Privacy Policy

This Privacy Policy explains how MailCrypted ("we", "us") collects, uses, shares and protects information when you use our website and services (the "Service").

1. Data we collect

• Account data: email, phone number, password (hashed), account type (Seller or Tester), display name, avatar, country, languages, categories and short bio.
• Verification data: email and phone verification status; codes we send you to prove ownership.
• Content data: messages, attachments and profile updates you submit through the Service.
• Billing data: subscription plan, billing cycle and payment status. Card details are handled by our payment processor; we never see or store full card numbers.
• Usage data: log data such as IP address, device type, browser, pages visited and timestamps used to secure and improve the Service.
• Cookies & similar technologies: see our Cookie Policy.

2. How we use data

• To create and operate your account and deliver messages and email notifications.
• To verify identity, prevent fraud, spam and abuse and enforce our Acceptable Use Policy.
• To process subscriptions and billing.
• To provide customer support and respond to your requests.
• To improve, secure and develop new features (using aggregated or anonymised data where possible).
• To comply with legal obligations and enforce our Terms & Conditions.

3. Legal bases (GDPR/UK GDPR)

• Contract: to provide the Service and process your subscription.
• Legitimate interests: to keep the Service secure, prevent abuse and improve our product.
• Consent: for optional marketing emails and non-essential cookies.
• Legal obligation: to comply with tax, accounting and law-enforcement requirements.

4. Sharing your data

We do not sell your personal data. We share it only with:

• Service providers ("subprocessors") who help us operate the Service — hosting, database, authentication, email delivery, payments and analytics — under written data-processing agreements.
• Other users to the limited extent required by the Service (for example, a Seller sees a Tester's public profile when initiating contact).
• Legal authorities where required by law, court order or to protect our rights, users or the public.
• Successors in the event of a merger, acquisition or sale of assets, subject to equivalent protection.

5. International transfers

Our infrastructure and providers may process data outside your country. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Data retention

We keep account and message data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymise personal data within a reasonable period, except where longer retention is required for legal, billing, fraud-prevention or dispute-resolution reasons.

7. Your rights

Depending on your location you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to portability and to withdraw consent. You may exercise these rights from your account settings or by contacting hello@mailcrypted.com. You also have the right to lodge a complaint with your local supervisory authority.

8. Security

We use encryption in transit, hashed passwords, role-based access controls, database row-level security and monitoring to protect your data. No online service can guarantee absolute security; you are responsible for keeping your credentials safe and enabling two-factor authentication if available.

9. Children

The Service is not directed to children under 18 and we do not knowingly collect their personal data. If you believe a minor has provided us data, contact us and we will delete it.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app.

11. Contact

Privacy questions: hello@mailcrypted.com.