Privacy Policy

1. Overview

MailFlash (“we”, “us”, or “our”) takes your privacy and data security seriously. This Privacy Policy outlines what information we collect, how it is used, and the measures we employ to safeguard your personal and transactional information.

2. Information We Collect

We collect only the minimum information necessary to provide reliable transactional email delivery:

• Account Information: Name, email address, password hash, and authentication credentials.
• Billing Data: Payment method status, customer IDs, and invoices processed securely through Stripe (we never store raw credit card numbers on our servers).
• Domain & Infrastructure Data: DNS records (SPF, DKIM, DMARC), sending domains, API keys, and webhook endpoints.
• Transit Delivery Logs: Timestamps, recipient addresses, delivery status codes, bounce reasons, open/click counts, and latency statistics.

3. How We Use Information

Your information is used strictly to:

• Deliver outbound transactional emails and receive incoming mail via designated inboxes.
• Authenticate sending domains and protect reputations with mailbox providers.
• Prevent unauthorized access, fraudulent activities, and spam abuse.
• Process subscriptions and manage accounts via our Stripe billing portal.
• Notify you of essential service announcements, security alerts, or billing receipts.

4. Sub-processors & Third Parties

We do not sell, rent, or trade your personal or customer data. We share data only with trusted infrastructure partners required to deliver our service:

• Stripe: Payment processing and subscription lifecycle management.
• Cloudflare: DDoS mitigation, network acceleration, and Turnstile bot verification.
• MongoDB Atlas: Encrypted operational database hosting.

5. Data Retention & Security

All data transmitted to and from MailFlash is encrypted using industry-standard TLS 1.3 / HTTPS. Transient email message payloads are scrubbed after successful transmission or quarantine expiry. Audit logs are preserved for 30–90 days depending on your subscription tier.

6. Your Rights (GDPR & CCPA)

Regardless of your location, you have the right to access, rectify, export, or delete your personal account data at any time. You can request complete account deletion directly from your account settings or by contacting our support team.