Privacy policy · Mailmoni

This policy says what personal data Mailmoni holds, why, for how long, and who else handles it. Aimosti Oy is the controller for the data in this policy. Privacy questions go to Raine Laurila, info@mailmoni.com.

What we hold, why, and for how long

Your account: your email address, your name if you give one, a hash of your password, and your two-step sign-in settings. We need them to let you sign in and to email you about your account (contract). We keep them until you delete your account.
Your organization: its name, its members and their roles, its domains and its settings (contract). Deleting the organization ends access at once, and its data is purged within 30 days.
Reports: the aggregate and TLS reports that mailbox providers send about your domains (contract). They hold domain names, IP addresses and counts. The retention depends on the plan: 30 days on Starter, 13 months on Pro, 25 months on Teams and 37 months on Enterprise. Daily totals and the sending sources worked out from the reports, with their IP addresses, are kept 30 days longer, so charts do not end abruptly. A source you have given a name is kept until you remove the name or delete its domain.
Forensic reports: a mailbox provider may also send a forensic report about a single failed message, which can contain email addresses. For these reports we process data on your behalf, and you are the controller. By default we remove the part of each address before the @, the subject and the body when we read the report, and delete the original. Your organization can choose to keep full reports, or to discard them all. They follow the same retention as the other reports.
Billing: the paying admin's email address, the organization's billing address and VAT number, and its invoices. Stripe holds them to take payment, and Finnish bookkeeping law requires invoices to be kept (contract and legal obligation). Deleting your organization does not delete its record or invoices at Stripe. They are kept for at least six years after the end of the year of the invoice. Stripe also sends us a copy of each billing event, with the same details, and we keep these copies for 90 days.
Email we send you: the address, the subject and the time of each email we send, so we can see delivery problems (legitimate interest). The retention is 90 days.
Server logs: the IP address, time and path of each request, for security and to find faults (legitimate interest). The retention is 30 days.
Sign-in protection: counts of sign-in, sign-up, password reset and similar attempts per IP address, to slow down password guessing and abuse (legitimate interest). They expire within an hour and are deleted the following night.
Support messages: what you write to us by email or through the support form, the address you give, and, if you are signed in when you use the form, your organizations and their plans. We need them to answer you (legitimate interest, or contract if you are a customer). The form keeps its copy, with your IP address for its sending limit, for 30 days. The conversation stays in our support mailbox for three years after it ends, the general limitation period in Finland, and is then deleted.

Everything above is also in our encrypted nightly backups. A nightly backup is kept for 30 days. The ten most recent backups taken before a software update are kept until newer ones replace them.

Where the data is

Mailmoni runs on a server at Hetzner in Helsinki, Finland. Backups are encrypted on our server before they leave it, and are stored in a Cloudflare R2 bucket under the EU jurisdiction. Reports arrive by email directly at our server.

Who else handles it

Hetzner Online GmbH, Germany: the server.
Cloudflare, Inc., United States: DNS, the connection between your browser and our server, and backup storage in the EU.
Zoho Corporation B.V., Netherlands: sends our email through ZeptoMail, and hosts our support mailbox, in its EU data centre.
Stripe Payments Europe, Ltd., Ireland: takes payments and keeps billing records.

Cloudflare and Stripe's parent company are in the United States. Transfers to them rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. Mailmoni uses no analytics and no advertising trackers. The only third-party script is Cloudflare Turnstile, on the sign-up and password reset forms, which checks that a person is filling them in. It runs in a frame from Cloudflare and uses your IP address and browser details for that check only.

Cookies

Mailmoni sets only the cookies it needs to work: one that keeps you signed in, one that protects forms against cross-site request forgery, one that carries a short notice, such as a confirmation, to the next page you open, and one that remembers your language if you choose it. The public pages set none.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, ask us to restrict or stop processing it, and ask for it in a machine-readable form. Write to info@mailmoni.com. We answer within one month. You can also complain to the Data Protection Ombudsman of Finland, tietosuoja.fi.

Changes to this policy

We change this policy when what we hold, or who handles it, changes. The date at the top of this page says when it last changed. We email your organization's admins about a change that affects them.