Privacy policy

Who is responsible

For the accounts of the people who use Mailroomly (their name, email address and sign-in), for signing up and billing, for our website and for trying Mailroomly by email, Yomatico Unipessoal Lda is the controller.

For the email an organization sends and receives through Mailroomly, and the personal data in it, that organization is the controller and we process it on its behalf, following its instructions, under the data processing terms in our terms of service.

You can reach us about privacy at hello@mailroomly.com. We have not appointed a data protection officer; this address reaches the people responsible.

What we keep

Account data: your name, email address, role, language, the organizations you belong to, a hash of your password if you use one, the identifier of your Google, Microsoft or LinkedIn account if you sign in with one, a recovery address if you add one, and when you last signed in.

Signing up: the name, email address and organization name you enter, while you confirm your address with the code we email you. To limit abuse, we also keep a keyed hash of the IP address the request came from, never the address itself: it is deleted with a sign-up you do not confirm, or 30 days after your organization is created.

Billing data, when your organization pays for a plan: the billing name, address, VAT number and email, the plan, its payments and its invoices. Card and other payment details go straight to our payment provider; we never see or store them.

Email: the messages an organization sends and receives (addresses, subject, body and attachments), and what happens to them: accepted, delivered, bounced, marked as spam.

When an organization tracks opens and clicks, we also record when a recipient opened a message or clicked a link, with the IP address and browser information (user agent) that came with it.

Lists that protect deliverability: addresses that bounced, complained or unsubscribed, so they are not emailed again.

Usage and security records: how much each organization sends and receives, API calls, and an audit trail of administrative actions. IP addresses used to sign in are only checked in memory to slow down attacks, and not stored. To limit abuse of emailed codes, we count how many codes each email address asks for and gets wrong, as keyed hashes of the address, never the address itself, for 24 hours. Our server logs never contain email addresses or message content.

Trying Mailroomly by email

On our website you can try Mailroomly by sending an email to try@mailroomly.com with a code from the page. We keep that email’s subject, the first 280 characters of its text and your email address for 24 hours, only to show them on the page you sent it from (your address partly hidden) and to answer you once, with a fixed text. Its attachments are not kept. After 24 hours we delete all of it.

We never add your address to a list, use it for marketing or share it. An email without a valid code is deleted at once and never answered. To limit abuse, keyed hashes of your address, its domain and your IP address are kept for the same 24 hours; after that only counts with no personal data remain, for 7 days. The basis is your request, and our legitimate interest in keeping the try from being abused.

Writing to us from our website

When you write to us with the form on mailroomly.com/contact, your name, email address, company and message reach our team as an email, which we answer from our inbox and keep as our correspondence. The form itself stores nothing. To limit abuse, we count messages from each network and each sender for up to a day, as keyed hashes, never the addresses themselves. The basis is your request, and our legitimate interest in keeping the form from being abused.

Why we use it, and on what legal basis

To provide the service you or your organization signed up for: sign-in, inboxes, sending and receiving email, campaigns, AI agents and integrations, and billing for paid plans. The basis is our contract with you or your organization, and the steps you ask us to take before it, such as signing up.

To keep the service safe and email clean: preventing abuse, spam and fraud, suppressing addresses that bounce or complain, and investigating problems. The basis is our legitimate interest, and that of everyone who relies on email arriving.

To keep records the law requires, such as invoices and billing records, which Portuguese tax law requires us to keep for 10 years. The basis is a legal obligation.

To send the emails the service needs, such as sign-up codes, invitations, password resets, receipts and notices. We send other news only with your consent, which you can withdraw at any time. We never sell personal data.

AI

Mailroomly does not use email or any personal data to train AI models, ours or anyone else’s.

An organization can connect AI agents of its choice to its inboxes through our API or the Model Context Protocol (MCP). They act on that organization’s instructions, with access only to the addresses it allows, and under its own agreement with the AI provider.

Automatic decisions

Some protections run on their own: an address that bounces or complains is no longer emailed, and an organization’s sending pauses when its bounce or complaint rates rise. None of them makes decisions with legal or similarly significant effects about a person.

How long we keep it

Email is kept for the period set for each organization by its plan: 60 days by default, never more than 730 days. Conversations with no activity for longer are deleted whole; email sent by applications, events and webhook deliveries are deleted by age.

Account data and the audit trail are kept while the account or organization exists, and usage counts for up to 730 days. When an organization is closed, its data is deleted within 30 days, and when you delete your account, its data goes with it. Lists that stop email to an address are kept while they protect it.

A sign-up you do not confirm expires after 24 hours, and what you send to try Mailroomly is deleted after 24 hours. Database backups are kept for 7 days, and server logs for 30 days. Invoices and billing records are kept for 10 years, as Portuguese tax law requires, also after an organization is closed.

If you received an email sent through Mailroomly

The organization that sent it is responsible for your data: ask it about your data, or unsubscribe with the link in its newsletters. If you write to us at hello@mailroomly.com, we pass your request to that organization and help it answer.

To report unwanted email sent through Mailroomly, write to hello@mailroomly.com.

Who helps us

Our cloud infrastructure provider runs Mailroomly’s servers, database and storage, and sends and receives its email, in the European Union (Ireland).

When an organization tracks opens and clicks, those links pass through a worldwide content delivery network run by the same provider.

Our payment provider (Stripe) takes the payments for paid plans and works out their VAT: it receives the billing name, address, VAT number and email, and the card or other payment details, which it keeps itself. We receive only what we need to bill and keep our records, never full card numbers.

Google, Microsoft and LinkedIn help only if you choose to sign in with one of them: it tells us your name, email address, account identifier and whether it verified that address.

Each provider works under a contract that protects your data. Where one processes data outside the European Economic Area, it does so under the European Commission’s standard contractual clauses or an adequacy decision. Write to hello@mailroomly.com for the list of our providers.

When we share data

We share personal data only with the providers above, with an organization about its own users and email, with the Portuguese tax authority through the invoices the law requires, and with other authorities when the law requires it. We check that every request from an authority is lawful, and share only what it requires.

Cookies

Mailroomly uses four cookies, all needed for it to work: one that keeps you signed in, one that tells our website you are signed in so it can take you straight to your Mailroom (mr_signed_in, which holds nothing else; it is removed when you sign out, or the next time the app sees you are no longer signed in, and in any case when you close your browser), one that protects your forms against requests from other sites, and, only while you sign up, mp_signup, which lets the password you chose count when you open the emailed link in the same browser (it lasts 24 hours, and the page itself can’t read it). Your browser also stores your language, theme and unsent drafts. Our website and app use no advertising or analytics cookies. When you pay, the payment page is our payment provider’s, which uses its own cookies to prevent fraud.

How we protect it

Connections use HTTPS, and data is encrypted at rest. Passwords are stored as salted hashes, and API keys, tokens and one-time links as keyed hashes. Other secrets are encrypted. Platform administrators sign in only with Google and two-step verification, and they never read an organization’s email.

If a security incident puts personal data at risk, we tell the Portuguese data protection authority within 72 hours where the law requires it, and the organizations and people affected without undue delay.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format, and you can withdraw a consent at any time. Write to hello@mailroomly.com and we will answer within a month.

If your data is in email an organization handled through Mailroomly, we pass your request to that organization and help it answer.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

Children

Mailroomly is a service for organizations and the adults who work with them. It is not meant for children, and we do not knowingly collect their data.

Changes

If we change this policy, we update the date above, and we tell organizations about important changes before they apply.