# Privacy policy — MiraMail > MiraMail privacy policy. ## Privacy Policy **Effective date:** 2026-05-07 > Scope of this policy This Privacy Policy covers personal data [Operator Legal Entity Name TBD] collects from you as our customer (the account holder). It does NOT cover the data you upload to your workspace (your contacts, your recipients, your subscribers) — that data is controlled by you, and is covered by our DPA (where MiraMail acts as your sub-processor) and by your own privacy notice that you publish to your subscribers. ### 1. Operator Identity The operator of the canonical hosted MiraMail at miramail.io is **[Operator Legal Entity Name TBD]**, registration № [Registration Number TBD], registered office [Registered Address TBD], Bulgaria. Self-hosted deployments are operated by their respective hosting party. ### 2. Information We Collect #### 2.1 Account information When you sign up: email, name, password (hashed via bcrypt), and optional profile details. We also collect IP address and user-agent string for security forensics, trimmed to a privacy-preserving prefix. #### 2.2 Billing information Billing details (card, billing address, VAT number where applicable) are collected and processed by **Paddle**, our merchant of record. Paddle is the seller and tax handler; [Operator Legal Entity Name TBD] receives only the minimum metadata required to associate a successful charge with your MiraMail account. #### 2.3 Usage events We log per-account usage events (emails sent, AI tokens consumed, contacts active, storage bytes) for billing, quota enforcement, and fraud detection. #### 2.4 Workspace content (out-of-scope here) Data you upload (contacts, broadcasts, templates, segments, events) is your data — see the [DPA](/dpa). Treat this Privacy Policy as silent on workspace content; your own privacy notice covers it for your subscribers. ### 3. Lawful Basis (GDPR Art. 6) - [object Object] - [object Object] - [object Object] - [object Object] ### 4. How We Use Information - To provide, operate, secure, and maintain the Service. - To send transactional emails (account-related, billing notices, security alerts). - To enforce usage limits and detect abuse and fraud. - To respond to your support requests. - To improve product features using aggregated, non-identifying data only. We do **NOT** sell your data, and we do **NOT** use your workspace content to train AI models without your explicit opt-in. ### 5. Data Retention - [object Object] - [object Object] - [object Object] - [object Object] ### 6. Sub-Processors We engage the following sub-processors for account-level processing. The full, authoritative list (including processors for workspace content) lives in the [DPA §7](/dpa). - [object Object] - [object Object] - [object Object] - [object Object] - [object Object] ### 7. International Data Transfers We use servers and sub-processors located in the EU/EEA and the United States. For transfers from the EU/EEA to third countries we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary technical and organizational measures where warranted. ### 8. Your Rights (GDPR Articles 15–22) You have the right to: - [object Object] - [object Object] - [object Object] - [object Object] - [object Object] - [object Object] - [object Object] Self-service tools are available in **Settings → Account**. Manual requests: [privacy@miramail.io](mailto:privacy@miramail.io). ### 9. Cookies We use **strictly-necessary cookies** (session, CSRF) without consent — they are required to operate the Service. **Analytics cookies (Plausible)** are loaded only if you accept analytics in the cookie banner. We do **NOT** use third-party advertising or retargeting cookies, ever. ### 10. Children's Privacy The Service is not intended for users under 16. We do not knowingly collect data from children. If you believe we hold data on a minor, contact [privacy@miramail.io](mailto:privacy@miramail.io) and we will delete it. ### 11. Supervisory Authority You have the right to lodge a complaint with the [Commission for Personal Data Protection (Комисия за защита на личните данни)](https://www.cpdp.bg/) (the supervisory authority in Bulgaria) or with your local supervisory authority in the EU/EEA Member State of your residence, place of work, or place of the alleged infringement. ### 12. Security We use industry-standard measures: TLS for in-transit data, encryption at rest for databases, bcrypt for password hashes, principle of least privilege for staff access, append-only audit logging on administrative actions. Report suspected vulnerabilities to [security@miramail.io](mailto:security@miramail.io). ### 13. Changes to This Policy We post material changes here with a new "Effective" date and notify account holders by email at least 30 days in advance. ### 14. Contact Privacy questions: [privacy@miramail.io](mailto:privacy@miramail.io) Data Protection Officer: [dpo@miramail.io](mailto:dpo@miramail.io)