Security and privacy
Mailyoto sits between the sender and the inbox you already use. Below are the steps one message goes through, and what we keep after it arrives.
What happens to a message
-
Received
- Our mail server accepts it over TLS whenever the sending server supports it.
- We hold it only while we process it.
-
Checked
- Automated checks score it for spam and test its SPF, DKIM and DMARC.
- A person sees a message only to investigate abuse, when you ask us about a delivery, or when the law requires it.
-
Delivered
- We pass it to your destination's mail server, over TLS whenever that server supports it.
- If the server can't accept it yet, we try again later.
- Once the server accepts it, we delete our copy.
-
Logged
- Its log entry records the sender, recipients, subject, times, size, message ID, and each server's response.
- Your log settings decide how much of that each entry keeps.
- We delete logs after 14 days on Free, or after the period you choose on a paid plan: up to 60 days on Pro and 365 on Max.
Protecting your account
- Hashed passwords
- We store your password and every SMTP password as a bcrypt hash. An SMTP password appears once, when you create it.
- A second sign-in step
- Use a passkey, or turn on codes from an authenticator app.
- Deleting your account
- You can delete it yourself from the dashboard. We remove your domains, aliases and logs within 30 days.
Your data and who handles it
You can ask for a copy of your data, a correction, or its deletion. The Privacy Policy lists your rights under South Africa's POPIA and the EU's GDPR.
Your rightsHosting, monitoring and our service emails run on providers that process data for us. Polar, which sells our plans, handles your payment details itself. We never see your card number.
Who we share data withWe disclose data to authorities only when the law requires it, and we tell you when the law allows.
Questions about your data?
The Privacy Policy has the full details. For anything it doesn't cover, write to us.