Privacy Policy

Our customers#

When you use Maillayer, we are the controller of your account data.

What we collect

• Account: your name, email address, and sign-in details through Firebase Authentication (email and password, or Google).
• Billing: your purchases and credit balance. Card details go to Stripe; we only keep a label like "Visa •••• 4242" for auto-recharge.
• Usage: what you do in the dashboard and through the API and MCP server, API key usage, and technical logs such as IP addresses, used for security and to run the Service.

Why

To provide the Service you signed up for, take payments, prevent abuse and protect deliverability, answer support requests, and tell you about important changes. We don't sell your data or use it for advertising.

Our customers' recipients#

When a customer uploads contacts or sends email through Maillayer, the customer is the controller of that data and we process it on their behalf, only to provide the Service. If you received an email sent with Maillayer, contact the sender for questions about your data; you can always unsubscribe with the link in their emails.

What we process for customers

• Contacts: email address, names and any custom properties the customer adds, and list membership.
• Email: the messages sent, delivery status, bounces and spam complaints.
• Engagement: when an email is opened or a link clicked, if the customer turned tracking on. We record the time, and use the IP address to estimate the country, region, city and timezone.
• Contact checks: to protect deliverability, we check new contacts against mail-server records and public lists of disposable domains and spam sources, and, when a customer sends a sign-up IP, against IP reputation services.
• Suppressions: addresses that bounced, complained or unsubscribed, kept so they aren't emailed again.

Who we share data with#

We use these service providers, only for the purpose listed:

Location lookups use a database stored on our own servers (from DB-IP), and lists of disposable and spam-listed domains are downloaded and checked locally, so no addresses or IPs are sent to those sources. We may also share data when the law requires it.

How long we keep data#

• Account data: while your account is open, and afterwards as long as needed for legal, tax and accounting duties.
• Contacts and email history: until the customer deletes them, or their account is closed.
• Suppressions: kept even after a contact is deleted, so a bounced or complaining address isn't emailed by mistake.

Cookies and local storage#

We use one essential cookie to keep you signed in. The sign-in page remembers in your browser whether you last used Google or email. We don't use advertising or third-party tracking cookies on our website.

Security#

Data is encrypted in transit, API keys are stored hashed, tracking links are signed, and access to production systems is limited. No system is perfectly secure; if a breach affects your data, we'll tell you without undue delay.

Your rights#

Depending on where you live (for example under GDPR or CCPA), you can ask to access, correct, delete or export your data, object to or restrict processing, and complain to your data protection authority. Customers can delete contacts at any time in the dashboard or through the API. To make a request, write to [email protected].

International transfers#

Our providers may process data in other countries. Where required, we rely on safeguards such as the EU Standard Contractual Clauses.

Changes#

We'll post updates here and change the date above. For significant changes we'll also tell customers by email.