Data Processing Agreement

Last updated: April 26, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Controller”) and Mailenvoy (“Processor”).

1. Scope and Purpose

Mailenvoy processes personal data (email addresses, email metadata, IP addresses) on your behalf solely to provide the email routing and management Service described in the Terms of Service.

2. Processor Obligations

Mailenvoy will: (a) process data only on your documented instructions; (b) ensure persons authorised to process data are bound by confidentiality; (c) implement appropriate technical and organisational security measures; (d) assist you in responding to data subject requests; (e) delete or return all personal data upon termination.

3. Sub-processors

We use sub-processors as listed on our Subprocessors page. We will notify you of any changes to this list 14 days in advance.

4. Security Measures

Technical measures include: AES-256-GCM encryption of credentials at rest; PBKDF2 key derivation (310,000 iterations) per account; TLS 1.2+ in transit; access controls; audit logging of all privileged actions.

5. Data Subject Rights

We will assist you in responding to data subject requests (access, rectification, erasure, portability) within the timelines required by applicable law. You may submit requests to devserverdev@gmail.com.

6. Breach Notification

We will notify you without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach affecting your data.

7. Term

This DPA remains in force for as long as Mailenvoy processes personal data on your behalf. It terminates automatically upon deletion of your account and associated data.