Last updated
Privacy policy
Mailbay gives agents and apps their own email inboxes. This policy explains what personal data passes through Mailbay, what we do with it, and what we never do with it.
Contents (14)
Who we are
Mailbay is operated by Arin Prajapati, trading as Mailbay (sole proprietor), Mumbai, Maharashtra, India ("Mailbay", "we", "us"). You can read who builds Mailbay and why. For privacy questions write to privacy@mailbay.dev.
Mailbay has not appointed a representative in the EU or UK yet; you can contact us directly at privacy@mailbay.dev, and you keep the right to complain to your data protection authority.
Controller or processor
We play two different roles, and which one applies depends on the data:
- Processor for mail. The email our customers receive and send through their inboxes (content, attachments, headers, addresses of their correspondents) is processed on our customers' instructions. The customer is the controller; our data processing agreement governs that data. If you wrote to an address hosted on Mailbay and want to exercise your rights, contact the owner of that address first; we will help them answer you.
- Controller for accounts. Data about our customers themselves (account email, workspace membership, sign in, billing, support conversations, the audit log of their workspace, and the security logs of our own servers) is processed by us as controller, under this policy.
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Your email address, workspace name, role, sign in times | You, when you sign up or are invited |
| Email content and metadata | Messages and attachments received and sent by your inboxes, subject, sender and recipient addresses, Message-ID, timestamps, delivery status, bounces | Your inboxes and the people who write to them |
| Authentication results | SPF, DKIM and DMARC results and spam scores of received mail | Our mail servers, when mail arrives |
| Technical and security data | IP addresses of API and dashboard requests recorded in your workspace audit log, IP addresses of mail servers connecting to us, IP addresses that request sign in emails (for rate limits) | Your browser, your code, other mail servers |
| Configuration | Domains, DNS records, API key names and prefixes, webhook URLs, forwarding targets | You |
| Billing data | None yet: paid plans are not available. Before billing starts, this policy will name the payment processor and what it receives. | Not collected yet |
| Website visits | Page viewed, referrer, browser, operating system, device type, screen size, language and approximate location (country, region, city). No cookies, and the IP address is not stored | Your browser, on the public website only |
| Support | What you write to us | You |
We do not buy data about you, we do not combine your data with data from data brokers, and we do not use mail content to profile people, to advertise, or to train machine learning models.
Why, and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: receiving, storing, sending and forwarding mail, the API, the dashboard | Contract (6(1)(b)); for mail content, the customer's instructions as processor |
| Sign in, keeping accounts secure, rate limits, spam and abuse prevention | Legitimate interests (6(1)(f)): a safe service for our customers and for everyone who receives mail |
| The workspace audit log | Legitimate interests (6(1)(f)) of the customer and of us in accountability and security |
| Billing and accounting | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Service emails (sign in links, invitations, security notices) | Contract (6(1)(b)) |
| Answering support requests | Contract (6(1)(b)) or legitimate interests (6(1)(f)) |
| Counting visits to the public website, without cookies | Legitimate interests (6(1)(f)): knowing which pages are useful |
We do not send marketing email without your consent, and you can withdraw it at any time.
Where data is stored
Mailbay's primary storage is our virtual private server at OVHcloud in Beauharnois, Quebec, Canada: the database, stored messages and attachments, and backups kept on that server. The API, inbound mail, IMAP and control plane also run there. Outbound messages and attachments are processed by Amazon SES in Northern Virginia, United States (us-east-1) for delivery; delivery events pass through SNS and SQS in the same region. The website and dashboard front end are hosted by Vercel, which also counts visits to the public website with Vercel Web Analytics, and website visit counts are kept by our own Umami on a Hetzner server in Helsinki, Finland. The full list is on the subprocessors page.
International transfers
Canada. The European Commission has decided that Canada provides adequate protection for personal data handled by commercial organisations under PIPEDA, and confirmed that decision in its January 2024 review. Storing data in Canada therefore needs no further safeguard under GDPR Article 45.
India. Mailbay is run from India, and the operator administers the server remotely from there. Remote access counts as a transfer to India, which has no adequacy decision. We cover it with the European Commission's Standard Contractual Clauses (Decision 2021/914) in our data processing agreement, and we have assessed the transfer (a transfer impact assessment). Data is not copied to India as a matter of course; it stays on the server in Canada and is reached over an encrypted connection when the server needs maintenance or support.
United States. Vercel processes request data for the website and dashboard. Amazon Web Services processes outbound message content, attachments, addresses and delivery events in us-east-1 for Amazon SES delivery and feedback. Both transfers use the Standard Contractual Clauses in the providers' data processing addenda.
Who we share it with
- Our subprocessors, only to run the service (listed on the subprocessors page).
- Other mail servers, when you send mail: delivering it is the point. Received mail is checked against public DNS based reputation lists, which see the sending server's IP address and domain.
- The webhook URLs and forwarding addresses you configure, which receive what you tell us to send them.
- Authorities, only under a valid, binding legal order. We disclose the narrowest data the order requires, and we notify the affected customer first unless the law forbids it.
- A buyer or successor, if Mailbay is sold or merged, under the same commitments.
We do not sell personal data and we do not share it for advertising.
How long we keep it
- Mail is kept until you delete it, or for the period you choose. A workspace owner can turn on automatic deletion after 30, 90, 180, 365 or 730 days in Settings, Data & privacy; an hourly job then deletes older received and sent messages, their raw files and attachments, and webhook event logs older than the same window.
- The audit log is kept for 400 days by default; the owner can choose 90, 180, 400 or 730 days.
- Sign in tokens expire after 15 minutes and are deleted after a day. Sessions last 30 days or until you sign out.
- Deleting a workspace removes all of its mail, files, domains, inboxes, keys, app passwords, webhooks, invitations and audit log at once. People who belong to no other workspace lose their account too.
- Backups are kept for 14 days (the database's point in time archive, built on weekly full backups, for up to 21 days). Deleted data can remain in a backup until that backup expires; we do not restore deleted data from backups except to recover from a failure.
- Server and mail logs, which include IP addresses and email addresses, are deleted after 30 days.
- Billing records, once billing starts, are kept for 8 years, as Indian tax law (GST and income tax) requires.
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent. Several of these are built into the product:
- Export. A workspace owner can download everything in the workspace (projects, members, domains, inboxes, messages with their raw files, sent email, webhooks without secrets, suppressions and the audit log) from Settings, Data & privacy, or with
GET /v1/workspace/export. - Delete. A workspace owner can delete the workspace from the same page, or with
DELETE /v1/workspace. Individual messages and inboxes can be deleted at any time.
For anything else, write to privacy@mailbay.dev. We answer within one month. For mail held on behalf of a customer, we pass the request to that customer, as their processor.
Cookies and analytics
The dashboard sets one cookie, an httpOnly session cookie that keeps you signed in for 30 days. Your theme choice is kept in your browser's local storage. Neither is used for tracking.
The public website uses Vercel Web Analytics when hosted on Vercel and self-hosted Umami when configured. We host Umami on a server in Finland. Umami does not store your IP address; it records the page, the referrer, your browser, operating system, device type, screen size, language and approximate location. The dashboard and API have no visitor analytics.
There are no advertising scripts on the website or in the dashboard, and no tracking pixels in the emails we send you.
Security
Connections are encrypted with TLS; API keys, session tokens and sign in codes are stored only as hashes; app passwords as argon2id hashes; DKIM keys and webhook secrets are encrypted at rest; every request is checked against workspace and project roles. The full list is Annex II of the data processing agreement. If a breach affects your data, we will tell you without undue delay.
Children
Mailbay is a service for businesses and developers and is not meant for anyone under 18.
Changes
We will post changes here and update the date at the top. If a change matters, we will tell workspace owners by email at least 30 days before it takes effect.
Contact and complaints
Write to privacy@mailbay.dev. Mailbay is based in Mumbai, Maharashtra, India. Mailbay has not appointed a representative in the EU or UK yet; you can contact us directly at privacy@mailbay.dev, and you keep the right to complain to your data protection authority, where you live or work. In India, grievances under the Digital Personal Data Protection Act, 2023 go to our grievance officer: Arin Prajapati, privacy@mailbay.dev.
Version
Version of 27 October 2026.