Privacy Policy

This policy explains what data Mailyoto (Pty) Ltd ("Mailyoto", "we", "us") collects when you use the Mailyoto email forwarding service, why we collect it, and the choices you have. We collect what the service needs to work, we keep it only as long as needed, and we don't sell it.

1. Data we collect

Account data

• Your email address and password (stored hashed).
• Your signed-in devices: the User-Agent each browser sends, the country its IP address is in, and when it signed in and was last active. We keep the country, not the IP address.
• Your plan and billing history.

You need an email address to create an account. We cannot run an account without one.

Service data

• The domains you connect and the aliases you create.
• Email logs, for messages we process: sender, recipient, subject, timestamps, size, message ID, the IP address and hostname of the server that sent the message to us, the responses of the servers we deliver to, and delivery status. How long log entries are kept depends on your plan and your domain's log settings (14 days on Free, up to 60 days on Pro and up to 365 days on Max). You can reduce the logging level per domain.
• Message content is held while a message is being forwarded, and while we retry a delivery. We do not keep message bodies after delivery. Section 4 says how long we keep a message that could not be delivered.

Payment data

Polar, our reseller and merchant of record, processes payments. We never see or store your card number. We keep a record of each payment: the plan, the amount and the date.

Website

Our website does not use third-party analytics or advertising trackers. Our servers keep standard technical logs (IP address, requested page, time) for security and abuse prevention.

2. Why we process it, and on what legal basis

• To forward and deliver your email, which is the core of the service. Legal basis: our contract with you.
• To show you logs and usage in your dashboard. Legal basis: our contract with you.
• To bill paid plans and keep billing records. Legal basis: our contract with you, and the accounting law we must follow.
• To filter spam, prevent abuse, and keep the service secure, which includes our server logs. Legal basis: our legitimate interest, and our customers', in a safe service that other mail servers trust.
• To send you service emails: security notices, payment problems, and delivery problem alerts. These are not marketing emails. Legal basis: our contract with you.

People who send email to our customers, or receive email from them, do not have a Mailyoto account. We process their addresses and messages only to deliver the email and to filter spam, as described above. Legal basis: our legitimate interest, and our customer's, in delivering their email.

3. Who we share data with

We share data only with the providers needed to run the service: our hosting providers, our monitoring provider for server logs, and our transactional email provider for service notices. They process data only on our instructions, under a data processing agreement with us. We do not sell personal data, and we do not share it with advertisers.

Polar, our reseller, is the seller of every paid plan. It handles your checkout and payment details as a separate controller, under its own privacy policy.

The dashboard shows each domain's icon. Our servers fetch it from DuckDuckGo's icon service, which receives the domain name only: never your IP address or account details.

We are based in South Africa, and some of our providers process data outside the European Economic Area (EEA), for example in the United States. When data about people in the EEA goes to one of them, a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or the Commission's Standard Contractual Clauses protect the transfer. Email us if you want details.

We disclose data to authorities only when legally required to, and we tell you when the law allows us to.

4. Data retention

• Email logs: per your plan's retention period, then deleted.
• Messages we could not deliver: no longer than their log entry, and on a paid plan you can resend them until then. When your log settings keep neither subjects and addresses nor the full content of failed email, we keep no copy. Clearing a domain's logs deletes these messages too.
• Account data: kept while your account exists. If you delete your account, domains, aliases, logs, and the messages kept with them are removed within 30 days.
• Billing records: kept as long as tax and accounting law requires.

5. Security

Connections to our website, dashboard, and mail servers use TLS. Passwords are stored hashed, SMTP credentials are shown once and stored hashed, and access to production systems is restricted and logged.

6. Your rights

Under the EU General Data Protection Regulation (GDPR), you have the right to:

• see the personal data we hold about you, and get a copy of it;
• correct data that is wrong;
• have your data deleted;
• limit how we use your data while we check a question you raised about it;
• get your data in a format you can move to another service;
• object to processing that we base on our legitimate interests.

South Africa's Protection of Personal Information Act (POPIA) gives you most of these rights too, and we honour all of them wherever you live. You can use most of them yourself: your dashboard shows your domains, aliases, and logs, and you can delete your account from it. For anything else, email us. We reply within one month.

Our spam and abuse checks run automatically. If one of them limits or suspends your account, you can ask a person on our team to review the decision.

If you think we handle your data wrongly, please tell us first so we can fix it. You also have the right to complain to South Africa's Information Regulator at inforegulator.org.za, or to the data protection authority in the country where you live.

7. Children

The service is not directed at children under 16, and we do not knowingly collect their data.

8. Changes to this policy

If we change this policy in a meaningful way, we will notify you by email at least 14 days before the change takes effect.

9. Contact

Mailyoto (Pty) Ltd is the responsible party for your personal data under POPIA, and its controller under the GDPR.

Privacy questions and requests: support@mailyoto.com.