Legal Center.

This Privacy Policy explains what personal data Mailtr.co collects about account holders — the people and businesses who sign up for and use Mailtr — why we collect it, and what rights you have over it.

It does not describe what happens to the contacts and recipients our customers email through the Service. For that data we act on our customer's instructions rather than our own, and Section 6 explains the difference.

1. Who We Are and What This Covers

Mailtr.co ("Mailtr", "we", "us") is an email platform operated from India and accessible at https://mailtr.co. For the data described in this Policy, we are the data controller — we decide why and how it is processed.

2. Information We Collect

We collect the following, and no more than is needed for the purposes in Section 3:

Information you give us when you sign up. Your email address, a password (which we store only as a cryptographic hash, never in readable form), and a record that you accepted these terms, including the date and time.

Information you add to your profile or account. Your full name, phone number, profile picture, company name, company size, company website, approximate number of contacts, whether you sell online, and your postal address (address line, city, state, postal code, country). These are optional; the Service works without them, though some features and invoices are more complete with them.

Billing information. Your subscription, plan, invoice, refund, and payment history. Card and bank details are collected and held by our payment provider, not by us — we receive only the result of a payment and a reference to it.

Security and audit information. When you sign in or take a significant action in your account, we record the event, your IP address, and your browser and device information (user agent), along with an approximate location derived from your IP address for session security. We use this to detect unauthorised access, investigate abuse, and show you your own active sessions.

Content you create. Templates, campaigns, uploaded images and assets, and other material you build in the Service.

Support and legal correspondence. What you send us when you contact support or submit a grievance.

If you use the Mailtr mobile app. The app for iPhone and Android uses the same account and data as mailtr.co. In addition:

• Push notifications. If you allow them, your device gives us a notification token. We use it only to tell you about new mail, activity in your account, and sign-ins you're asked to approve. It's deleted when you sign out of the app or turn notifications off.
• Approving sign-ins. When a sign-in on another device asks your phone to approve it, we show that device's browser, operating system, approximate location (worked out from its IP address) and a masked IP address, so you can tell whether it's you.
• Face ID, Touch ID and fingerprints. When the app asks you to confirm it's you, your phone checks your face, fingerprint or passcode. We never receive or store biometric data.
• Photos and camera. The app reads only the photos you pick, and uses the camera only when you take a photo to upload.
• On your device. Your sign-in is kept in the phone's secure keychain; a few preferences (such as which mailboxes show and recent searches) stay on the phone.
• No tracking. The app has no advertising or analytics tools and doesn't track you across other apps or websites.

3. How We Use Your Information, and Our Legal Bases

We do not sell your personal data, and we do not share it with third parties for their own marketing.

4. Cookies and Similar Technologies

We use only the cookies strictly necessary to sign you in and keep you signed in. We do not use analytics, advertising, or tracking cookies, and we do not track you across other websites. Our Cookie Policy lists every cookie we set and what it does.

5. When We Share Your Information

We share personal data only where necessary, and only with categories of recipients that are bound to protect it:

• Payment providers — to take payment and process refunds.
• Cloud hosting and storage providers — to run the Service and store your data.
• Communications providers — to deliver email and SMS notices, including verification codes.
• Professional advisers and authorities — where we are required by law, or need to establish, exercise, or defend legal claims.
• An acquirer — if we are involved in a merger, acquisition, or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.

A current list of the providers we use for these purposes is available on request from the contact in Section 13.

6. Data You Send Through the Service

When you use Mailtr to email your own contacts, the personal data of those contacts and recipients belongs to you, not to us. You are the data controller for it and we act only as your data processor — we process it on your documented instructions, to deliver the Service, and for no purpose of our own.

That means it is your responsibility, not ours, to have a lawful basis and the necessary permission to email and to track those recipients, to give them their own privacy notice, and to honour their requests. Section 5 of our Terms of Service sets out these obligations.

We do not use your recipients' data to build our own products, to train models, or to market to them. Our Data Processing Agreement governs this processing and lists the sub-processors involved.

7. How Long We Keep Your Information

We keep your account data for as long as your account exists.

Deleting your account. You can delete your account yourself in Settings → Data & Privacy on mailtr.co, in Account → Data & privacy in the Mailtr app, or from mailtr.co/account/delete. We ask you to confirm it's you. If you own an organization that has other members, first hand ownership to another member or remove the other members; if your account has an unpaid balance, settle it first; if an organization created your account for you, ask its owner to delete it.

When you delete your account:

• You're signed out on every device, scheduled sends are cancelled, API keys and SMTP credentials stop working, and your subscription is cancelled with no further charges.
• Your account is kept for 30 days in case you change your mind: sign in during that time to restore it. We email you a reminder 3 days before.
• After 30 days we permanently delete your account and its data — mail and attachments, contacts, templates, campaigns, library files, sending domains and sign-in methods. If you used Sign in with Apple, we also revoke Mailtr's access with Apple.
• Work you did inside someone else's organization stays with that organization.

What we keep, and for how long.

• Invoices and payment records: 7 years, as tax law requires.
• Security and audit logs: up to 12 months, our standard retention for them. They're tamper-evident, so entries aren't edited or removed early.
• Unsubscribes: a one-way hash of an address that unsubscribed or bounced, so it isn't mailed again. It can't be turned back into the address.
• A minimal record needed to prevent a terminated account from being recreated to evade suspension.

8. International Transfers

We operate from India, and the providers described in Section 5 may process data in other countries. This means your personal data may be transferred to, and stored in, a country other than your own, where data-protection law may differ from the law where you live.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards — including the European Commission's Standard Contractual Clauses — and take steps to ensure your data remains protected. Contact us using Section 13 for details of the safeguards that apply to a specific transfer.

9. Your Rights

Depending on where you live, you have some or all of the following rights over the personal data we hold about you as an account holder:

• Access — obtain a copy of your personal data and information about how we use it. You can download a copy yourself from Settings → Data & Privacy, or Account → Data & privacy in the app.
• Correction — have inaccurate or incomplete data corrected. Most of this you can do yourself in your account settings.
• Erasure — have your personal data deleted, subject to the exceptions in Section 7.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection and restriction — object to processing based on our legitimate interests, or ask us to restrict processing while a concern is resolved.
• Withdraw consent — where we rely on your consent, withdraw it at any time, without affecting processing already carried out.
• Complain — raise a concern with us using Section 13, or with your local data-protection authority. In India, you may complain to the Data Protection Board.

To exercise any of these rights, email grievance@mailtr.co. We will acknowledge your request within 24 hours and respond within 30 days. We may need to verify your identity first, and we will not charge you for a reasonable request.

10. Security

We implement reasonable security practices and procedures to protect your personal data, in line with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encryption of data in transit, hashing of passwords, access controls, and audit logging of significant account activity.

No system is perfectly secure, and we cannot guarantee absolute security. Keep your password and your API and SMTP credentials secret, and tell us promptly if you believe your account has been compromised.

11. Children

The Service is intended for business use by adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us using Section 13 and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. Changes will be posted on this page with an updated "Last updated" date, and where a change materially affects how we use your personal data we will make reasonable efforts to notify you in the product or by email.

13. Grievance Redressal

In accordance with the Information Technology Act, 2000 and the Rules made under it, our Grievance Officer is:

You can also submit a formal complaint using the grievance form on our Legal Center page. We acknowledge grievances within 24 hours and aim to resolve them within 15 days, and in any event within the timelines required by applicable law.