Privacy Policy

1. Data we collect

We collect the following categories of data:

• Account data — your email address, optional name, preferred language and a hash of your password. We never store your password in plain text.
• SMTP credentials — the host, port, username and password of the servers you connect. Credentials are encrypted at rest and are used solely to send your campaigns.
• Sending configuration — your domains, sender inboxes, DNS verification results (SPF, DKIM, DMARC) and campaign settings.
• Recipient lists — the email addresses you upload to your campaigns.
• Delivery data — per-message delivery status (queued, sent, bounced, failed). We do not track opens or clicks: your emails carry no tracking pixel and we do not rewrite your links.
• Billing data — your internal balance, top-up and subscription history. Crypto payments are processed by NOWPayments; we never see or store card numbers or wallet private keys.
• Technical data — logs, IP addresses and browser information needed to keep the service secure and debuggable.

2. How we use your data

• To provide the service: sending campaigns through your servers, tracking delivery, showing statistics.
• To operate your account: authentication, email verification, password resets and important service notifications.
• To bill you: maintaining your balance and subscription.
• To keep the platform safe: preventing abuse, fraud and violations of our Terms of Service.

We do not sell your data, and we do not use your recipient lists or message content for advertising or for training any models.

3. Your recipients' data

For the recipient lists you upload, you act as the data controller and Mailex acts as a processor: we process recipient addresses and engagement events only to execute your campaigns, on your instructions.

You are responsible for having a lawful basis (such as consent) to email the people on your lists and for complying with applicable anti-spam and data-protection laws (e.g. GDPR, ePrivacy, CAN-SPAM). Deleting a campaign deletes its recipients from our systems.

4. Third-party services

We share data with a small number of service providers, only to the extent needed to run Mailex:

• Resend — delivers our own transactional emails to you (verification links, password resets).
• NOWPayments — processes crypto top-ups of your balance.
• Hosting and infrastructure providers that run our servers and database.

Your campaign emails are delivered through the SMTP servers you connect, not through our infrastructure.

5. Cookies

Mailex uses a minimal set of first-party cookies:

• Session cookie — keeps you signed in (httpOnly, not readable by scripts).
• Locale cookie — remembers your language.
• Theme preference — stored in your browser's local storage.

We do not use advertising or cross-site tracking cookies.

6. Data retention

We keep your data for as long as your account is active. Campaign, recipient and delivery data is removed when you delete the corresponding campaign, domain or server. When you delete your account, we delete or anonymize your personal data within 30 days, except where we are legally required to retain it (e.g. billing records).

7. Security

SMTP credentials are encrypted at rest, passwords are stored as bcrypt hashes, and all traffic between your browser and Mailex is encrypted with TLS. Access to production data is restricted to personnel who need it to operate the service.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can exercise most of this directly in the app (account settings, deleting campaigns and domains) or by contacting us — we respond within 30 days.

9. Changes to this policy

We may update this policy as the product evolves. For material changes we will notify you by email or through the app before the changes take effect.

10. Contact

Questions about privacy? Reach us on Telegram (@mailex_support) or by email at mailex_sh@proton.me.