy policy](https://pidgeon.ai/legal/privacy) lists how long everything else is kept.

## Not used to train models

We never use the content of your mail to train a model, ours or anyone else's. Our [Firewall](https://pidgeon.ai/firewall) learns from how it judged a message, never from what the message said. AgentMail's terms, last updated 12 October 2026, license customer content to "develop, improve and train" its technology, including AI models ([terms](https://www.agentmail.to/legal/terms), §7(c)(ii)).

## Start

[Sign up](https://pidgeon.ai/signup) and your first address is hosted in the EU like every other. The [security page](https://pidgeon.ai/security) covers what reaches your agent and what it can reach; the [legal pages](https://pidgeon.ai/legal) have the terms, the DPA and the subprocessor list in full.