Privacy Policy

1. Overview

MailStrap LLC (Colorado, United States) operates MailStrap, a business email and productivity platform. This policy explains what personal data we collect, why, who helps us process it, how long we keep it, and the rights you have. The short version: your email and files are yours, we don't sell data, we don't show ads, and we collect only what running the Service requires.

2. Data we collect

• Account data, name, email address, hashed password, organization name, and security settings (2FA status, passkey identifiers).
• Customer content, the email you host, files you upload, documents, contacts, calendar events, tasks, campaign content, and e-signature documents. We process this only to provide the Service to you.
• Billing data, handled by Stripe. We never see or store full card numbers; we keep subscription status and invoice records.
• Usage and log data, IP addresses, sign-in events, security audit events, and service metrics (for example emails sent), used for security, abuse prevention, and billing.

3. Why we process it (legal bases)

• To provide the Service you signed up for (performance of contract).
• To secure accounts and prevent abuse and spam: sign-in alerts, audit logs, outbound spam screening (legitimate interest).
• To bill subscriptions and meet tax and accounting obligations (contract and legal obligation).
• To send service emails such as verification, security alerts, and billing notices. We do not send you marketing without consent.

4. AI features

AI features (summaries, smart replies) run only when you invoke them, using either your organization's own API key or our provider (Anthropic). Only the specific content you ask to process is sent, it is not used to train models, and we never feed your mailbox to AI in the background.

5. Who processes data for us

We use a small set of subprocessors, each bound by data protection agreements. The current list also lives at /subprocessors:

We do not sell personal data, share it with advertisers, or use it for advertising. Ever.

6. Retention and deletion

• Your content stays as long as your account is active.
• When you delete your account (Settings, or see /delete-account), your data is removed from production immediately and purged from encrypted backups within 30 days.
• Invoice records are kept as long as tax law requires.
• Security logs are retained for up to 12 months.
• Fraud-prevention records (hashed email and payment-card fingerprints used to enforce the one-trial-per-customer policy) are retained after account deletion. They cannot be reversed into the original values.

7. Security

All traffic is encrypted with TLS. Passwords are hashed with bcrypt. Stored credentials and keys (DKIM private keys, API tokens, 2FA secrets) are encrypted with AES-256 before they touch the database. We support two-factor authentication and passkeys, and we alert you to sign-ins from new locations. More detail is on our Security page.

8. Your rights

Depending on where you live (including under GDPR and the Colorado Privacy Act / CCPA), you have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. You can exercise most of these directly: edit your profile in Settings, export your mail via IMAP, and delete your account in Settings. For anything else, email hello@mailstrap.com and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority.

9. International transfers

Our infrastructure is in the United States. Where data of EU/UK residents is transferred, we rely on Standard Contractual Clauses with our subprocessors.

10. Children

The Service is for business use and is not directed to children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

11. Changes and contact

Material changes to this policy are posted here with a new date, and significant changes are emailed to account owners. Privacy questions and requests: hello@mailstrap.com. Controller: MailStrap LLC, Colorado, United States.