Privacy Policy (draft)

This is a working draft. It must be reviewed by a qualified lawyer, including for GDPR, UK GDPR, DPDP Act and CCPA applicability, before launch.

1. Who we are#

[Operator legal name and address] is the controller of account data. For the contents of mail you send and receive through the Service, you are the controller and we act as your processor. [Data processing terms to be provided.]

2. What we process#

• Account data: email address, password hash, organisation name, session records, security events such as logins.
• Mail content and metadata: messages, attachments, headers, labels, threads and delivery events for the inboxes you create.
• Billing data: plan, status and payment provider identifiers. Card details are handled by Stripe or Razorpay and are not stored by us.
• Operational data: request logs with secrets redacted, IP addresses for rate limiting and abuse prevention.

3. Why we process it#

To provide and secure the Service, to bill you, to prevent abuse, and to meet legal obligations. [Legal bases to be specified.]

4. Sub-processors#

Outbound mail is handed to a mail provider chosen by the operator (for example Resend, Amazon SES or an SMTP relay). Inbound mail may pass through an email forwarding service. Payments go through Stripe or Razorpay. Hosting is with [hosting provider]. [Complete list and regions to be specified.]

5. Security#

Passwords are stored with a salted memory-hard hash. API keys and session identifiers are stored hashed. Webhook secrets are stored so that deliveries can be signed. [Additional measures to be described.]

6. Retention and your rights#

[Retention periods, deletion on request, export, and how to exercise rights under applicable law to be specified.]

7. Contact#

[Contact details and data protection officer, if any.]