Last updated
Privacy policy
Mailbay gives agents and apps their own email inboxes. This policy explains what personal data passes through Mailbay, what we do with it, and what we never do with it.
Contents (14)
Who we are
Mailbay is operated by [Legal entity name], [Registered address], India ("Mailbay", "we", "us"). For privacy questions write to [Contact email for privacy].
Because we offer Mailbay to people in the European Union, our representative in the EU under Article 27 of the GDPR is [EU representative name and address]. You can contact them instead of us on any question about your data. [UK representative, if serving UK customers]
Controller or processor
We play two different roles, and which one applies depends on the data:
- Processor for mail. The email our customers receive and send through their inboxes (content, attachments, headers, addresses of their correspondents) is processed on our customers' instructions. The customer is the controller; our data processing agreement governs that data. If you wrote to an address hosted on Mailbay and want to exercise your rights, contact the owner of that address first; we will help them answer you.
- Controller for accounts. Data about our customers themselves (account email, workspace membership, sign in, billing, support conversations, the audit log of their workspace, and the security logs of our own servers) is processed by us as controller, under this policy.
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Your email address, workspace name, role, sign in times | You, when you sign up or are invited |
| Email content and metadata | Messages and attachments received and sent by your inboxes, subject, sender and recipient addresses, Message-ID, timestamps, delivery status, bounces | Your inboxes and the people who write to them |
| Authentication results | SPF, DKIM and DMARC results and spam scores of received mail | Our mail servers, when mail arrives |
| Technical and security data | IP addresses of API and dashboard requests recorded in your workspace audit log, IP addresses of mail servers connecting to us, IP addresses that request sign in emails (for rate limits) | Your browser, your code, other mail servers |
| Configuration | Domains, DNS records, API key names and prefixes, webhook URLs, forwarding targets | You |
| Billing data | [payment processor and billing data, once billing is live] | You |
| Support | What you write to us | You |
We do not buy data about you, we do not combine your data with data from data brokers, and we do not use mail content to profile people, to advertise, or to train machine learning models.
Why, and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: receiving, storing, sending and forwarding mail, the API, the dashboard | Contract (6(1)(b)); for mail content, the customer's instructions as processor |
| Sign in, keeping accounts secure, rate limits, spam and abuse prevention | Legitimate interests (6(1)(f)): a safe service for our customers and for everyone who receives mail |
| The workspace audit log | Legitimate interests (6(1)(f)) of the customer and of us in accountability and security |
| Billing and accounting | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Service emails (sign in links, invitations, security notices) | Contract (6(1)(b)) |
| Answering support requests | Contract (6(1)(b)) or legitimate interests (6(1)(f)) |
We do not send marketing email without your consent, and you can withdraw it at any time.
Where data is stored
Every Mailbay service runs on our own virtual private server at OVHcloud in Beauharnois, Quebec, Canada: the API, the mail servers, the database, stored messages and attachments, and backups. The full list is on the subprocessors page.
International transfers
Canada. The European Commission has decided that Canada provides adequate protection for personal data handled by commercial organisations under PIPEDA, and confirmed that decision in its January 2024 review. Storing data in Canada therefore needs no further safeguard under GDPR Article 45.
India. Mailbay is run from India, and the operator administers the server remotely from there. Remote access counts as a transfer to India, which has no adequacy decision. We cover it with the European Commission's Standard Contractual Clauses (Decision 2021/914) in our data processing agreement, and we have assessed the transfer (a transfer impact assessment). Data is not copied to India as a matter of course; it stays on the server in Canada and is reached over an encrypted connection when the server needs maintenance or support.
Who we share it with
- Our subprocessors, only to run the service (listed on the subprocessors page).
- Other mail servers, when you send mail: delivering it is the point. Received mail is checked against public DNS based reputation lists, which see the sending server's IP address and domain.
- The webhook URLs and forwarding addresses you configure, which receive what you tell us to send them.
- Authorities, when the law requires it and only after checking the request is valid. Unless the law forbids it, we tell the affected customer first. [confirm policy on government requests]
- A buyer or successor, if Mailbay is sold or merged, under the same commitments.
We do not sell personal data and we do not share it for advertising.
How long we keep it
- Mail is kept until you delete it, or for the period you choose. A workspace owner can turn on automatic deletion after 30, 90, 180, 365 or 730 days in Settings, Data & privacy; an hourly job then deletes older received and sent messages, their raw files and attachments, and webhook event logs older than the same window.
- The audit log is kept for 400 days by default; the owner can choose 90, 180, 400 or 730 days.
- Sign in tokens expire after 15 minutes and are deleted after a day. Sessions last 30 days or until you sign out.
- Deleting a workspace removes all of its mail, files, domains, inboxes, keys, app passwords, webhooks, invitations and audit log at once. People who belong to no other workspace lose their account too.
- Backups are kept for [backup retention period, 14 days by default]. Deleted data can remain in a backup until that backup expires; we do not restore deleted data from backups except to recover from a failure.
- Billing records are kept as long as tax law requires. [period under Indian tax law]
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent. Several of these are built into the product:
- Export. A workspace owner can download everything in the workspace (projects, members, domains, inboxes, messages with their raw files, sent email, webhooks without secrets, suppressions and the audit log) from Settings, Data & privacy, or with
GET /v1/workspace/export. - Delete. A workspace owner can delete the workspace from the same page, or with
DELETE /v1/workspace. Individual messages and inboxes can be deleted at any time.
For anything else, write to [Contact email for privacy]. We answer within one month. For mail held on behalf of a customer, we pass the request to that customer, as their processor.
Cookies and analytics
The dashboard sets one cookie, an httpOnly session cookie that keeps you signed in for 30 days. Your theme choice is kept in your browser's local storage. Neither is used for tracking.
There are no third party analytics, advertising or tracking scripts on the website or in the dashboard, and no tracking pixels in the emails we send you.
Security
Connections are encrypted with TLS; API keys, session tokens and sign in codes are stored only as hashes; app passwords as argon2id hashes; DKIM keys and webhook secrets are encrypted at rest; every request is checked against workspace and project roles. The full list is Annex II of the data processing agreement. If a breach affects your data, we will tell you without undue delay.
Children
Mailbay is a service for businesses and developers and is not meant for anyone under 18.
Changes
We will post changes here and update the date at the top. If a change matters, we will tell workspace owners by email at least 30 days before it takes effect.
Contact and complaints
Write to [Contact email for privacy] or [Registered address]. In the EU you can also contact our representative, [EU representative name and address], and you have the right to complain to the data protection authority where you live or work. In India, grievances under the Digital Personal Data Protection Act, 2023 go to our grievance officer: [Grievance officer name and email].
Version
Draft of 13 October 2026.