Privacy Policy

1. Data we collect about you

Account and identity data: name, business email address, company name, job title, and where we verify a business, the registration details, website and telephone number you provide.

Billing data: billing address, plan, invoices and payment history. Card details are collected and stored by our payment processor; we receive only a token and the last four digits.

Usage and technical data: IP address, browser and device characteristics, pages and features used, actions taken, timestamps, referring pages, and diagnostic logs. Collected automatically through cookies and similar technologies.

Communications: messages you send us by email, through the Service, or on a call, and records of support requests.

2. Legal bases for processing your data

Where the UK or EU GDPR applies, we rely on: performance of a contract, to provide the Service and administer your account; legitimate interests, to secure the Service, prevent and investigate abuse, improve the product, and communicate about it, balanced against your rights; legal obligation, for tax, accounting and lawful requests; and consent, where we ask for it, which you may withdraw at any time without affecting prior processing.

3. Data you upload about your contacts

To run campaigns you upload Customer Data, which typically includes names, business email addresses, company information and custom fields you define. We store it, transmit the messages you create, and record delivery outcomes.

We process this data only on your documented instructions, which are given through your use of the Service and these terms. We do not sell it, rent it, share it with other customers, use it to build our own marketing lists, or use it to train models.

We will: ensure personnel with access are bound by confidentiality; implement appropriate technical and organisational measures; engage subprocessors only under written terms no less protective than these and remain liable for their performance; assist you, so far as reasonably possible, with data subject requests, impact assessments and regulator engagement; notify you without undue delay on becoming aware of a personal data breach affecting Customer Data; and delete or return Customer Data on termination, except where retention is legally required or necessary for suppression.

You are responsible for having a lawful basis to contact your Recipients, for providing them with any notice the law requires, and for honouring their rights and opt-outs.

4. Sending and delivery data

Operating sending infrastructure requires us to record what receiving providers do with mail sent through it: acceptances, deferrals, bounces, complaints, unsubscribes, replies, authentication results and blocklist status.

We use this to operate and protect the infrastructure, pace sending, provide your reporting, and detect abuse. We also use aggregated and de-identified signals across the platform to protect the reputation of infrastructure other customers rely on. Aggregated data of this kind does not identify you or your Recipients and may be retained indefinitely.

5. How we use data

To provide, maintain and support the Service; to authenticate users and secure accounts; to process payments and issue invoices; to monitor, investigate and prevent abuse, fraud and violations of our Terms; to comply with legal obligations and respond to lawful requests; to improve and develop the Service; and to send administrative messages about your account, security, billing and material changes.

We send marketing email only where we are permitted to, and you can opt out of it at any time without affecting administrative messages, which are necessary to the Service.

We do not engage in automated decision-making that produces legal or similarly significant effects concerning you.

6. Sharing and disclosure

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We disclose data to service providers who process it on our behalf under contract: cloud and network infrastructure providers, our payment processor, analytics and error monitoring providers, and email and support tooling. A current list of subprocessors is available from privacy@mailrig.io, and we will give notice of material changes to it.

We may also disclose data where required by law, regulation, subpoena or court order; where necessary to establish, exercise or defend legal claims; to protect the rights, property or safety of MailRig, our customers or the public, including to blocklist operators and upstream providers when investigating abuse; and to an acquirer in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

7. International transfers

We and our service providers may process data in countries other than your own, including the United States. Where personal data is transferred out of the United Kingdom or European Economic Area, we rely on an adequacy decision where one applies, or otherwise on Standard Contractual Clauses together with supplementary measures where required. A copy of the relevant safeguards is available on request.

8. Retention

Account and billing records: for the life of the account and afterwards for the period required by tax and limitation law.

Customer Data: until you delete it or for thirty days after termination, after which it is deleted, except where law requires retention.

Sending and delivery logs: retained for a limited operational period and then deleted or aggregated.

Suppression records: retained indefinitely. An address that has unsubscribed or complained must remain suppressed, and deleting the record would cause the very contact it is meant to prevent.

Security and abuse investigation records: retained as long as necessary for the investigation and any resulting claim.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption at rest for sensitive stores, hashed credentials, least-privilege access controls, audit logging, and separation of production environments.

No method of transmission or storage is completely secure. Where a personal data breach occurs we will notify affected customers and the relevant supervisory authority within the timeframes the law requires.

10. Your rights

Subject to your location and applicable law, you may have the right to access the personal data we hold about you; to correct inaccurate data; to delete it; to restrict or object to processing, including profiling; to portability; to withdraw consent; and to lodge a complaint with your supervisory authority, including the Information Commissioner's Office in the United Kingdom.

Where the California Consumer Privacy Act applies, you also have the right to know what personal information is collected, disclosed or sold, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising.

If you are a Recipient whose data was uploaded by one of our customers, that customer is the controller. Contact them directly, or contact us and we will route your request to them and assist as processor.

To exercise any right, email privacy@mailrig.io. We will verify your identity and respond within the period required by law, normally one month.

11. Cookies

We use cookies that are strictly necessary for authentication, session management and security, and analytics cookies that help us understand how the Service is used. Where consent is required, we ask for it before setting non-essential cookies. You can control cookies through your browser, though blocking necessary cookies will prevent the Service from functioning.

12. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

13. Changes to this policy

We will update this policy as the Service and the law change. Material changes take effect no less than thirty days after notice by email or in the Service, except where a change is required by law or addresses a security risk. The date at the top reflects the current version, and prior versions are available on request.

14. Contact

Privacy questions, data subject requests and subprocessor enquiries: privacy@mailrig.io. Abuse reports: abuse@mailrig.io. Everything else: hello@mailrig.io.