Privacy Policy
Last updated: 8 November 2026
This policy explains what personal data Polpo Mail processes when you use Polpo Mail, why, for how long, and the rights you have. The short version: we use your data to run your email and keep it secure, nothing more. No advertising, no profiling, no selling.
1. Who is responsible
Polpo Mail is the controller for account, billing, support and service-security data described below.
For the contents of mailboxes (the messages you send, receive and store), the organisation that owns the workspace is the controller and we act as its processor. We process that content only to provide the Service on the organisation's instructions. If you have a mailbox through your employer, your administrator is your first point of contact for questions about it.
2. Data we process
| Category | Examples |
|---|---|
| Account data | Name, email address, role, company domain, password hash, storage quota, two-step verification settings (authenticator secret, passkey public keys, backup email address, hashed recovery codes). |
| Mailbox content | Messages and attachments you send, receive and store, folder names, flags, aliases and catch-all settings. |
| Mail transport metadata | Sender and recipient addresses, IP addresses and host names of sending servers, message IDs, authentication results (SPF, DKIM, DMARC), spam scores and delivery status. |
| Security and usage logs | IP addresses, browser user agents, sign-in times and outcomes, trusted browsers, and the pages and protocol commands requested, kept to detect abuse and fix problems. |
| Domain data | Your domain name, DNS verification token, DKIM keys and the DNS records we look up to check your configuration. |
| Communications | What you tell us when you contact support, abuse or privacy. |
| Website analytics | On public pages, when you're not signed in: the page viewed, the referring page, campaign tags, time on page and a random browser identifier (see the Cookie Policy). Never collected inside webmail or the admin console. |
We don't use advertising or third-party tracking, we never track what you do inside your mailbox, and we don't buy data about you from others.
3. Why we process it, and our legal bases
- To provide the Service: create your workspace, verify your domain, store, deliver and display your mail, and run IMAP and SMTP. Basis: performance of our contract with you or your organisation.
- To keep the Service and your account secure: authenticate sign-ins, recognise trusted browsers, detect spam, phishing and malware, rate-limit abuse, and investigate incidents. Basis: our legitimate interest in a secure, reliable service, and that of our users.
- To communicate with you: security notices (for example, a sign-in from a new browser), verification codes, service announcements and support replies. Basis: contract and legitimate interests.
- To comply with the law: respond to lawful requests and keep records we're required to keep. Basis: legal obligation.
- To understand how our public website is used: count visits to pages such as pricing and sign-up, so we can improve them. Basis: our legitimate interest in running and improving our website; the measurement is cookieless, limited to public pages and never covers your mailbox.
Automated filtering (spam scoring and SPF/DKIM/DMARC checks) is used only to protect you; it can move mail to Junk or refuse it, and you can always check your Junk folder. We make no other automated decisions about you.
4. How long we keep it
- Mailbox content: until you or your administrator delete it, or the account or workspace is closed. Deleted workspaces are removed from backups within 30 days.
- Unverified registrations: deleted automatically after 72 hours.
- Sessions: up to 14 days; trusted browsers: 30 days after the last two-step verification.
- Outgoing mail queue: until the message is delivered or bounced, at most 5 days.
- Website analytics: kept only as long as needed to produce usage statistics about our public website.
- Security and server logs: normally no longer than 90 days, unless needed to investigate a specific incident.
- Support correspondence: up to 2 years after the conversation ends.
5. Who we share it with
We never sell personal data or share it for advertising. We share it only:
- with the recipients and their mail providers when you send a message, which is how email works;
- with infrastructure providers (hosting, storage, backups, and an outbound mail relay if one is configured) who process it on our behalf under contracts that require confidentiality and security;
- with your workspace administrators, who can manage your account;
- with authorities when the law requires it. We review each request and disclose only what we're legally obliged to; where permitted, we tell the affected customer first.
DNS and blocklist lookups we make to check incoming mail reveal the sending server's IP address or domain to those DNS services.
6. International transfers
If personal data is transferred outside the country or region where it was collected, we use appropriate safeguards such as adequacy decisions or standard contractual clauses. Contact us for details.
7. Security
We use encryption in transit (TLS), bcrypt password hashing, two-step verification, access controls, rate limiting and regular backups. See our Security page for details. If a breach affects your personal data, we'll notify you and the relevant authority as the law requires.
8. Your rights
Depending on where you live (for example under the GDPR or UK GDPR), you may have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent where we rely on it. You can do much of this yourself: edit your name and security settings in Settings, and export your mail over IMAP. For anything else, write to privacy@polpomail.com. We reply within one month. If your mailbox is provided by an organisation, we may pass your request to it as the controller.
You also have the right to complain to your local data-protection authority.
9. Cookies
We only use cookies that are strictly necessary to sign you in, remember a trusted browser and protect forms. See the Cookie Policy.
10. Children
The Service is meant for businesses and isn't directed at children under 16. We don't knowingly collect their data.
11. Changes to this policy
We'll post any changes on this page and update the date above. If a change is significant, we'll notify administrators before it takes effect.
12. Contact
Privacy questions and requests: privacy@polpomail.com. Post: Polpo Mail.