Mailfoy ← Back to Mailfoy

Mailfoy Privacy Policy

Mailfoy delivers email for your own domain into Gmail. To do that we handle your account details and the email sent to your addresses. We only use them to run the service, we never sell them, and we don't read your email.

This Privacy Policy ("Policy") forms part of, and is incorporated into, the Mailfoy Terms of Use ("Terms"). Words defined in the Terms (including "Account", "Domain", "Mailbox", "Email Content", "Services", "Website", "Third Party" and "Personal Data") have the same meanings in this Policy.

BY ACCESSING THE WEBSITE OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS POLICY, AND YOU AGREE TO THE COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL DATA AS DESCRIBED IN IT.

1. Who we are

  1. Mailfoy is operated by LYHCO (UEN 53333705D) ("LYHCO", "Mailfoy", "we", "our" or "us").
  2. This Policy explains what Personal Data we collect when you use mailfoy.com, the Mailfoy dashboard and the Mailfoy email service, and how we use, disclose and protect it, in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA") and, where it applies, the EU General Data Protection Regulation ("GDPR").

2. What we collect

There may be certain types of data collected from you in connection with your access to or use of the Services and/or the Website. The data includes the following:

Account details

  1. Your name, email address and Google account ID, from Google when you sign in with Google or link a Gmail account.
  2. Anything else you add to your profile, such as a phone number.

Your Domains and Mailboxes

  1. Your domain names, the addresses you set up on them (Mailboxes and aliases), catch-all and denylist settings, and which Gmail account each address delivers to.
  2. DNS verification status, and the details of the SMTP credentials we create so Gmail can send as your address. We never store the SMTP password itself; it is shown to you once.

Email sent to and from your addresses

  1. Incoming email. When someone emails one of your addresses, the message arrives at our email provider (Amazon Web Services) and is stored, encrypted, only until it has been delivered to your Gmail. It is then deleted. If delivery fails, we keep the message for up to 14 days so it can be delivered or recovered, and it is then deleted automatically.
  2. Delivery records. For each message sent or received we keep a short record: sender, recipient, subject line, date and delivery status. You can see these in your dashboard's traffic log. They are deleted automatically after 90 days.
  3. Outgoing email. When you send as your address from Gmail, the message goes through our email provider to the recipient. We do not keep a copy; we only keep the delivery record described in paragraph (f) above.

Payment details

  1. Payments are handled by Stripe. Your card details go directly to Stripe and never reach our servers. We keep your Stripe customer reference, your Plan, number of Seats, billing status and renewal dates. Stripe holds your billing address, tax ID and invoices.

Security and usage information

  1. When you sign in, and when you make a change in the dashboard (for example adding a Mailbox or changing a setting), we keep an activity record: what was changed and when, your IP address, your browser and device type, and your approximate location (city and country) worked out from your IP address. We use it to keep Accounts secure and to keep an audit trail of changes. You can see your own activity in your account settings, and domain admins can see the changes made to their Domain.
  2. Technical logs from our servers, used to run, secure and fix the Services. These can include email addresses and other details of the requests our servers handle.
  3. Website analytics: the pages you view on mailfoy.com, clicks on the sign-up buttons, and general device and location information, collected by Google Analytics. See Clause 11.

Such data may be stored in our servers, systems or devices, or in a Third Party's servers, systems or devices engaged by us as described in Clause 6, and may be used by us or those Third Parties only in order to provide, secure and support your access to and use of the Services and/or the Website.

3. Google user data

  1. Mailfoy asks for access to your Google account in two places, and only for what each needs:
    1. Linking a Gmail account to a Mailbox uses your Google account's basic identity (name, email address and account ID), so we can confirm you own the Gmail address mail will be delivered to.
    2. Gmail import (optional, in beta) also asks for the permission Add emails into your Gmail mailbox (gmail.insert). We use it for one thing: placing email addressed to your Mailfoy addresses into your Gmail inbox. It does not let us read, send, change or delete any of your existing email. We store the access token Google gives us encrypted, and delete it when you leave the beta, remove the Mailbox, or link a different Gmail account.
  2. Mailfoy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
    1. we only use Google user data to provide and improve Mailfoy's email delivery, which you can see in the dashboard;
    2. we do not transfer it to others, except as needed to run the Services, to comply with the law, or as part of a merger or acquisition with notice to you;
    3. we do not use it for advertising, and we do not sell it;
    4. we do not use it to train or improve artificial intelligence or machine learning models; and
    5. nobody at Mailfoy reads it, unless you ask us to (for example in a support request), it is needed for security (such as investigating abuse), or the law requires it.
  3. You can remove Mailfoy's access at any time in your Google Account under Security → Third-party apps with account access.
  4. If there is any inconsistency between this Clause 3 and any other part of this Policy or the Terms, this Clause 3 shall prevail in respect of Google user data.

4. How we use your data

If you provide us with Personal Data, you agree that it may be used by us for the following purposes:

  1. to provide the Services: verify your Domains, deliver your incoming email, let you send as your address, and show your delivery history;
  2. to verify your identity for the purposes of processing your Registration and servicing your Account;
  3. to administer and manage your Account, and to bill you for your Plan, through Stripe;
  4. to keep Mailfoy secure: detect spam, malware and abuse, protect Accounts, and keep an audit trail;
  5. to respond to your queries, requests, feedback and complaints;
  6. to contact you about your Account: setup, billing, security and changes to the Services. These are not marketing emails; and
  7. to comply with our legal obligations.

5. Automated processing of email

  1. Incoming email is scanned automatically by our email provider (Amazon Web Services) for viruses, spam and sender authentication (SPF, DKIM and DMARC).
  2. We block messages that contain a virus, or that fail the DMARC check of a sender domain that asks for such mail to be rejected, and record this in your traffic log.
  3. Apart from that automated processing, we do not analyse the content of your email.

6. Who we share it with

  1. Your Personal Data may be used by LYHCO, as well as by the Third Parties engaged solely in connection with the provision of the Services and/or the Website to you, in order to provide the Services and/or the Website to you. These service providers only process your data on our instructions:
    1. Amazon Web Services (Global): hosting, databases, and receiving, storing and sending email;
    2. Google (Global): sign-in, Gmail account linking, Gmail import and website analytics (Google Analytics); and
    3. Stripe (Global): payments, invoices and tax.
  2. Your Personal Data will not be shared with entities which are not engaged solely in connection with the provision of the Services and/or the Website, except where the law requires it, to protect the rights or safety of our users or others, or as part of a merger or sale of our business, in which case we will tell you first.
  3. We do not sell Personal Data, and we do not share it with marketing or advertising partners.

7. Where your data is stored

  1. Mailfoy stores your data with Amazon Web Services in Singapore.
  2. Google and Stripe may process data in other countries. Where data leaves Singapore or the EEA, we rely on our providers' contractual safeguards, such as standard contractual clauses, to protect it to the standard required by the PDPA and, where it applies, the GDPR.

8. How long we keep it

  1. Incoming email: until delivered to your Gmail, then deleted. Failed deliveries: up to 14 days.
  2. Delivery records: 90 days.
  3. Gmail import access token: until you leave the beta, remove the Mailbox or link a different Gmail account.
  4. Activity records (changes and sign-ins, with IP address, device, city and country): kept indefinitely, as a permanent audit trail.
  5. Technical server logs: kept indefinitely.
  6. Account, Domain and Mailbox details: while your Account is open, then deleted within 90 days of closing it.
  7. Billing records: as long as tax and accounting law requires.

9. How we protect it

  1. We will use our best endeavours to ensure that your Personal Data (including all electronic storage and transmission of such Personal Data) is secured with appropriate security technologies. In particular:
    1. all connections to Mailfoy use TLS encryption, and stored data is encrypted at rest;
    2. Gmail import tokens are encrypted with a dedicated key, separate from the rest of your data;
    3. each Mailbox gets its own sending credentials that can only send as that Mailbox's own addresses; and
    4. access to our systems is limited to what each part of the Services needs.

10. Consent and its withdrawal

  1. Where you provide us with the Personal Data of any other individual, including any Authorised User whose Gmail account you link or invite, you warrant that you have obtained that individual's consent, or are otherwise permitted by law, to disclose it to us for the purposes set out in this Policy.
  2. In the event that the collection, use or disclosure by us of Personal Data is permitted by law without the need to obtain your consent or the consent of the individual concerned, such permission granted by the law shall continue to apply.
  3. You may withdraw your consent to the collection, use and disclosure of your Personal Data by giving us reasonable notice at support@mailfoy.com, subject to any prevailing statutory, legal or contractual considerations. You agree that such withdrawal may result in the Services failing to function properly, or the provision of the Services being ceased.

11. Cookies

  1. The Mailfoy dashboard uses cookies that are strictly necessary to keep you signed in securely.
  2. The mailfoy.com website uses Google Analytics cookies to understand how visitors use the website, such as the pages they view and clicks on the sign-up buttons. Google Analytics does not run in the Mailfoy dashboard. You can block these cookies in your browser settings.
  3. We do not use advertising cookies. If that changes, we will update this Policy and ask for your consent where required.

12. Children

Mailfoy is not meant for anyone under 18, and we do not knowingly collect data from children.

13. Third party sites

We bear no responsibility for the content and privacy policies of any sites owned or operated by any other party which may be linked on the Website or accessible through the Services, including those of Google, Amazon Web Services and Stripe, whose own privacy policies govern their handling of your data.

14. Contact

MAILFOY
Email: support@mailfoy.com