MailowsPrivacy policy
What we know about you, why we know it, how long we keep it and who gets to see it. Written to match what the system actually does.
1. Who the controller is and where the data sits
The controller of personal data is DW Technology LLC, registered in the state of New Mexico, USA. Contact for all data protection matters: support@namailu.cz.
The processing, however, takes place in the European Union. The servers running the mail, the databases and the webmail stand in a data centre operated by Contabo GmbH in Lauterbourg, France. Your messages therefore do not leave the EU in normal operation; access to them is held by the operator's administration, which is run from the USA. We state this mismatch explicitly, because with an e-mail service it is something you need to know.
2. What data we process
Data you give us
- Registration data: e-mail address, chosen mailbox name, password (stored as an argon2 hash, never in readable form), and possibly the second-factor secret (stored encrypted).
- Billing data if you subscribe to a paid plan — see section 4.
- Mail content: messages, attachments, contacts and calendar that you store in the mailbox or that someone sends to you.
Data that arises from operation
- Operational record of messages — sender, recipients, time, size and delivery result. It serves to enforce quotas, for anti-spam, and so that you can see in the portal what your agent mailbox has sent.
- Audit record — who performed which administrative action in the account (creating a mailbox, changing a password, issuing a key, granting an agent consent).
- Security records — IP address and time of sign-in, failed attempts, trusted devices.
The sign-in and security cookies we set are strictly necessary for sign-in to work. We have no consent banner because we have nothing to ask consent for: we use no analytics or advertising measurement — there is no Google Analytics, Matomo, Plausible, PostHog or anything similar on our pages.
3. Why we process it
| Purpose | Legal basis |
|---|---|
| Providing the mailbox and delivering mail | performance of a contract |
| Invoicing and accounting | legal obligation |
| Scanning incoming and outgoing mail for malicious content, anti-spam, quotas and limits | legitimate interest in safe operation |
| Audit and security records | legitimate interest in protecting accounts |
| Operational e-mails about the service (outage, change of terms) | performance of a contract |
What we do not do: we do not read the content of your mail for any purpose other than technical delivery and malicious-content scanning, we do not sell data, we do not display advertising, we do not profile you, and we do not use the content of your messages to train artificial intelligence models.
4. Who receives the data
Processors without which the service cannot be operated:
| Who | What they hold | Where |
|---|---|---|
| Contabo GmbH | the servers, that is all operational data including mail | France (EU) |
| Stripe | payment data of subscribers; the card never reaches us | EU / USA |
| Cloudflare | authoritative DNS for our domains — name resolution, not mail content | globally |
An encrypted copy of the backups sits off the main server, on storage belonging to the operator and reachable only over a private network. Without the key, which is kept offline, it is unreadable.
We pass data on only where a legal obligation requires it — and only to the extent the law requires. We naturally deliver mail to recipients on the servers chosen by the other party; that is the nature of e-mail.
5. How long we keep the data
| What | How long |
|---|---|
| Mailbox content | until you delete it or the account ends |
| Trash | 30 days, then deleted automatically |
| Audit record of administrative actions | 365 days |
| Record of processed messages and delivery events | 30 days |
| Undeliverable events (dead-letter) | 90 days |
| Invoicing documents | as required by accounting law |
Backups are an exception that is only fair to state out loud. We back up several times a day and keep older copies for up to 12 months. When you have an account or a message deleted, it disappears from the live system immediately, but it leaves the backups only as the old backups gradually expire. Backups are encrypted and we reach into them only when recovering from a failure.
6. Your rights
- Access and portability. You can download the entire mailbox content yourself at any time over IMAP or JMAP with an ordinary mail client — you do not have to ask for anything.
- Rectification of account data directly in the portal.
- Erasure. Deleting the account removes the mailboxes and their content; for the limitation regarding backups see section 5.
- Restriction of processing and objection to processing based on legitimate interest.
- Complaint to a supervisory authority — for the Czech Republic the Office for Personal Data Protection.
Write to support@namailu.cz; we reply within one month. So that we do not hand data to the wrong person, the request must come from the account address or be verifiable in another way.
7. Security
- All communication with the service is encrypted (HTTPS, IMAPS, SMTPS, POP3S); we do not offer the unencrypted variants of these protocols.
- We keep passwords as argon2 hashes and second-factor secrets encrypted.
- Incoming and outgoing mail is scanned for malicious content.
- Agent access (API and MCP) is bound to a specific mailbox and scope of permissions, which you can revoke in the portal at any time.
- Backups are encrypted and a copy of them sits off the main server.
Should a security breach occur with a risk to your rights, we will let you know without undue delay and meet our notification obligations.
8. Access by agents and artificial intelligence tools
When you allow your agent (for example over MCP) to access a mailbox, that is your decision and your authorisation: consent is granted for specific mailboxes and a specific scope, confirmed with a second factor, and revocable in the portal at any time. Content the agent reads reaches the operator of that agent — that is, whoever you chose. We do not hand data to agents ourselves and we provide nothing for model training.
9. Children
The service is not intended for children under 16.
10. Changes
The current wording is always on this page. We will announce any substantial change in advance to the account's contact e-mail.