Privacy

Data controller

The data controller is the company named above, with its company name, registered office and VAT number. For any privacy request write to privacy@mailpod.app.

Data protection officer

We have not appointed a data protection officer (DPO). For any request write to privacy@mailpod.app.

What data the website collects

The server logs the requests it receives (page, result, time), to run and protect the website.

• Nothing is loaded from third parties: fonts, images and scripts are served by this website.

Visit statistics

We count visits to the site with Matomo, installed and run by us on our own infrastructure in the European Union: no data goes to third parties.

Matomo works without cookies: that is why we do not ask for any consent. Your IP address is anonymised: Matomo keeps only its first 2 bytes.

For each visit it records the page visited, where you came from (referrer), the language and the type of browser and device, and the time.

We use this to know which pages are read and to improve the site. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can object (Art. 21 GDPR) by writing to privacy@mailpod.app.

Data on individual visits is deleted automatically after 180 days; only aggregated, anonymous statistics remain (for example, the number of visits per page).

Cookies

The mailpod.app website uses no cookies, neither ours nor third-party ones. That is why we do not ask for any consent.

If you change the theme with the button at the top, the choice (light or dark) stays in your browser's local storage, under the key «tema». It is never sent to the server, and you can delete it by clearing the site's data in your browser.

If you write to us

If you email us, we use your address and what you write only to reply to you and, if you ask, to prepare an offer.

If you sign up

For the free mailbox we need the mailbox name and a contact address, to which we send the verification link. For the paid service we need the name of the space, the seats and the storage chosen, the administrator's address and the billing details.

We use this data to create the service, to invoice it and to write to you about the service itself. The legal basis is the contract (Art. 6(1)(b) GDPR) and, for invoicing, a legal obligation (point (c)). The contact address, or the administrator's address, also becomes the recovery address of your account: that is where the link arrives if you forget your password. We use it for the newsletter and marketing only if you choose so (see below). The form's anti-abuse check is a calculation done by your browser: it uses no third-party service and leaves no cookie.

All the data in the form is required, except the newsletter box: without it, the service cannot be created or invoiced, and the form cannot be sent. With the form we also record the IP address you sent it from and the version of the terms you accepted.

Newsletter and marketing communications

Only if you tick the box in the sign-up form do we use your contact address, or the administrator's address, to send you the mailpod newsletter and communications about news and offers of the service. The box is empty when the form opens and is not required: signing up works without it.

We record your choice, yes or no, with date and time, the version and language of the text you saw, the sign-up it refers to and the IP address the form was sent from: this is the proof of consent. A new choice is added to the previous one, it does not erase it.

You can withdraw your consent at any time, free of charge and with no consequence for the service, by writing to privacy@mailpod.app. Withdrawal does not affect the lawfulness of what was done before (Art. 7(3) GDPR).

We keep the proof of consent for as long as the consent lasts and, after withdrawal, for 10 years, the ordinary limitation period. Every marketing message carries a link to unsubscribe.

How long we keep data

• Sign-up data: for the whole duration of the relationship.
• Invoices and billing data: 10 years (Art. 2220 of the Italian Civil Code).
• Proof of consent to marketing: for as long as the consent lasts, then 10 years (ordinary limitation period).
• Unverified sign-ups and unpaid orders for the paid service: the verification link expires after 3 hours and can no longer be used; the request data, with its evidence, is deleted 30 days after expiry.
• Visit statistics: 180 days, as stated above.

Who receives the data

• Infrastructure: Hetzner Online GmbH, Germany, which hosts our servers.
• Payments: Stripe, only for the paid service, to collect the price and verify the VAT number.
• Electronic invoicing: the provider that transmits the electronic invoices and the Sistema di Interscambio (the Italian Revenue Agency's exchange system).
• The authorities, when the law requires it.

The free mailbox

If you open a free mailbox as an individual, we are the controller of your mailbox's data. We process:

• account data: the mailbox name, the contact address, which is also the recovery address, and the login credentials;
• the content of the mailbox: messages, folders and whatever you save in it;
• access logs, with the IP address you access from;
• message delivery logs: date, sender, recipient and outcome.

Retention. The account and the content of the mailbox remain as long as the mailbox is active; when you close it they are deleted from the system. Backups are daily and the last 7 are kept: deleted data leaves the backups after 7 days, through rotation. Delivery logs are deleted after 90 days. The recipient count for the sending limits is deleted after 2 days. Access logs are kept for the security of the service and for legal obligations, for at most 12 months.

Recipients. The data stays in our infrastructure, hosted by Hetzner Online GmbH in Germany and Finland. We do not give it to anyone else, except to an authority that requests it under the law. The messages you send reach, of course, their recipients.

Transfers. No transfer outside the European Union: the mailbox data stays in the Union.

Business customers

For the paid service, the data processed in an organisation's mailboxes belongs to the organisation, which is its controller; we process it as processor, on its behalf and according to its instructions (Art. 28 GDPR). The organisation's sign-up and billing data, on the other hand, remain governed by this notice.

The data processing agreement and the list of sub-processors are made available before signing, on request to privacy@mailpod.app. The sub-processors include Hetzner Online GmbH, Germany, which hosts the infrastructure.

Your rights

You can ask for access, rectification, erasure, restriction and portability of your data and object to processing (Arts. 15-22 GDPR), by writing to privacy@mailpod.app.

You can also lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), or with the supervisory authority of the country where you live or work.