This policy explains what personal data MailCraft handles, why, and the choices you have — whether you are a MailCraft customer, or someone who receives email sent through MailCraft.
1. Our role
For your account, billing and website use, MailCraft is the controller of your data. For the contacts and emails our customers manage in MailCraft, the customer is the controller and we process that data on their behalf, following their instructions.
2. What we collect
- Account data — your name, email address, password (stored hashed), team membership and, if you use them, passkey and two-factor settings. If you sign in with Google or GitHub, we receive your name, email address and account ID from them.
- Billing data — plan and billing history. Card details are collected and stored by Stripe; we never see or store full card numbers.
- Service data — API keys (stored hashed), domains, senders, templates, sent emails, webhook deliveries and logs needed to run and secure the service.
- Customer contact data — email addresses, names and custom properties our customers add about their own contacts.
- Email engagement — when an email is opened or a link in it is clicked, with the time and the browser’s user agent. We do not record recipients’ IP addresses for this.
3. How we use it
We use data to provide and secure MailCraft, to deliver the email our customers send, to bill for the service, to prevent abuse, to support you, and to meet legal obligations. We do not sell personal data, and we do not use customers’ contact data for our own marketing.
4. Open and click tracking
Open and click tracking is on for our customers’ sending domains. Opens are detected with a small invisible image in the email; clicks by routing links through MailCraft before redirecting to the destination. If you receive email sent through MailCraft and want to stop this, block remote images in your mail client, or contact the sender, who controls the data.
5. Who we share it with
We share data only with service providers that help us run MailCraft, under contracts that require them to protect it:
- Amazon Web Services — email delivery (Amazon SES).
- Stripe — payments and invoicing.
- Our hosting and infrastructure providers.
- Google and GitHub — only if you choose to sign in with them.
6. How long we keep it
We keep account and service data while your account is active. When you delete your workspace, its contacts, emails and other data are deleted; some records, such as invoices, are kept longer where the law requires.
7. Security
Data is encrypted in transit with TLS. Passwords and API keys are stored hashed, API keys are scoped, and webhook deliveries are signed. No system is perfectly secure — please use a strong password and turn on two-factor authentication.
8. Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to how we use it. Customers can manage most of this in their account settings. If you are a contact of one of our customers, please contact that company directly — we will help them respond.
9. International transfers
Data may be processed in countries other than yours. Where required, we protect transfers with safeguards such as the European Commission’s standard contractual clauses.
10. Contact
Privacy questions or requests: [email protected].