Privacy Policy

Who we are

Maillo ("Maillo", "we", "us") provides business email at your own domain through maillo.work and the Maillo app at mail.maillo.work. This policy explains what information we handle, why, and the choices you have. Questions go to [email protected].

Information we collect

• Account details: your name, business name, your Maillo address, a recovery email address, and your password. We store passwords only as a one-way hash, never in readable form.
• Your team: names and Maillo addresses of people in your workspace, their roles, and the personal email addresses invitations are sent to.
• Your domain: the domain you connect, the DNS records we ask you to add, and the results of our checks on them.
• Email: the messages you send and receive, including their content, attachments, subject lines, senders and recipients, and delivery information.
• Billing: your plan, number of seats and subscription status. Payment details such as card numbers are collected and stored by Paddle, not by us.
• Technical data: IP addresses, browser type and sign-in times, used to keep accounts secure and to prevent abuse. If you turn on notifications, we store the address your browser's push service gives us.
• Messages to us: anything you send when you contact support.

How we use it

• To run the service: deliver, receive, store and display your email, check your domain's DNS, and manage your team and seats.
• To keep it secure: sign-in protection, preventing spam, phishing and abuse, and investigating problems.
• To contact you about your account: invitations, domain and DNS alerts, billing notices and important service changes.
• To meet legal obligations, and to enforce our Terms of Use.

We do not sell your information, show ads, or use the content of your email for advertising or to train AI models. Our systems process email automatically to deliver it and to protect against spam and abuse. People at Maillo only look at message content when you ask us to (for example in a support request) or when the law requires it.

Service providers we use

We rely on a few providers to run Maillo. They process data on our behalf and only for that purpose:

• Amazon Web Services (United States): sending and receiving email, storing messages and attachments, our servers and database.
• Cloudflare: hosting this website and the Maillo app, DNS and network security.
• Paddle: checkout, payments, invoicing and tax, as our merchant of record. Paddle handles your payment information under its own privacy policy.
• Your browser's push service (for example Google, Apple or Mozilla), only if you turn on new-mail notifications.
• Google Fonts: our pages load fonts from Google, which receives your IP address when they load.

We may also disclose information when required by law, to protect the rights and safety of our users or others, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

Cookies and local storage

We don't use advertising or analytics cookies. The Maillo app stores sign-in tokens in your browser's local storage so you stay signed in, and so you can switch between several accounts. Cloudflare may set strictly necessary security cookies, and Paddle's checkout sets its own cookies when you pay.

Where your data is stored

Maillo's servers and email storage are in the United States (AWS, us-east-1). If you use Maillo from elsewhere, your information is transferred to and processed in the United States.

How long we keep it

We keep your account information and email for as long as your account is active. You can delete messages at any time. When an account or workspace is closed, we delete its data from our live systems, and from backups as they rotate out, unless we must keep something longer by law (for example billing records, which Paddle also keeps).

Security

Connections to Maillo are encrypted with HTTPS, passwords are hashed, the signing keys for your domain are encrypted at rest, and access to production systems is limited. No system is perfectly secure, so we can't guarantee absolute security, but we work to protect your information and will tell you about breaches as the law requires.

Your rights and choices

You can see and update most of your information in the app. You can also ask us to access, correct, export or delete your personal information, or object to how we use it, by emailing [email protected]. Depending on where you live (for example in the EU, UK or California), you may have further rights under local law, including the right to complain to your data protection authority. We won't treat you differently for using these rights.

If you use a Maillo address provided by your employer or another organisation, that organisation controls the workspace, and some requests may need to go through them.

Children

Maillo is a service for businesses and is not directed at children. You must be at least 13, or the minimum age in your country, to use it.

Changes to this policy

We may update this policy as Maillo changes. We'll post the new version here with a new date, and tell account owners by email about significant changes.