Privacy Policy
Effective 1 August 2026
This describes what we do with personal data. It covers two different relationships, and the distinction matters: data about you as our customer, where we decide what happens to it, and data inside the messages you send, where you decide and we only act on your instructions.
Draft — not yet in force
This document is awaiting legal review and does not yet name a contracting entity. It is published so you can see the terms we intend to offer; it is not a contract, and nothing on this page should be relied on until this notice is gone.
Two roles, not one
- We are the controller of your account data — your email address, your billing details, the domains you add, your API request logs. We decide why and how that is processed, and this policy governs it.
- We are your processor for everything inside the messages you send: recipient addresses, subject lines, message bodies and attachments. You decide what goes in them; we transmit and store them under your instructions. The Data Processing Agreement governs that relationship, and if you are a business customer it is the document your compliance review wants.
What we collect about you
- Account. Your email address and authentication details, held by our identity provider. We never see or store your password.
- Billing. If you subscribe, Stripe holds your payment details and we hold a customer reference, your plan, and whether the last payment succeeded. We never receive your card number. We do hold the card fingerprint Stripe gives us — a code derived from the card that cannot be used to make a payment and does not reveal the number. Because it is the same code for the same card across different accounts, we use it for one purpose only: to notice when a new account is paying with a card that belongs to an account we have already suspended for abuse. A match slows that account’s sending for 24 hours and alerts us; it never closes an account on its own.
- Usage. Message counts, delivery outcomes, and a log of API requests — endpoint, status, method, user agent — kept so you can debug your own integration. Recipient addresses appearing in error messages in that log are redacted before it is written.
- Network. When someone clicks an unsubscribe link we derive a short-lived, non-reversible bucket value from the requesting IP address in order to rate-limit abuse. The address itself is not stored.
There is no analytics or advertising tracker anywhere on this site. The dashboard displays plaintext API keys, and we are not willing to put a third-party script on a page that does that.
Why we are allowed to process it
- Contract. Running your account, sending your mail, billing you.
- Legitimate interests. Keeping the service secure, preventing abuse, protecting the sending reputation every customer shares, and diagnosing faults. We limit this to what those aims actually require.
- Legal obligation. Keeping financial records, and responding to lawful requests.
Who else processes it
We use the following sub-processors. Each is bound by a data-processing agreement, and we will give notice before adding a new one.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Email delivery (SES) and attachment storage | London, UK (eu-west-2) |
| Convex | Application database — message records and account data | United States; storage region not yet confirmed in writing |
| Clerk | Authentication and user accounts | United States |
| Vercel | Dashboard and website hosting | United States, with edge delivery worldwide |
| Stripe | Payment processing and subscription billing | United States and Ireland |
| Sentry | Error monitoring for the dashboard | United States |
Where a provider processes data outside the UK, that transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Message bodies and attachments are kept for as long as you choose. The retention setting in your dashboard offers indefinite, 365, 90 or 30 days; when a window is set, an automated job strips bodies and attachments past it while keeping the delivery record so your statistics stay intact.
- API request logs are deleted after 30 days, on a fixed schedule that your retention setting does not change. That is why recipient addresses in them are redacted.
- Account and billing records are kept while your account is open, and financial records for as long as tax law requires afterwards.
- Everything else goes when you delete your account, which you can do yourself.
- An account we suspend for abuse is the exception. We keep its records — including the card fingerprint above, after the account is closed — for as long as we need them to answer a chargeback, a regulator or a law-enforcement request, and to stop the same actor signing straight back up. Self-serve deletion is refused while that case is open; erasure still happens, it just goes through a person.
Your rights
Under UK GDPR you can ask for a copy of your data, correct it, have it erased, restrict or object to processing, and receive it in a portable format. Two of those you do not have to ask us for:
- Export — the settings page produces a JSON file of your account, domains, suppression list, webhooks, usage and message metadata, on demand.
- Erasure — the same page deletes your account outright, including every message, your sending identities and your login. If we have suspended the account for abuse, that button is refused while the case is open and you should email us instead; the right is not removed, only the self-serve route to it.
For anything else, email support@yourmail.dev. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
Security
API keys are stored only as SHA-256 hashes and shown to you exactly once. Every query is scoped to your account. Webhook deliveries are signed so you can verify they came from us. More detail, including what we do not yet claim, is on the security page.
Contact
[LEGAL_ENTITY_NAME], company number [COMPANY_NUMBER], registered at [REGISTERED_ADDRESS]. ICO registration [ICO_REGISTRATION_NUMBER]. Data protection enquiries: support@yourmail.dev.