Privacy Policy

1.1 Account Information

When you create an account, we collect your name, email address, and password (stored as a cryptographic hash). If you subscribe, we collect billing information through our payment processor (Stripe).

1.2 Email Data

The Service processes and stores emails that you send and receive through your configured domains, including headers, body content, and attachments.

1.3 Domain Configuration Data

We store the domain names you add, DNS configuration records, and domain health check results.

1.4 Usage Data

We collect information about how you use the Service — login timestamps, feature usage, email-volume statistics, and storage consumption.

1.5 Technical Data

We automatically collect IP addresses, browser type and version, operating system, and device information when you access the Service.

We use the data we collect to:

• Provide, operate, and maintain the Service
• Process and deliver emails on your behalf
• Manage your account and subscriptions
• Provide customer support
• Send service-related notifications (billing, security alerts)
• Monitor and improve the security and performance of the Service
• Detect and prevent spam, abuse, and fraud
• Comply with legal obligations

We do not read, scan, or analyse the content of your emails for advertising purposes. Email content is processed only as necessary to provide the Service (spam filtering, virus scanning, delivery).

Under the GDPR, we process your data based on the following legal bases:

• Contract performance — processing necessary to provide the Service you have subscribed to.
• Legitimate interests — processing necessary for security, fraud prevention, and service improvement.
• Legal obligation — processing required to comply with applicable laws and regulations.
• Consent — where we rely on your consent (e.g. marketing communications or optional analytics), you may withdraw it at any time.

We share data with third-party service providers only as necessary to operate the Service. The full list — with locations — lives in the DPA. In summary:

• Stripe — payment processing, under Stripe's privacy policy.
• Railway + DigitalOcean — infrastructure hosting for the web app and mail server.
• Cloudflare — DNS, CDN, and Turnstile bot protection.
• JustAnalytics — first-party product analytics (our sibling product).

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

We retain your data for as long as your account is active and as necessary to provide the Service. Specifically:

• Account data — retained for the duration of your subscription and for 30 days after account termination to allow data export.
• Email data — retained for the duration of your subscription. Deleted emails are permanently removed from our servers within 30 days.
• Billing data — retained for up to 7 years as required by tax and accounting regulations.
• Server logs — retained for up to 90 days for security and debugging purposes.

Under the GDPR and other applicable data-protection laws, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate personal data.
• Right to erasure — request deletion of your personal data ("right to be forgotten").
• Right to restriction — request restriction of processing of your personal data.
• Right to data portability — request a copy of your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact privacy@justemails.app. We respond within 30 days. Both data export and deletion are also available self-serve under Settings → Data.

We use only essential cookies necessary for the Service to function, plus one optional first-party analytics cookie which you can decline via our cookie banner:

• Session cookies — used to maintain your authenticated session. These expire when you log out or after the session timeout.
• CSRF tokens — used to protect against cross-site request forgery attacks.
• JustAnalytics anonymous ID — a rotating first-party ID (no cross-site tracking, no ad targeting). Opt out via the cookie banner.

We do not use advertising cookies or third-party tracking cookies of any kind.

We implement appropriate technical and organisational measures to protect your data, including:

• TLS 1.2+ encryption for all data in transit (HTTPS, IMAPS, SMTPS)
• Encryption at rest for stored secrets and backups
• Regular security audits and penetration testing
• Access controls and principle of least privilege
• Two-factor authentication (TOTP + WebAuthn passkeys) for user accounts
• Automated threat detection and incident response

Your data may be transferred to and processed in countries other than your own. Where we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place — such as the EU Standard Contractual Clauses (SCCs, Module Two) approved by the European Commission, plus the UK IDTA Addendum for UK-origin transfers.

The Service is not intended for children under 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the Service at least 30 days before the changes take effect. Prior versions are archived and available on request.

For privacy-related questions or to exercise your data rights, contact us at:

Velocity Digital Labs
Email: privacy@justemails.app
Website: velocitydigitallabs.com

If you are in the EU and believe we have not adequately addressed your data-protection concerns, you have the right to lodge a complaint with your local Data Protection Authority.