Privacy policy
Last updated: 26:10:2026
This policy explains how personal data is processed when you use AnyMail, as required by Articles 13 and 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). It also contains the information about cookies and similar technologies required by EU ePrivacy rules as implemented in Poland.
1. Who is responsible for your data
The controller of your personal data is Michał Płatosz, an individual based in Poland, who operates AnyMail ("AnyMail", "we", "us") and the website and service available at anymail.tech (the "Service").
- Postal address: ul. Pogodna 4C/45, 15-354 Białystok, Poland
- Email: legal@anymail.tech (for all privacy questions and requests)
We have not appointed a Data Protection Officer. We are not a public body, and our core activities do not consist of large-scale, regular and systematic monitoring of individuals or large-scale processing of special categories of data, so a DPO is not required under Art. 37 GDPR. Privacy matters are handled directly by the controller at the address above.
2. Who this policy covers and our role
This policy applies to:
- Account holders - anyone who registers an AnyMail account;
- Shared-inbox users - AnyMail users to whom an account holder grants access to an inbox;
- Correspondents - anyone who sends mail to, or receives mail from, an address hosted on AnyMail, even if they have never used AnyMail themselves, and anyone whose personal data appears in that mail;
- Visitors - anyone who visits anymail.tech without signing in, and anyone who contacts us.
When we are the controller. We are the controller for your account, billing and security data, for the data we need to run, secure and protect the Service (including spam and abuse detection), and for the mail of account holders who use AnyMail for their own personal purposes.
When we act for a business customer. If an account holder uses AnyMail for their business or organisation (for example, mailboxes for employees or for customer correspondence), that account holder is usually the controller of the personal data inside their mailboxes, and we process that mail content on their behalf as a processor under the data processing terms in Section 17 of our Terms of Service. If you are a correspondent of such an organisation, please direct requests about your mail primarily to that organisation; we will help them answer it. Even in that case we remain the controller for our own security and abuse-prevention processing described in Sections 6 and 7.
3. What data we process and where it comes from
Data you give us or create in the Service
- Account data: email address, a bcrypt password hash (never the password itself), roles, account status, plan and billing status, the date you accepted the Terms of Service and Privacy Policy at registration, the date you acknowledged our cookie notice, creation and last sign-in timestamps, email-verification status, and - if you enable two-factor authentication - an encrypted TOTP secret and hashed one-time recovery codes. When you change or reset your password or change your email address, we store when your password was last changed and, only while a change is pending, the new email address you requested. Links we email for these purposes contain a one-time code; we store only a cryptographic fingerprint (hash) of it, never the code itself.
- Mail hosting configuration: mail servers, the domains you attach or the subdomain of fromanymail.tech you choose, a domain-ownership verification token, DNS check results, DKIM keys (the private key is stored encrypted), inbox addresses and aliases, inbox avatars (an uploaded image or a link to an image), filter rules, sharing grants (who has access to which inbox, and with which role), mail-app (SMTP) credentials and API keys (stored only as hashes), webhook settings and their delivery log, and notification preferences.
- Mail content: messages you send, receive, draft or move to Trash - sender and recipient addresses, subject, body, attachments, technical message headers used for threading, delivery status, spam score, and internal notes and assignments added in shared inboxes.
- Billing data: your plan, subscription status and billing period, and Stripe customer and subscription identifiers. Card details and billing details you enter at checkout are collected by Stripe directly; we never see or store your full card number.
- Business plan data (only if you request the Business plan): the registrant details you enter for the domain registration - full name, phone number, postal address (street, postal code, city, country) and a contact email address (your account email unless you change it) - the domains you would like, your message, and when you agreed to their use; the offers we send you (domains, prices, status, validity, and a hash of the offer link - never the link itself); for each domain registered for you, the registrar, the registration and expiry dates and the renewal status; and internal notes we make while preparing your offer.
- Feedback and correspondence: anything you send through the in-app Feedback tool or by email (for example a complaint, a withdrawal notice, a content report or a privacy request).
- Push notification data (only if you enable browser push): the push endpoint and encryption keys your browser creates for AnyMail.
Data created automatically when you use the Service
- Request telemetry: for requests to our API - method, path, response status, duration, your internal user id if you are signed in, and your browser's User-Agent string. We do not store your IP address in this record.
- Failed sign-in records: the email address that was entered, the IP address and the reason the attempt failed.
- Automated-traffic protection: to protect the Service and your account from automated abuse, we check each request to the part of our application interface used by the web app for signs of automation. This uses the request's IP address and headers (such as the browser identifier, known as the User-Agent) and, for a request that claims to come from a search engine, a reverse-DNS lookup of its IP address. The check runs in our server's memory and is not written to our database. To recognise bursts, it briefly remembers, per IP address, when requests arrived, a hash of the addresses requested and up to 4 browser identifiers; this is forgotten 15 minutes after the address goes quiet. For the last 200 requests identified as automated, we keep the time, IP address, browser identifier, method, address requested and result in memory for security review. Everything here is lost whenever the service restarts, and requests from ordinary visitors are never listed.
- Honeypot records: our servers contain decoy addresses (such as
/.envor/wp-login.php) and fake credentials that no ordinary visitor ever uses. When a request touches one - or carries an exploit attempt or an attack tool's signature - we record the time, IP address, the method and address requested, the browser identifier, a technical fingerprint of the request headers, what was detected and how we responded. We never store the content of such requests, cookies, sign-in headers, any other header, or any password or command that was entered. - Security audit log: an entry for security-relevant and administrative actions (for example creating or deleting a mail server, sending mail, changing roles, an administrator opening a message), recording who acted (internal user id), what was affected (internal ids), when, the IP address the request came from, and limited details about the action - which, for some actions, include a domain name, an inbox address, a webhook URL, or the recipient or sender address of a message (never its subject, body or attachments). When you buy a plan, the log also records that you asked us to start the service immediately and acknowledged the consequences for your right of withdrawal, and, when you pay a Business plan or domain renewal offer, that you asked us to register or renew the domain immediately and acknowledged that your right of withdrawal for it then ends (only the number of domains, never their names).
- Server logs: our web server and application keep technical logs that may include IP address, requested URL, time and User-Agent. Known personal fields (email addresses, passwords, tokens, cookies) are automatically redacted from application logs.
- Spam reputation: a per-account count of spam violations, whether sending is restricted, and short-lived fingerprints of recent outgoing messages used to detect bursts and duplicates.
- Error reports: when something fails on our servers or in the app in your browser, a technical report of the failure - the error message and stack trace, the page or API route (without ids or query parameters), the browser family, the app version and, if you are signed in, your internal user id. Email addresses and access tokens are removed from the report; it never contains your IP address, request bodies or cookies.
- Greylisting records (spam prevention): for mail sent to an AnyMail-hosted address, the sending mail server's network prefix (IPv4 /24 or IPv6 /64, never the full IP address) and a one-way hash of the sender address, recipient mailbox and that prefix.
Data we receive from others (Art. 14 GDPR)
If you are a correspondent, we receive your data from the person or system that sent the mail: your email address, name as shown in the message, the content you wrote and anything attached, and technical headers - either because you wrote to an AnyMail-hosted address or because an AnyMail user wrote to you. When you write to an AnyMail-hosted address, we also keep a greylisting record for a limited time: your mail server's network prefix and a one-way hash of your address, the recipient mailbox and that prefix (see Sections 3, 4 and 10). If you were given shared access to an inbox, we receive your account email from the account holder who invited you. We also obtain public DNS records for domains attached to AnyMail, from Stripe we receive payment status updates for your subscription, and, if we register a domain for you on the Business plan, we receive its registration details (such as the registration and expiry dates) from the registrar. Because we usually have no way to contact correspondents individually, this public policy is how we inform them (Art. 14(5)(b) GDPR).
4. Purposes and legal bases
We process personal data only for the following purposes, each with its own legal basis under Art. 6(1) GDPR:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account: registration, email verification, sign-in, two-factor authentication, switching between linked accounts, resetting and changing your password, changing your email address | Account data | Performance of our contract with you - Art. 6(1)(b) |
| Providing the mail service you signed up for: mail servers, domain and DNS verification, inboxes, sending, receiving, storing, searching, filtering and forwarding mail, shared inboxes, mail-app access, API keys and webhooks | Account data, configuration, mail content | For account holders: contract - Art. 6(1)(b). For correspondents and other people mentioned in mail: our and the account holder's legitimate interest in operating the mail service the account holder contracted for - Art. 6(1)(f). For business customers' mail: on the customer's behalf as their processor (see Section 2) |
| In-app and browser push notifications you choose to enable | Account data, notification preferences, push subscription, sender and subject of new mail | Contract - Art. 6(1)(b) |
| Taking payment and managing your plan | Account and billing data | Contract - Art. 6(1)(b) |
| Business plan: preparing an offer at your request, registering the domain in your name, setting up mail for it, renewal offers and reminders, and handing the domain over to you | Business plan data, account data | Steps taken at your request before entering into a contract, and performance of the contract - Art. 6(1)(b). Handing a domain over after your account has been deleted: our and your legitimate interest in returning your property to you - Art. 6(1)(f) |
| Keeping accounting and tax records | Billing data, invoices | Legal obligation - Art. 6(1)(c), under Polish tax and accounting law |
| Service emails: email verification, password-reset and email-change links, security notices about password and email-address changes, delivery failures, account-deletion warnings and confirmation | Email address, account status | Contract - Art. 6(1)(b) |
| Securing the Service and preventing abuse: spam and abuse scoring, sending limits, sender restrictions, rate limiting, recording failed sign-ins, the security audit log | Account data, mail content and metadata, IP address, User-Agent, audit records | Legitimate interest - Art. 6(1)(f): protecting our users, the Service and the shared sending reputation every customer depends on, and detecting fraud and unauthorised access |
| Automated-traffic protection: recognising and refusing requests from automated clients (for example scripts that identify themselves as such, or a client falsely claiming to be a search engine) | IP address, request headers including the User-Agent, method and address requested, result of the check | Legitimate interest - Art. 6(1)(f) in protecting the Service and your account from automated abuse |
| Honeypot: detecting attacks through decoy addresses and fake credentials, and blocking an IP address for one hour when there is proof of an attack | IP address, method and address requested, User-Agent, a fingerprint of the request headers, what was detected | Legitimate interest - Art. 6(1)(f) in detecting and stopping attacks on the Service |
| Keeping a released Subdomain-plan name blocked after an account is deleted, so that nobody else can receive mail meant for its former user | The subdomain name | Legitimate interest - Art. 6(1)(f) in protecting the former user and their correspondents from someone taking over their address |
| Greylisting of incoming mail: briefly deferring the first message from an unknown sending server | Network prefix of the sending mail server; one-way hash of the sender address, recipient mailbox and that prefix | Legitimate interest - Art. 6(1)(f) in protecting mailboxes from unsolicited bulk mail |
| Detecting and fixing errors in the Service (error reports from our servers and from your browser) | Error reports | Legitimate interest - Art. 6(1)(f) in keeping the Service working and secure |
| Administrator access to mail for abuse investigation, security incidents and support you ask for | Mail content | Legitimate interest - Art. 6(1)(f) (see Section 7) |
| Handling complaints, withdrawals, notices of illegal content and requests from authorities | Correspondence, account data, relevant content | Legal obligation - Art. 6(1)(c) (consumer law, the Digital Services Act); legitimate interest in establishing, exercising or defending legal claims - Art. 6(1)(f) |
| Recording that you accepted the Terms and Privacy Policy, that you asked for a plan to start immediately before the withdrawal period ends, and that you asked for a domain to be registered or renewed immediately | Account id, acceptance date, audit log entry | Legitimate interest - Art. 6(1)(f) in being able to prove the terms of our contract and the basis for any pro-rata payment on withdrawal |
| Aggregate usage statistics (traffic volume, popular endpoints, browser and device type share) | Request telemetry | Legitimate interest - Art. 6(1)(f): understanding load, performance and which browsers to support. Statistics are aggregated and are not used to profile you |
| Answering feedback and support messages | Feedback, correspondence | Legitimate interest - Art. 6(1)(f) in responding to you and improving the Service; contract where it concerns your account |
| Serving the website to visitors who are not signed in | IP address, User-Agent, server logs | Legitimate interest - Art. 6(1)(f) in delivering and securing the website |
We do not currently rely on consent (Art. 6(1)(a)) for any processing. We do not sell personal data, show advertising, build advertising profiles, or use your mail content to train machine-learning models.
5. Do you have to give us your data?
Providing your email address and a password is a contractual requirement: without them we cannot create an account. Payment details are required only if you buy a paid plan. If you request the Business plan, the registrant details are required, because the registrar and the registry require them to register a domain in your name; without them we cannot prepare an offer. Everything else - two-factor authentication, push notifications, avatars, feedback - is optional. Correspondents are not obliged to give us anything, but mail cannot be delivered without a sender and recipient address.
6. Automated spam and abuse scoring
Every message sent or received through the Service is scored automatically using content rules (for example, typical spam phrases or suspicious links) and behaviour signals (for example, sending volume, duplicate messages, and the sender's history of spam violations). Depending on the score:
- moderate-confidence spam is delivered but hidden behind a "show spam" toggle in the recipient's inbox;
- high-confidence spam is not delivered but held for review by a human administrator, who can release it;
- if an account repeatedly sends mail that is held as spam, its ability to send further mail is restricted automatically until an administrator reviews and lifts the restriction.
Separately, each mail server has a fixed hourly sending limit (lower for new mail servers during their first two weeks) that does not depend on content.
We do not consider these measures to be decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR: they are temporary, affect only how mail is routed within the Service, and are always reviewable by a person. Nevertheless, if a held message or a sending restriction affects you, you can at any time ask for a human review, explain your point of view and contest the outcome by writing to legal@anymail.tech; an administrator will review it and reply. Our legal basis for this scoring is our legitimate interest in keeping the Service free of spam and abuse (Art. 6(1)(f)).
Our automated-traffic protection and honeypot (Section 3) also act automatically: a request from a client that identifies itself as a script or other automated tool, or that falsely claims to be a search engine, is refused, and an IP address that gives proof of an attack - for example by using one of our fake credentials - is blocked for one hour. These measures apply to requests and IP addresses, not to a decision about you as a person: they are based only on technical evidence, never on a score alone, are short-lived, and do not affect your account or contract. If you believe you were blocked by mistake, write to legal@anymail.tech and a person will look into it.
7. Administrator access to mail content
Platform administrators can search for and open messages in any account. They do this only when it is necessary to investigate abuse or a reported legal violation, respond to a security incident, review mail held as spam, or help you with a support request you have made. This rests on our legitimate interest in operating and securing the Service (Art. 6(1)(f)). Every message an administrator opens is recorded in the audit log with the administrator's identity, the message, the time and the IP address, so this access can be reviewed independently. Administrators are bound to confidentiality.
8. Who receives your data
We share personal data only where needed, with:
| Recipient | Role and data |
|---|---|
| Stripe Payments Europe, Ltd. (Ireland) and its affiliates, including Stripe, Inc. (USA) | Payment processing and subscription management. Receives your email address, internal user id and chosen plan (and, when you pay a Business plan or renewal offer, the names of the domains being paid for), and collects your payment and billing details directly from you. Stripe acts as our processor and, for its own purposes such as fraud prevention and its legal obligations, as an independent controller under its own privacy policy (stripe.com/privacy). |
| Our production server, located in Poland | Runs the Service (web application, mail transport and the alert hub). Mail in transit, server logs and the application itself are processed here, and the encrypted daily backups of our database are stored here (see Section 10). |
| MongoDB Atlas, operated by MongoDB, Inc. (USA) and its group companies, with our database hosted in Germany (EU) | Stores all account, configuration and mail data, as our processor. |
| Your browser's push service (e.g. Google, Mozilla, Apple or Microsoft, depending on your browser) | Only if you enable push notifications. Notification contents (sender and subject of new mail) are end-to-end encrypted for your browser, so the push service cannot read them; it sees only the push endpoint and the time and size of each notification. |
| The domain registrar we use for your domain, and the registry for its extension (for example NASK for .pl domains) | Only on the Business plan. To register the domain in your name, the registrar receives the registrant details from your request (name, postal address, phone number, contact email) and passes them on as required to the registry. Each acts as an independent controller under its own terms and privacy policy and the rules that apply to the domain extension (for generic domains such as .com, those set by ICANN). Whether and which registrant details are published in public domain lookup services (WHOIS/RDAP) depends on those rules - for individuals they are often withheld. The name of the registrar is shown in your account once the domain is registered. |
| Recipients of your mail and their mail providers | When you send mail to an address outside AnyMail, the message, your address and technical headers (including our DKIM signature) are delivered to the recipient's mail server - at your instruction. |
| Webhook endpoints you configure | Event data about your messages (for example a new message or a failed delivery), sent to the URL you entered - at your instruction. |
| Other AnyMail users you share an inbox with | Can read (and, as managers, act on) the mail in that inbox, according to the role you gave them. |
| Public authorities, courts, and our professional advisers | Only where we are legally required to disclose data, or where necessary to establish, exercise or defend legal claims; advisers are bound to confidentiality. |
Our TLS certificates are issued by Let's Encrypt (Internet Security Research Group, USA), which receives only our own domain names and an administrative contact address - none of your data. Verification and other service emails are sent by our own mail server; no third-party email delivery provider is used.
9. Transfers outside the EEA
Some recipients are located, or have group companies, outside the European Economic Area - in particular Stripe, Inc., the browser push services and MongoDB, Inc. (the US parent of our database provider - the database itself is stored in Germany), which are based in the USA. Where personal data is transferred to a country without an EU adequacy decision, the transfer is protected either by the recipient's certification under the EU-U.S. Data Privacy Framework (on the basis of the European Commission's adequacy decision of 10 July 2023) or by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for information about these safeguards at legal@anymail.tech. When you send mail to someone outside the EEA, or point a webhook at a server outside the EEA, or order on the Business plan a domain whose registrar or registry is located outside the EEA, the transfer happens at your request and is necessary to perform our contract with you (Art. 49(1)(b) GDPR).
10. How long we keep data
| Data | How long we keep it |
|---|---|
| Account data | As long as your account exists. Accounts without an active paid plan are deleted automatically - see 10.1. If you use "Delete my account", the account and everything it owns is deleted immediately - see Section 11. Copies in our encrypted backups expire within 14 days (see "Backups" below). |
| Two-factor secrets and recovery codes | Until you turn two-factor authentication off, or your account is deleted. |
| Email-verification link | Until it is used or expires. |
| Password-reset and email-change links | Password-reset links expire after 1 hour and email-change confirmation links after 24 hours, and each works only once. We delete the stored fingerprint when the link is used, when a newer request replaces it, when you change your password, or with your account; after expiry it can no longer be used. |
| Requested new email address | Until the change is confirmed, cancelled or replaced by a new request, or you change your password, or the account is deleted. Once the confirmation link has expired, the address can no longer be confirmed, but it stays on your account until one of these happens. |
| Date your password was last changed | As long as your account exists. |
| Mail servers, domain configuration, inboxes, filters, sharing grants, mail-app credentials, API keys, webhooks and their delivery log, notification settings | Until you delete them, or your account is deleted. Revoked keys and credentials stay listed (unusable) until the account is deleted. |
| Messages, drafts, internal notes | Until you delete them (via Trash), or your account is deleted. |
| Messages in Trash | 30 days after being moved to Trash, then permanently deleted (unless restored earlier). |
| Attachment file contents | As long as the message they belong to - deleted together with it (when it is permanently deleted or emptied from Trash, or the inbox or account is deleted). Attachments removed under our earlier 90-day rule stay removed; the message shows only their name, type and size. |
| Storage usage counters (bytes and message count per inbox) | As long as the inbox exists; recounted daily from the messages themselves. They contain no message content. |
| Unsubscribe (suppression) list of a mail server | As long as the mail server exists, so the opt-out keeps being honoured. |
| In-app notifications, push subscriptions | Until you delete or disable them, your browser invalidates the subscription, or your account is deleted. |
| Feedback, spam reputation | Until your account is deleted. |
| Request telemetry | A rolling buffer of the 5,000 most recent requests; older entries are overwritten automatically. |
| Failed sign-in records | A rolling buffer of the 5,000 most recent failed attempts. |
| Automated-traffic protection | In memory only, never in our database: the per-address memory is forgotten 15 minutes after the address goes quiet, and only the last 200 requests identified as automated are kept. Everything is lost whenever the service restarts. |
| Honeypot records | A rolling buffer of the 5,000 most recent records; older ones are overwritten automatically - under a sustained attack within hours, otherwise within weeks. A block of an IP address lasts one hour and, like the running score per address, is kept in memory only. |
| Business plan requests and offers | A request that never led to a paid offer is deleted, with its offers, 12 months after it was made. A paid request, its offers and the records of domains registered for you are kept as long as your account exists, because renewals and a handover rely on them. When the account is deleted, requests and offers are deleted with it (see 10.1). |
| Domain handover record after account deletion | For each domain registered in your name: the domain and only your name and email address, until the domain has been handed over and at most 60 days after the account was deleted. |
| Released Subdomain-plan names | The name you chose (for example yourname from yourname.fromanymail.tech) for 90 days after your account is deleted, stored without any link to your account, so that nobody else can register it and receive mail meant for you; then it is deleted automatically. A name can itself identify you (for example a first and last name). |
| Error reports | Error reports (technical details of failures in our service or your browser, with any email addresses and access tokens removed): 30 days after the error last occurred. When an account is deleted, its user id is removed from these reports immediately. |
| Greylisting records | Records of first-time senders are deleted automatically after 24 hours; records of confirmed senders 36 days after the last message they delivered. |
| Security audit log | 365 days, then deleted automatically. When an account is deleted, the details (including any addresses, domains or URLs) are immediately removed from every entry about that account; only the action, internal ids, time and IP address remain until the 365 days are up. Exception: the entry recording your express request to start a plan immediately, before the withdrawal period ends (its details are only the plan and the confirmations you gave), is kept for 6 years - the general limitation period for claims under Art. 118 of the Polish Civil Code - as evidence of the contract terms and of the basis for any pro-rata payment on withdrawal; its details are not removed when the account is deleted. The same applies to the entry recording your express request to register or renew a domain immediately and your acknowledgement that the right of withdrawal for it then ends (its details are only the kind of offer, the number of domains and those confirmations). |
| Web server and application logs | Kept in a size-limited rotating buffer (at most 30 MB per service) and overwritten automatically once it is full; never archived. |
| Backups | An encrypted copy of the whole database is made every day and kept for 14 days, then deleted automatically. The copies are encrypted before they are written and are stored on our production server in Poland (and, if configured, as an encrypted off-site copy); we use them only to recover the Service after data loss, never to restore individual accounts or messages on request. Data deleted from the live database - by you, by an erasure request or by the retention rules above - therefore remains in the backups made before the deletion until they expire, at most 14 days later. If we ever have to restore a backup, then before the Service resumes we delete again every account deleted since that backup was made and re-apply the retention rules above. Individual items you deleted yourself during that period (for example a single message) could reappear; you can delete them again. |
| Payment records and invoices | Kept by Stripe, and where applicable by us, for as long as required by tax and accounting law - in Poland generally 5 years from the end of the calendar year in which the tax obligation arose. Our own copy of your subscription status is deleted with your account. |
| Correspondence about complaints, withdrawals, content notices and privacy requests | As long as needed to handle the matter, and then until the limitation period for related claims expires (generally up to 6 years under the Polish Civil Code). |
| Session (sign-in) | The sign-in token expires 2 hours after you sign in; the cookie itself is deleted when you close your browser or sign out. |
10.1 Automatic deletion of accounts without an active plan
An account that does not have an active paid plan is permanently deleted 2 months after its plan ended - or, if no plan was ever bought, 2 months after registration. A plan counts as active while its subscription is active or while a failed payment is being retried.
- Before deletion, we email the account owner a warning 30, 14, 7, 3, 2 and 1 day(s) before the deletion date, and the date is shown in the app.
- Buying or reactivating a plan before that date cancels the deletion.
- Deletion is complete and irreversible. It removes the account and all its mail servers, domain configuration, inboxes, messages, attachments, filters, mail-app credentials, API keys, webhooks, notifications, push subscriptions, sharing grants, feedback, and Business plan requests and offers (including the registrant details).
- Not deleted immediately: security audit log entries, which are stripped of their details at deletion and removed after 365 days - except the records of a request to start a plan immediately and of a request to register or renew a domain immediately, which are kept unchanged for 6 years (see the table above) - a handover record for each domain registered in your name on the Business plan (only the domain, your name and email address, for at most 60 days), a released Subdomain-plan name (blocked for 90 days, without any link to you), payment records and invoices that Stripe must keep under tax and accounting law, and copies in our encrypted backups made before the deletion, which expire within 14 days and are never used to bring a deleted account back (see "Backups" in the table above).
- We send a confirmation email once the account has been deleted.
- Platform administrator accounts are exempt from this rule.
To keep a copy of your data, including all your messages and attachments, use Account & privacy → Export my data before the deletion date.
11. Your rights and how to use them
Under the GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure ("right to be forgotten", Art. 17);
- restriction of processing (Art. 18);
- data portability - receiving data you gave us in a machine-readable format, or having it sent to another provider (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21) - we will then stop unless we have compelling legitimate grounds or need the data for legal claims;
- withdraw consent at any time, where processing is based on consent, without affecting earlier processing;
- human review of automated decisions, to express your view and to contest them (Art. 22) - see Section 6;
- lodge a complaint with a supervisory authority - in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl - or with the authority in the EU country where you live or work, or where the alleged infringement took place.
Self-service tools
Signed-in account holders can use Account & privacy:
- Export my data downloads a single JSON file with your account record, subscriptions, mail servers, inboxes with every message (including attachment file contents and internal notes), filters, mail-app credential and API key details, sharing grants you gave and received, webhooks (including their signing secret), notification settings and notifications, push subscription endpoints, feedback, and your Business plan requests, offers and registered domains (without our internal notes). For security, it leaves out password and recovery-code hashes, two-factor secrets, hashes of API keys and mail-app credentials, DKIM private keys, domain-ownership tokens, offer-link hashes and push encryption keys. Store the file securely - it contains your mail and live webhook secrets.
- Delete my account permanently and immediately deletes your account and everything it owns - the same data listed in 10.1. A paid plan is cancelled at Stripe first, so no further payments are taken (Stripe keeps its invoice history, as required by law). Apart from copies in our encrypted backups, which expire within 14 days and are never used to bring a deleted account back, only the security audit log keeps its entries - stripped of details and removed after 365 days, except the records of a request to start a plan or register a domain immediately, which are kept for 6 years (see Section 10) - and we keep the domain handover records and the released Subdomain-plan name described in 10.1. Deletion cannot be undone, so export your data first if you want to keep it. Administrators can carry out the same deletion on your behalf if you ask us by email.
Most account details can be corrected directly in the app. For any other request, write to legal@anymail.tech from the email address of your account (or, if you are a correspondent, tell us which address and messages the request concerns). We may ask for additional information if we need to confirm your identity. We respond within one month of receiving your request; for complex or numerous requests this can be extended by up to two further months, in which case we tell you why within the first month (Art. 12(3) GDPR). Exercising your rights is free of charge.
12. Cookies and local storage
Cookies are small text files a website stores in your browser; local storage is a similar browser feature. We use only cookies and storage that are strictly necessary to provide the Service you request, or to remember a setting you chose. Under Art. 5(3) of the ePrivacy Directive and Art. 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej), such storage does not require your consent - only clear information, which this section provides. We use no analytics, advertising, social-media or other third-party cookies or trackers, and no third party can set cookies through our website.
| Name | Purpose | Type | Duration |
|---|---|---|---|
anymail_session__<id> | Keeps you signed in. One cookie per account signed in on this browser (up to 5). HttpOnly - not readable by scripts. | Cookie, first-party, strictly necessary | Until you close the browser or sign out; the token inside expires after 2 hours |
anymail_active_account | Remembers which of your signed-in accounts is currently active. | Cookie, first-party, strictly necessary | Until you close the browser or sign out |
anymail_csrf | Security token that proves requests come from your browser (protection against cross-site request forgery). | Cookie, first-party, strictly necessary | Until you close the browser or sign out |
anymail_local_consent_dismissed | Remembers that you have seen the cookie notice while signed out, so it is not shown again. | Local storage, strictly necessary | Until you clear your browser data |
anymail-theme | Remembers the light/dark theme you picked. The interface library may store companion keys (mui-color-scheme-light / mui-color-scheme-dark) for the same purpose. | Local storage, preference you set | Until you clear your browser data |
anymail:sidebar-collapsed, anymail:mail-rail-open, anymail:mail-thread-view | Remember layout choices: collapsed sidebar, inbox switcher open, conversation view. | Local storage, preference you set | Until you clear your browser data |
anymail.alert-device… | Administrators only: the key pair that lets this browser receive operator alerts. | Local storage, strictly necessary for that feature | Until the device is disconnected or browser data is cleared |
| Service worker and offline cache | Stores the app's own program files (never your mail or account data) so the app loads quickly and works offline, and receives push notifications if you enabled them. | Cache storage, strictly necessary | Until replaced by a newer version or you clear your browser data |
anymail_session__<id>anymail_active_accountanymail_csrfanymail_local_consent_dismissedanymail-themeanymail:sidebar-collapsed, anymail:mail-rail-open, anymail:mail-thread-viewanymail.alert-device…Local storage values stay in your browser and are not sent to our servers. You can delete cookies and local storage at any time in your browser settings; if you block the cookies above, you will not be able to sign in. If you have signed in, the date you acknowledged the cookie notice is also stored with your account.
13. Content loaded from other servers
Some HTML emails contain images hosted on the sender's servers, and an inbox avatar can be set to an image link. When your browser displays such a message or avatar, it loads the image directly from that server, which can learn your IP address, your browser type and the time the image was loaded - and so, for example, that you opened the message. We do not control those servers; their own privacy policies apply.
14. Security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: TLS encryption for the website and opportunistic TLS for mail transfer; bcrypt hashing of passwords, recovery codes, API keys and mail-app credentials; AES-256-GCM encryption at rest of two-factor secrets and DKIM private keys; daily database backups encrypted with AES-256 and kept for 14 days; optional two-factor authentication; one-time, time-limited links for password resets and email changes, stored only as hashes; signing out other devices when your password or email address changes; protection against cross-site request forgery and cross-site scripting; strict input validation and HTML sanitisation; rate limiting, automated-traffic protection and a honeypot; role-based access control with ownership checks on every request; and an audit log of administrative access. No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours where required (Art. 33), and notify you without undue delay where the risk is high (Art. 34).
We email you when your password is changed or reset. When you ask to change your email address, we send a notice to your current address, and once the change is completed, a further notice to your previous address. These messages are necessary to keep your account secure and cannot be turned off.
15. Children
The Service is intended for adults. You must be at least 18 years old to create an account (see our Terms of Service). We do not knowingly process the data of children as account holders. If you believe a child has created an account, contact legal@anymail.tech and we will delete it.
16. Changes to this policy
We may update this policy when the Service or the law changes. The "Last updated" date at the top shows when it last changed. We will inform account holders of material changes by email or an in-app notice before they take effect. Earlier versions are available on request.
17. Contact and complaints
For any question about this policy or your data, or to exercise your rights, contact Michał Płatosz at legal@anymail.tech or by post at ul. Pogodna 4C/45, 15-354 Białystok, Poland. You can also complain to the Polish supervisory authority (UODO) or another EU supervisory authority, as described in Section 11.
This policy is published in Polish and in English (wersja polska), and both versions have the same content. The Polish version is binding, in particular for consumers whose habitual residence is in Poland; the English version is provided for convenience. In case of any discrepancy between them, the Polish version prevails, but this never limits your rights under the GDPR or other mandatory law.