1. Who we are and our role
MailerAce ("we", "us") operates mailerace.com and the MailerAce service. You can reach us about privacy at [email protected].
- Controller: we are the controller for personal data about our website visitors, account holders and their team members, and people who contact us.
- Processor: for personal data contained in the email our customers send (for example recipient addresses and message content), the customer is the controller and we process it only on their instructions to provide the service.
2. Data we collect
Account and team data
Name (optional), email address, password (stored only as a one-way hash), two-factor authentication settings, workspace names, team roles and invitations.
Sending configuration
Domains you add and their DNS check results, SMTP credential names and settings (passwords stored only as hashes), webhook endpoint URLs, IP allowlists and preferences.
Usage and security data
IP addresses, browser user agent, sign-in times, actions taken in the dashboard, SMTP connection metadata and an audit log of sensitive actions. We use it to secure accounts, prevent abuse and fix problems.
Billing data
When paid plans are available: plan, invoices, billing address and tax details. Card details are collected and stored by our payment processor, never by us.
Email you send (as processor)
Sender and recipient addresses, message headers, message content and delivery events. Message content is held only as long as needed to deliver it; delivery logs and events are kept for your plan's log-retention period.
Communications
Emails you send to us and our replies.
3. How we use data and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create and run your account, deliver your email, provide support | Performance of a contract |
| Secure the service, prevent spam, fraud and abuse, review new accounts | Legitimate interests (protecting the platform, our customers and recipients) |
| Billing, tax and accounting records | Legal obligation; performance of a contract |
| Service announcements (security, changes to terms, outages) | Performance of a contract; legitimate interests |
| Product news and offers | Consent, which you can withdraw at any time |
| Respond to legal requests and enforce our terms | Legal obligation; legitimate interests |
5. International transfers
Our servers are located in professional data centres in the European Union and the United States (see Subprocessors). When personal data is transferred outside the EEA or UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum), together with technical safeguards such as encryption in transit and at rest.
6. How long we keep data
- Account data: while your account is open, then deleted or anonymised within 90 days of closure, unless we must keep it longer by law.
- Message content: only until delivered or finally failed.
- Delivery logs and events: for your plan's retention period (3 to 30 days, longer with the retention add-on).
- Webhook delivery records: 30 days.
- Suppression entries (bounced or complained addresses): while your account is open, so we never re-send to those addresses.
- Security and audit logs: up to 24 months.
- Billing records: as long as tax law requires (typically up to 10 years).
7. Security
We use TLS for data in transit, encryption at rest for secrets such as DKIM keys and webhook secrets, hashed passwords and credentials, two-factor sign-in, least-privilege access and audit logging. See our Security page. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.
8. Your rights
Depending on where you live, you can ask us to:
- access the personal data we hold about you and receive a copy (portability);
- correct inaccurate data or delete your data;
- restrict or object to processing based on legitimate interests;
- withdraw consent at any time (this does not affect earlier processing).
California and other US states: you have the right to know, access, correct and delete personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA/CPRA.
To exercise a right, email [email protected]. We will verify your identity and respond within one month (45 days under US state laws). If you are a recipient of email sent by one of our customers, please contact that sender; we will forward requests to them where we can. You may also complain to your data protection authority.
10. Children
The service is for businesses and adults. It is not directed at children under 16, and we do not knowingly collect their personal data.
11. Changes to this policy
We will post any changes here with a new effective date, and notify account holders by email or in the dashboard of material changes before they take effect.
Contact
Questions about this document: [email protected].