Privacy policy

1. Who we are

Mueslimail is operated by KaiFloor OÜ, Tallinn, Estonia, registered at the Estonian Commercial Register, registry code EE 1049281, VAT ID [VAT ID], represented by [Legal representative] ("we").

Contact for data protection questions: privacy@mueslimail.com. [Data protection officer: to be confirmed whether one is required.]

2. Our two roles

Controller. KaiFloor OÜ (registry code EE-1049281, Tallinn, Estonia) is the controller for personal data about our customers and their users (account and contact details, billing data, API usage) and about visitors of this website.

Processor. For the content of email that customers send and receive through the service (messages, attachments, addresses of correspondents), the customer is the controller and we process that data only on the customer's documented instructions, under a data processing agreement according to Article 28 GDPR. Requests from people whose data appears in customer mail should go to the customer; we help the customer answer them.

3. Data we process

• Account data: organization name, contact email addresses, plan.
• Credentials: API keys, stored only as SHA-256 hashes; webhook signing secrets.
• Customer email content (as processor): inbound and outbound messages, headers, bodies, attachments, labels, the email addresses of senders and recipients, and results of spam, DKIM and gatekeeper checks.
• Technical data: IP addresses, request metadata and logs of API and SMTP connections.
• Communication: what you write to us by email.
• Billing data, once billing is live: [to be completed with the payment provider].

4. Purposes and legal bases

• Providing the service, including storing, screening and delivering mail: performance of a contract, Article 6(1)(b) GDPR, and for customer email content the customer's instructions under Article 28.
• Security, abuse and spam prevention, enforcing limits and the acceptable use rules: legitimate interests, Article 6(1)(f), in keeping the service and its sending reputation safe.
• Answering your messages: legitimate interests, Article 6(1)(f), or steps before a contract, 6(1)(b).
• Accounting and tax records: legal obligation, Article 6(1)(c).

5. Processors

We use these processors. We will update this list before adding a new one.

Outbound mail is, by its nature, delivered to the mail servers of its recipients, wherever they are. That transfer is requested by the customer who sends the message.

6. Transfers outside the EU

Customer data and customer email content are stored and processed in the EU. GitHub, in the United States, receives source code only, not customer data. [Counsel to confirm the transfer mechanism for any account data that may reach GitHub, for example in issue reports.]

7. Retention

• Customer email content is kept until the customer deletes it or the account ends. Deleting an inbox deletes its messages and attachments from the live database immediately.
• Database backups are overwritten on rotation after [N] days, so deleted data leaves backups by then.
• Idempotency records of send requests are deleted after 24 hours.
• Server and connection logs are kept for [N] days.
• Account data is kept for the life of the account, and accounting records as long as the law requires.

8. This website

This website sets no cookies, uses no analytics or tracking and loads no third party resources: fonts are served from our own server. The web server records technical access data (IP address, time, requested page, user agent) for security, kept for [N] days.

9. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability, under Articles 15 to 21 GDPR. Where processing relies on consent, you can withdraw it at any time. Write to privacy@mueslimail.com.

You can also lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. [Competent lead authority to be named.]

10. Security

We protect data with technical and organizational measures described on the security page, including tenant isolation with row level security, hashed API keys, encrypted transport for the API and signed webhooks.

11. Changes

We will update this policy when our processing changes and show the date of the last update at the top of the page. Customers will be told of material changes in advance.