Privacy policy

This policy explains what personal data Mailrail handles and why. There are two kinds: data about you, the account holder, which we control; and data about the people you email, which we process for you.

1. Account holders

We collect:

• your name, email address and a hash of your password;
• what you tell us when you apply to send (company, website, what you send and how you collected your list);
• billing details, handled by our payment processor; we do not store card numbers;
• logs of how you use the service, such as sign-ins, API calls and IP addresses, kept for security and abuse handling.

We use this to run your account, review and protect sending, bill you, and contact you about the service. We do not sell it.

2. Your recipients

When you send through Mailrail we store the contacts, attributes and lists you upload, the messages you send, and delivery events (delivered, bounced, opened, clicked, unsubscribed, complained), which can include the recipient's IP address and email client. You are the controller of this data; we process it only to provide the service to you, and we do not use it for anything else. Open and click tracking can be turned off per workspace.

Unsubscribes, bounces and complaints are kept on a suppression list so we never mail that address again for you, even if you upload it again. If you are a recipient and want your data removed, contact the sender who emailed you; we will help them handle the request.

3. Service providers

• Amazon Web Services (Simple Email Service), to deliver email and report bounces and complaints;
• DigitalOcean, which hosts the application and database;
• an AI model provider (currently DeepSeek), only when you use the optional email designer, which receives the instructions and content you give it;
• our payment processor, for paid plans.

These providers may process data outside your country, including in the United States, under contracts that require them to protect it.

4. Retention

We keep account and customer data while your account is open, and delete it within 90 days after it closes. We keep suppression entries and records needed to handle abuse reports or meet legal duties for as long as those require.

5. Security

Data is encrypted in transit. Passwords are hashed, API keys are stored only as hashes, and access to production systems is limited to the people who run the service.

6. Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to how we use it. Email privacy@mailrail.io and we will reply within 30 days. You can also complain to your local data protection authority.

Version 2026-10-18. Last updated October 18, 2026.