Privacy policy

Last updated: 1 January 2021.

If anything here is unclear, write to privacy@mailpile.co.

What we store about you

A Mailpile account is: your address, your password as a salted hash, your recovery address, the mailbox contents you keep with us, and the delivery logs needed to move mail. Payment accounts keep the last four digits and expiry of a card, never the card number itself, which goes straight to our payment processor.

Our legal basis for processing is the mailbox contract itself: we handle what providing the service requires, and nothing beyond that.

What we don't do

We don't scan or mine message content. We don't build advertising profiles, sell or rent personal data, or run third-party analytics or trackers. This site sets no cookies except the signed-in session cookie for the mailbox itself.

Mail delivery and logs

To deliver mail we must temporarily hold what passes through: sending and receiving addresses, message ids, timestamps, and connecting IP addresses. Connection-level logs are kept 30 days for abuse handling, then erased. Full message bodies are encrypted at rest with AES-256.

Where your data lives

Primary storage is in Reykjavík, Iceland; the failover site is in Frankfurt, Germany. Your mailbox is stored only at these sites. Mail in transit goes wherever its recipients are — delivering it is the service, not a data transfer.

Your rights

Access, correct, export or delete everything you like: export from the mailbox, or write to dpo@mailpile.co. Requests are handled within one month. Deleting an account purges mailbox contents within seven days of confirmation. You can also complain to the Isle of Man Information Commissioner, or to the supervisory authority where you live.

Legal requests

If we are ever compelled by legal process to disclose your data, we will notify you before disclosing unless legally prohibited, and we limit disclosure to the narrowest reading of the order.

Company details

Mailpile Ltd., registered in the Isle of Man (company no. 048912C), is the data controller. Write to privacy@mailpile.co, or the data protection officer.