Privacy policy

Mailmus (AMOS [TO BE COMPLETED: provisional name, to be replaced with the final registered company name once settled, along with legal form, company number and registered address]) operates the Mailmus platform (Mail and Auth). For any question about your personal data, write to us at hello@mailmus.io.

Depending on how you use the service, we process:

• Account data: name, email address, password (hashed), billing details.
• Data sent through the API by our customers (emails, recipients, content, end-users), processed on the customer’s behalf. The customer remains the controller towards their own users.
• Technical data: IP address, sign-in logs, session information.
• Cookies and similar technologies (see our cookie policy).

We process this data to provide and secure the service (performance of the contract), to bill it (legal obligation and contract), to improve the product (legitimate interest), and to communicate with you (consent, for anything that is not essential to the service).

Your data is shared with the following processors, and with no one else:

• Stripe — payments and subscription billing.
• Amazon Web Services (SES) — email delivery, in the eu-west-1 region.
• Railway — hosting of the API.
• Vercel — hosting of the dashboard and of this site.

We use no analytics or audience-measurement provider, so none receives anything about you. Each of the processors above acts strictly within what is needed to run the service.

Each retention window below is enforced by an automatic purge, not by a manual clean-up, and these are the durations actually applied:

• Sent email records (recipient, subject, delivery status): 24 months.
• Inbound emails received on your domains, including their body: 30 days.
• Webhook delivery logs: 90 days.
• Audit log of sensitive actions on an account: 24 months.
• Sessions and refresh tokens: 30 days after they expire or are revoked.
• Account data: for as long as the account is open. Deleting the account deletes them, subject to the retention periods the law requires of us for invoicing.

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. You can export your account data directly from your dashboard, or write to us at hello@mailmus.io. You also have the right to lodge a complaint with the CNIL, or with whichever supervisory authority has jurisdiction.

We apply reasonable technical and organisational measures to protect your data: encryption in transit, hashed passwords, access control, two-factor authentication available on every account, and an audit log of sensitive actions. [TO BE COMPLETED: further specifics if needed.]

This policy may be updated. We will tell you about substantial changes by email or through the service.