ViMail provides email hosting for people who bring their own domain. We built it to handle as little personal data as possible, and to be straightforward about what we do handle. This policy explains what we collect, why, who sees it, and what control you have.
1. Who we are
The data controller responsible for your personal data is [Operator legal name], [registered address] (“ViMail”, “we”, “us”). You can reach us about anything in this policy at [email protected].
2. Scope of this policy
This policy applies to:
- this website and the beta waitlist (people who ask to be considered for the private beta); and
- the ViMail service — email hosting, webmail and related features — for people who are invited to use it (“Users”).
If you are a User, the contents of your mailbox may also include personal data about other people (for example, the people who write to you). You decide what to do with that data; we process it on your behalf as described in section 5.
3. Data we collect
3.1 If you join the beta waitlist
- Email address (required).
- Domain name and intended use, if you choose to tell us.
- Sign-up details: the date and time, the form you used, your browser language, and a record of your consent.
- Technical data such as your IP address and browser type, processed briefly for security and to prevent abuse of the form.
3.2 When you visit this website
- Server logs: IP address, date and time, requested page, response status and user-agent. These are used for security, troubleshooting and capacity planning.
- One preference in your browser: your chosen color theme (light, dark or automatic) is stored locally on your device. It is never sent to us.
We do not use advertising or analytics trackers on this website.
3.3 If you use the ViMail service
- Account data: your username and addresses, the domain(s) you connect, a securely hashed password, two-factor and app-password settings, preferences and sending limits.
- Mail and other content you store: messages and attachments, folders, labels, filters, and, where enabled, calendar entries, contacts and files.
- Message metadata: sender, recipients, timestamps, size, and delivery and authentication results (such as SPF, DKIM and DMARC outcomes).
- Technical and security logs: connection and sign-in events, IP addresses, client software, error reports, and abuse and spam-filtering signals.
- Verified recipients: if you ask us to verify a recipient so that messages to them are not counted toward your sending limit, we process that person’s email address, send them a single one-time code, and keep the address and its verification status in your account.
- Support correspondence: messages you send us and our replies.
We currently do not collect payment card details. If paid plans are introduced, we will update this policy and explain who processes payments.
4. How and why we use data
Where the EU or UK GDPR applies, we need a legal basis for each use of personal data. The table below sets them out.
| Purpose | Data | Legal basis |
|---|---|---|
| Managing the beta waitlist, choosing testers and contacting you about the beta | Email, optional domain and intended use, sign-up details | Your consent (you give it by submitting the form; you can withdraw it at any time) |
| Providing the service: creating accounts, delivering, storing, searching and syncing mail | Account data, mail content, metadata | Performance of a contract (our Terms of Service) |
| Spam, phishing and malware filtering; securing the service; preventing abuse, fraud and misuse | Message content and metadata (processed automatically), technical logs | Our legitimate interests in running a safe, reliable service, and yours in receiving one |
| Verifying recipients at your request (sending a one-time code) and applying sending limits | Recipient email address, verification status, sending counters | Performance of a contract with you; legitimate interests in preventing abuse |
| Support and communicating about your account (security notices, service changes) | Account data, support correspondence | Performance of a contract; legitimate interests |
| Improving and maintaining the service using aggregated or non-content data (for example, performance and error rates) | Technical logs, usage statistics | Legitimate interests |
| Complying with law, responding to valid legal requests, and establishing or defending legal claims | As needed | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we balance them against your rights and expectations. You can object at any time (see section 11). We do not use personal data for automated decisions that have legal or similarly significant effects on you. Automated spam filtering only decides where a message is delivered, and you can always review your spam folder.
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
5. Your mail and files
Your mailbox is yours. We process its contents only to operate the service for you: to deliver and store messages, to make them searchable, to protect you from spam and malware, and to keep the service secure.
- We do not read your mail for advertising, build advertising profiles from it, or sell or license it to anyone.
- We do not use the contents of your mail or files to train generative AI models.
- Our staff do not browse mailbox contents. Access happens only when it is necessary to operate or secure the service, when you ask us to investigate a problem, to investigate suspected abuse of the service, or when we are legally required to.
Email is not end-to-end encrypted by default: messages are encrypted in transit where the other server supports it, and the server can technically access stored mail. If you need stronger protection, you can use S/MIME or OpenPGP in your mail client.
If you receive a one-time verification code from us and do not know why, you can ignore it; no further messages are sent to you by that process. To have your address removed from someone’s verified list, write to [email protected].
Where we process the personal data of the people who correspond with you, we act as your service provider (processor) and handle that data on your documented instructions. If you use ViMail for business and need a data processing agreement, contact [email protected].
6. Cookies and tracking
This website does not set cookies and does not use advertising, analytics or cross-site tracking technologies. The only item stored in your browser is your theme preference, kept in local storage; it is strictly functional and stays on your device. Because we do not track you, there is nothing to opt out of — we treat browser signals such as “Do Not Track” and Global Privacy Control as honored by default.
The webmail may use similar technologies (such as session tokens and local storage) that are strictly necessary to keep you signed in and remember your settings.
7. Who we share data with
We share personal data only as follows:
- Service providers (processors) that help us run the service, such as infrastructure and hosting, backup storage, and email or messaging providers used to send invitations and service notices. They may only process data on our instructions, under written agreements that require appropriate security and confidentiality.
- Other mail servers and recipients. When you send a message, it and its headers (including your address and IP-related routing information) are delivered to the recipients’ providers. That is inherent in how email works.
- Authorities and other parties where we are required by law or valid legal process, or where needed to protect the rights, safety and security of users, the public or ViMail. Where permitted and practical, we will notify you first and challenge requests that appear overbroad.
- Successors. If ViMail is involved in a merger, acquisition or sale of assets, your data may be transferred as part of it; we would tell you beforehand and this policy would continue to apply.
- Anyone else, with your consent or at your direction.
8. International transfers
We and our service providers may process personal data in countries other than the one where you live, including countries whose data protection laws differ from yours. Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on an adequacy decision, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement where relevant), together with supplementary measures where necessary. You can request a copy of the relevant safeguards by contacting us.
9. How long we keep data
| Data | Retention |
|---|---|
| Beta waitlist details | Until you withdraw consent or ask us to delete them, or 12 months after the beta ends, whichever is earlier |
| Website server logs | Up to 30 days |
| Account data, mail and files | For as long as your account is active. After you delete the account, content is removed from live systems promptly and from backups within 90 days |
| Service connection and security logs | Generally up to 90 days; longer only when needed to investigate an ongoing security or abuse issue |
| Support correspondence | Up to 2 years after the matter is closed |
| Records we must keep by law | For the period the law requires |
10. Security
We use measures appropriate to the risk, including encryption of connections (TLS), hashed credentials, optional two-factor authentication, access controls and monitoring, rate limiting and automated blocking of abusive traffic, and regular backups. No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as required by law.
11. Your rights
Depending on where you live, you may have some or all of the following rights over your personal data:
- Access — to know whether we process your data and to get a copy;
- Rectification — to correct inaccurate or incomplete data;
- Erasure — to ask us to delete your data;
- Restriction — to ask us to pause certain processing;
- Portability — to receive your data in a structured, commonly used format (for mailboxes, standard IMAP and JMAP export is always available);
- Objection — to object to processing based on legitimate interests;
- Withdrawal of consent — at any time, without affecting earlier processing. For the beta list, use the unsubscribe link in any email from us, or write to us.
European Economic Area, United Kingdom and Switzerland
You have the rights above under the GDPR, the UK GDPR and the Swiss FADP, and the right to lodge a complaint with your local data protection authority (for example, your national supervisory authority in the EU, the Information Commissioner’s Office in the UK, or the Federal Data Protection and Information Commissioner in Switzerland). We would appreciate the chance to resolve your concern first.
California and other US states
Residents of California and several other US states have the right to know, access, correct and delete their personal information, to opt out of its sale or sharing, and to limit the use of sensitive personal information, as well as the right not to be discriminated against for exercising these rights. In the last 12 months we have not sold or shared (as those terms are defined by US state privacy laws) any personal information, and we do not knowingly do so. The categories of personal information we collect are described in section 3: identifiers (such as email address and IP address), internet and network activity, and, for Users, the contents of communications that we process on your behalf. You may use an authorized agent to make a request; we may ask for proof of authorization.
Brazil, Canada, Australia and elsewhere
If you live in a place with a data protection law such as Brazil’s LGPD, Canada’s PIPEDA, or Australia’s Privacy Act, you have the rights that law gives you, and we will honor them. In Brazil you may also contact our contact point listed in section 14 and the national authority (ANPD); in Canada and Australia, the relevant privacy commissioner.
How to exercise your rights
Email [email protected]. We may need to verify your identity first (we will not ask for more information than necessary). We respond within one month, or sooner where the law requires, and may extend that period by up to two further months for complex requests, telling you why. Requests are free unless they are clearly unfounded or excessive.
12. Children
ViMail is not intended for children under 16 (or the higher minimum age of digital consent in your country). We do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the service evolves or the law changes. We will change the “Last updated” date above and, for material changes, notify you by email or in the service before they take effect. Earlier versions are available on request.
14. Contact us
[Operator legal name]
[Registered address]
Privacy contact: [email protected]
Data protection officer / EU and UK representative (where required): [name and contact details, or delete this line]