Privacy Policy

Last updated: October 4, 2026

This Privacy Policy explains how Smailor, operated by Victor ANDRE EI ("we", "us", or "our"), collects, uses, discloses, and protects personal data in connection with our website, applications, and the Smailor service (the "Service").

We may be reached at the contact details in our Legal notice and, for privacy matters, at [email protected].

By using the Service, you acknowledge that you have read this notice. If you are in the EEA, UK, or Switzerland, and where the GDPR or equivalent law applies, additional rights and obligations apply as described in Section 5.

1. Scope: who this applies to

This policy covers:

• Account owners, team members, and end users who use Smailor in an organization,
• Visitors of our public website (e.g. marketing, login, and registration pages),
• Marketplace buyers and sellers who purchase, list, or manage subscriptions to email addresses,
• Telecom/SMS account holders and people whose phone numbers or messages they process through the Service,
• Affiliates who take part in our referral program,
• Business prospects we contact about Smailor, who do not have an account — see Section 10, and
• Visitors of a customer's website who use an embedded Smailor widget, for the limited data we receive as that customer's processor,

unless a separate controller–processor agreement (e.g. a Data processing agreement, DPA) governs the processing of personal data for which you are the controller and we act on your instructions (e.g. your helpdesk customers' data inside tickets).

Two different roles. For your account, billing, identity and business certification, security, and our own marketing, we act as a controller. For the content you process through the Service — including mail, contacts, SMS recipient numbers and content, attachments, and tracking data of your customers — we act as your processor, on your instructions, under the DPA. Where this policy and the DPA both apply to the same processing, the DPA controls.

Children. The Service is not directed to individuals under 16 (or a higher age where the law of your country of residence requires it). We do not knowingly process children's data for these purposes. If you believe we have, please contact us.

2. What we collect

We may process the following categories, depending on how you use the Service.

2.1 Account and identity

• Email address, name, and authentication data (e.g. password hash, OAuth identifiers with Google or Discord, session tokens)
• At signup, where we collect them for account creation and eligibility, age and gender (as provided by you); registration IP address stored with the account to enforce reasonable signup limits from a single network and for security reviews
• A normalized variant of your address on certain major mail domains (local-part rules such as removing dots before @ or ignoring plus-tags) used to correlate related aliases for abuse prevention and may block duplicate registrations using known alias patterns (e.g. plus-tags or dots on Gmail-like domains)
• Role, group, team membership, and permission data you configure. Where you invite a team member, we process that person's account identity and the access scope you grant them, and their activity within your workspace is visible to you.
• Presence and activity signals inside the product (for example that a colleague is viewing a conversation), used to coordinate work and avoid duplicate replies
• Account certification, when requested for Telecom or another sensitive service: the legal name, optional business name, identity or business document supplied, requested and approved level, review decision and note, reviewer, and review timestamps. Document files are encrypted in application storage and accessible to authorised reviewers; certification is an account control, not consent for marketing.

2.2 Service content

• Emails, tickets, attachments, contacts, template text, auto-reply and AI-assisted content when you use such features, calendar entries where you connect or create them, widget submissions, and API payloads and webhook events, to the extent they contain personal data of your users, your customers, or third parties.
• Derived content signals: excerpts and summaries, topic clusters, contact classifications, priority or attention scores, suggested deadlines, and spam or risk scores. These are inferences, not verified facts.
• SMS service data, where enabled: recipient and sender numbers or names, message text, classification as marketing or transactional, segment count, sending schedule, delivery status and receipts, reply text, suppression records, campaign membership, provider references, route, and usage history. A provider or carrier necessarily receives the information needed to route and deliver an SMS. Do not include sensitive or unnecessary personal data in messages.

2.3 Billing, payments, and payouts

• Billing contact, invoicing and address as needed, plan and usage data
• Separate Telecom plan and payment records, where applicable: plan, included and used segments, subscription status, optional international credit, and payment references. An email plan recommendation does not link the two subscriptions for billing.
• We use payment providers; we do not store full payment card numbers on our servers. Card data is handled by the payment processor under their terms.
• For marketplace activity, we process the account identity and contact details of buyers and sellers, listing and address details, subscription and transaction records, payout status, risk and verification status, and payment-provider references. We do not store bank-account or card credentials supplied to a payment provider.
• For affiliates, we process the referral code and referral events, amounts earned, the payout method you choose, and — where you choose a bank payout — the bank details you enter for that purpose, together with any tax information we are required to collect.

2.4 Technical and usage data

• IP address at registration (see Section 2.1) and, where applicable, on login or other interactions; approximate location (derived where we use IP for fraud, security, or tax), user agent, device and browser type, log and error data, timestamps
• Diagnostics to operate and secure the Service, including abuse detection
• Signed-in sessions. For each browser or device signed in to your account we keep the IP address and user agent last seen, when the session started, and when it was last active (refreshed at most every five minutes). We use this to show you where your account is signed in, under Settings > Security, and to let you sign out a single session. A session's record is deleted when you sign out of it; a session you end from the list is kept, marked as ended, so it cannot be used again.
• Acquisition source, where you arrive through a src, utm_source, or ref parameter (see the Cookie policy)

2.5 Mail client access (POP3 and SMTP)

Where you connect a standard mail application, we process the mail access credential you were issued (stored as a hash — the secret itself is shown once and is not recoverable by us), together with connection metadata: the IP address the client connects from, timestamps, protocol and port, transport mode, authentication outcome, and per-credential counters. We use it to authenticate you, apply limits, and detect credential compromise and abuse. Failed authentication attempts are logged for security.

2.6 Email tracking, links, and filtering

• Open tracking on outbound mail. This is off by default and only happens if you switch it on. Where you do, we record that a tracking element was requested and, when a recipient's client loads it, the event and its metadata (time, and network and client information available from that request). This is processing you decide on, about your recipients, and you are the controller for it (see the Terms and Section 1).
• Remote content in inbound mail. Your browser never contacts the sender's servers for images in mail you receive. Remote images are fetched by our servers on your behalf, so the sender sees Smailor's IP address and a generic client, not your IP address, location, or browser. By default images load automatically this way, which can still tell the sender that and when a message was opened. If you choose to have images held until you ask for them, nothing is fetched until you load them on a given message, and the sender learns nothing. We do not keep the images we fetch, and we do not control what senders do with the requests they receive.
• Link and sender safety. To detect phishing and malware, we extract URLs from messages and check links, sending domains, and sending IP addresses against third-party reputation services. For some of these checks, the full URL found in the message is sent to the reputation service. Sender IPs and domains may be queried against blocklists over DNS. Results are cached for a limited period. These services are listed in the Sub-processor list, and some are outside the EEA (see Section 4).
• Spam filtering signals: authentication results (SPF, DKIM, DMARC), header and body features, sender history, and scores from the above.

2.7 Connected third-party accounts

Where you connect an account you hold elsewhere, we process what the connection requires:

• Google / Gmail. The OAuth identifiers and tokens, and the message data the scopes you approved allow us to read or import. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the feature you enabled, do not transfer it to others except as needed to provide the feature, at your direction, or for security or legal reasons, do not use it for advertising, and do not allow humans to read it except with your explicit permission, for security, to comply with law, or where the data is aggregated and anonymised. You can disconnect at any time here and revoke access in your Google account.
• Discord. Account identifiers used for sign-in and, where you use the Discord integration, the identifiers and message content needed for the commands you invoke. If an account holder links a Discord channel, emails sent to them are copied there at their request, in the content mode they choose; that copy is under their responsibility and Discord's terms.
• Calendars (CalDAV or OAuth). The credential — an OAuth token or an application-specific password where the provider only supports that — plus the calendar and event data needed to display, create, or share entries. A reusable password of that kind must be held in a form our servers can replay in order to work; it is protected by access controls and deleted when you disconnect. Use a scoped, revocable credential, never your provider's main password.

2.8 AI-assisted features

Where AI-assisted drafting, triage, classification, translation, topic clustering, contact intelligence, attention scoring, or abuse detection is enabled, the relevant content is processed by the inference service configured for Smailor, which is identified in the current Sub-processor list together with any transfer safeguards. We do not use your content, messages, or contacts to train models for third parties. Outputs are suggestions; you are responsible for verifying them before you rely on them.

2.9 Mobile applications

Where you use a Smailor mobile app, we process the account and usage data described above, plus device and app diagnostics, the app and OS version, and — where you enable notifications — a push token used to deliver them. The app store you install from processes your download and any purchase under its own policy.

2.10 Cookies and similar tools

• Essential cookies and local storage to log you in and keep sessions secure
• If we use analytics or marketing tools that are non-essential, we will seek consent where required (e.g. European ePrivacy and similar rules) and as described in our Cookie policy

Signup bot protection. When Cloudflare Turnstile is configured on our deployment, completing password-based signup includes a short verification mediated by Cloudflare (cookies may apply — see Cookie policy). We send the resulting single-use token server-side for validation and do not treat that flow as substitute legal consent for non-essential marketing. (OAuth signup paths use the identity provider instead.) Legal bases (GDPR Art. 6(1)(b) and (f)) mirror other security measures; you may object where applicable (Art. 21) after discussing proportionality.

Historical note. Older builds may still display deprecated columns (fingerprint_hash) for staff review tools; we no longer accept forgeable browser fingerprints from signup forms.

3. How we use personal data

We process data on the following legal bases (GDPR Art. 6 where applicable): contract (providing the Service to you), legitimate interests (e.g. security, product improvement, B2B prospecting, and fraud prevention, balanced against your rights), legal obligation (e.g. accounting, tax, or regulatory requests), and, where we ask for it, consent (e.g. some cookies or newsletters).

Automated processing and inferences. The Service produces automated signals: spam and risk scores, link and sender classifications, contact classifications, topic groupings, and priority or attention scores. These assist human judgement; they are not determinations about you and are not used to make decisions with legal or similarly significant effect without human involvement where the law requires it. The exceptions are limited security and fraud checks — for example blocking a login attempt, rejecting a message, or refusing a signup that matches abuse patterns — which you may contest by contacting us, and which we will review manually on request.

4. Sharing, processors, and international transfers

We do not sell your personal data. We may share with:

• Service providers (processors): e.g. hosting, email sending, payment, reputation and anti-abuse, inference, logging, and infrastructure, who process data on our instructions and under agreements. The current list, with purposes, locations, and transfer mechanisms, is published as our Sub-processor list and in the DPA.
• Third-party sending providers you configure. Where you supply credentials for a provider such as Resend, Brevo, Mailjet, or your own SMTP server, mail you send through it is transmitted to that provider, whose own terms and privacy notice then apply to that traffic.
• SMS provider and carriers, when Telecom is enabled. The provider selected by Smailor receives destination numbers, sender information, message content, and delivery metadata to transmit SMS and receive receipts or replies. Carriers and destination networks process this information to deliver messages. Our proposed primary provider for launch is Opportunity (AllMySMS); it is listed as pending in the Sub-processor List until activated. International destinations may involve processing outside the EEA and remain disabled unless separately enabled.
• Reputation and anti-abuse services. To detect phishing and malware we may transmit URLs extracted from message content, and sender domains and IP addresses, to third-party reputation services. Some of these are established outside the EEA, including in the United States. This is a security measure; the services are named in the Sub-processor list with the transfer mechanism that applies.
• Marketplace counterparties: we disclose only the information reasonably needed to perform and support a marketplace subscription. Sellers do not receive the contents of a buyer's mailbox. Buyers do not receive a seller's personal contact details unless disclosure is required by law or necessary to resolve a dispute.
• Providers of accounts you connect, for the connection you authorised (see Section 2.7).
• Professional advisers, courts, and regulators, as required
• Corporate reorganization, if the Service or assets are transferred, with notice where the law requires

International transfers. If we transfer data outside the EEA/UK/Switzerland, we use Standard Contractual Clauses, UK addenda, or other mechanisms the law approves, and supplementary measures where needed for transfer after TIA-style assessment. Our core hosting and mail storage remain in the European Union.

5. Data subject rights (EEA, UK, and similar)

If the law of your jurisdiction grants you the following, you may:

• Access, rectify, delete, and port your data, object to certain processing, restrict processing, and, where the law grants, withdraw consent (without affecting lawfulness before withdrawal)
• Lodge a complaint with a data protection authority, e.g. in the EEA your local DPA (in France, the CNIL), or in the UK the ICO
• Name a DPR in the EU, if we require one under the Art. 27 GDPR, as listed in our Legal notice (if applicable)

Requests may be made through [email protected]. We may need to verify your identity before we disclose or change information. We answer within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.

If you are a customer's end user. Where your data sits inside a Smailor customer's mailbox, tickets, or contacts, that customer is the controller. Send your request to them; if you send it to us, we will forward it to them and assist them, but we cannot decide it for them.

California and other U.S. state privacy laws. If you are a California resident, you may have access, deletion, correction, and opt-out of sale or sharing rights. We do not sell personal information in the sense of California's CCPA/CPRA without offering the rights the law requires. If we honor a Global Privacy Control signal, we will describe that practice in a U.S. addendum.

6. Retention

We keep data for as long as your account is active and as needed to provide the Service, and then in de-identified, aggregated, or limited form where permitted, for:

• Legal, accounting, and evidence purposes (statutes and fraud may require longer)
• Dispute resolution and TOS enforcement for a reasonable period after termination of the Service (often 3–6 years depending on the type of data and the jurisdiction)

You can export and request deletion in settings where that feature exists.

Deletion is final. Where you use an immediate deletion control — for a conversation, an archive, a mailbox, or an account — the data is removed from the live Service and we cannot restore it, including from backups. Backups exist for disaster recovery, are not a per-user restore service, and are overwritten on their own cycle, so a deleted item may persist in a backup only until that cycle completes. Copies your mail client already downloaded are outside our control and must be deleted on your devices.

Why we keep a suppression list. If you ask us never to contact you again, we must retain the minimum needed — normally your address in hashed or plain form and the date — to make sure we do not contact you again. Erasing that record entirely would defeat your own request.

7. Security

We use technical and organizational measures (for example encryption in transit, storage encryption at rest at the infrastructure layer, access controls, credential hashing, rate limiting, and monitoring) appropriate to the risk, but no system is fully secure. Use 2FA and strong passwords where we offer them.

Some things are, by design, not end-to-end encrypted: mail must be readable by the Service to be searched, filtered, routed, and displayed, and credentials for third-party providers you connect must be replayable to function. Our Trust page and DPA describe what is protected and how. Our Security Policy explains how to report a vulnerability.

Breach notification. If a personal data breach occurs, we notify the competent supervisory authority and affected individuals where the GDPR or equivalent law requires, and we notify business customers without undue delay so they can meet their own obligations, as set out in the DPA.

8. Marketing to you

Customers. We send transactional and security messages as part of the Service; you cannot opt out of those while you hold an account. Product news and marketing are sent where you opted in, or on the basis of an existing customer relationship where the law allows, and every such message carries an unsubscribe link that we honour.

Prospects. See Section 10.

9. Changes to this policy

We will post the updated policy on the website and change the last updated date. Material changes may be announced in the product or by email. Continued use after the effective date may be treated as acceptance where the law allows. Where consent is required, we will seek it.

10. If we contacted you and you are not a customer

We carry out business-to-business prospecting: we contact organizations that appear to have a professional need for email infrastructure. If you received such a message, this section is your Article 14 notice.

• Controller. Victor ANDRE EI (see the Legal notice).
• Where the data came from. We did not buy it. It comes from publicly accessible professional sources — chiefly the organization's own public website and the contact or role addresses published on it — together with public DNS and technical records about the domain. We do not use purchased, scraped-from-private-source, or unlawfully obtained lists.
• What we hold. A professional contact address, the organization and website it relates to, publicly stated role or business information, technical findings about the domain relevant to email (for example DNS or mail configuration), the source URL, and the record of what we sent you and how you responded.
• Purpose and legal basis. Contacting the organization about a product plausibly relevant to its business, on the basis of our legitimate interests (GDPR Art. 6(1)(f)), balanced against your rights. We target professional, role-based contacts in a business capacity, keep volumes low, and do not pursue a contact who does not respond.
• What we do not do. We do not process special-category data for this purpose, do not contact individuals in a personal capacity, do not build behavioural profiles of you, and do not sell or share prospect data for others' marketing.
• Your rights. You may object at any time, for any reason, and we stop (GDPR Art. 21(2) — for direct marketing there is nothing to balance). Use the unsubscribe link in the message, or write to [email protected]. You also have the access, rectification, erasure, restriction, and portability rights in Section 5, and may complain to the CNIL or your local authority.
• Retention. If you do not respond, we delete or anonymise the prospect record within a limited period. If you object or unsubscribe, we delete the record and keep only the minimum suppression entry needed to make sure we never contact you again.
• Automation. Selection and drafting may be assisted by automated tools, but this involves no decision with legal or similarly significant effect on you, and no sending happens that we have not configured and accepted responsibility for.

11. Contact

For privacy questions, contact [email protected] and see the Legal notice for postal and company details. For security reports, see the Security Policy.