Privacy Policy

Last updated: April 26, 2026

1. Data We Collect

• Account data: Email address, name, bcrypt-hashed password.
• Integration credentials: email routing API tokens, outbound sending API keys, and mailbox OAuth tokens — stored AES-256-GCM encrypted with a per-user derived key.
• Domain and routing data: Domain names, DNS records, email routing rules you configure.
• Email metadata: From, To, Subject, Snippet of emails processed through the Service.
• Audit log: Actions you take in the dashboard with IP address and timestamp.
• Usage data: Server logs (IP, user agent, response codes). Retained for 30 days.

2. How We Use It

We use your data to provide the Service, troubleshoot issues, and send transactional emails (account alerts). We do not sell your data or use it for advertising.

3. Data Storage

Data is stored in MongoDB Atlas (EU region) and a VPS located in the United States. Credentials are encrypted at rest. See our Subprocessors page for a full list of vendors.

4. Data Retention

Your data is retained while your account is active. When you request account deletion, your data is scheduled for hard deletion 30 days after the request. You may cancel the deletion within 7 days.

5. Your Rights

You may export all your data at any time from Settings → Export my data. You may request correction or deletion of your data by contacting us or using the in-app deletion flow.

6. Third Parties

We share data with third-party providers only as required to deliver the Service. See our Subprocessors page. We do not share data with advertisers.

7. Cookies

We use a single session cookie for authentication (NextAuth.js). We do not use tracking or advertising cookies.

8. Contact

Email devserverdev@gmail.com with privacy questions or requests.