Privacy Policy

Effective date: 2026-05-07

1. Operator Identity

The operator of the canonical hosted MiraMail at miramail.io is [Operator Legal Entity Name TBD], registration № [Registration Number TBD], registered office [Registered Address TBD], Bulgaria. Self-hosted deployments are operated by their respective hosting party.

2. Information We Collect

2.1 Account information

When you sign up: email, name, password (hashed via bcrypt), and optional profile details. We also collect IP address and user-agent string for security forensics, trimmed to a privacy-preserving prefix.

2.2 Billing information

Billing details (card, billing address, VAT number where applicable) are collected and processed by Paddle, our merchant of record. Paddle is the seller and tax handler; [Operator Legal Entity Name TBD] receives only the minimum metadata required to associate a successful charge with your MiraMail account.

2.3 Usage events

We log per-account usage events (emails sent, AI tokens consumed, contacts active, storage bytes) for billing, quota enforcement, and fraud detection.

2.4 Workspace content (out-of-scope here)

Data you upload (contacts, broadcasts, templates, segments, events) is your data — see the DPA. Treat this Privacy Policy as silent on workspace content; your own privacy notice covers it for your subscribers.

3. Lawful Basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)). Most account-level processing — login, billing, support — is necessary to perform the contract with you.
• Legitimate interest (Art. 6(1)(f)). Security logging, anti-fraud and abuse detection, audit trails.
• Consent (Art. 6(1)(a)). Optional product analytics (Plausible) — gated by the cookie banner. You can revoke consent at any time.
• Legal obligation (Art. 6(1)(c)). Tax records and other statutory retention.

4. How We Use Information

• To provide, operate, secure, and maintain the Service.
• To send transactional emails (account-related, billing notices, security alerts).
• To enforce usage limits and detect abuse and fraud.
• To respond to your support requests.
• To improve product features using aggregated, non-identifying data only.

We do NOT sell your data, and we do NOT use your workspace content to train AI models without your explicit opt-in.

5. Data Retention

• Account data: retained while your account is active. On account deletion: hard delete within 30 days from production systems; backups rotate within an additional 30 days.
• Email send logs: 180 days (deliverability + dispute investigation).
• Audit logs: retained per statutory requirements (security + compliance).
• Billing records: retained as required by applicable tax law in Bulgaria.

6. Sub-Processors

We engage the following sub-processors for account-level processing. The full, authoritative list (including processors for workspace content) lives in the DPA §7.

• Resend — outbound email delivery (Delaware, USA).
• Paddle — payments and tax (UK + USA; merchant of record).
• Sentry — error monitoring, with PII stripped before transmission.
• Plausible — privacy-preserving product analytics; consent-gated via the cookie banner.
• Hosting provider — compute, database, object storage.

7. International Data Transfers

We use servers and sub-processors located in the EU/EEA and the United States. For transfers from the EU/EEA to third countries we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary technical and organizational measures where warranted.

8. Your Rights (GDPR Articles 15–22)

You have the right to:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate data via Settings → Account, or by emailing privacy@miramail.io.
• Erasure (Art. 17) — delete your account and associated data via Settings → Account → Delete.
• Portability (Art. 20) — export your account + workspace data via Settings → Account → Export.
• Restriction (Art. 18) — request that we restrict processing while a dispute is resolved.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent — revoke any consent-based processing (e.g., analytics) at any time, without affecting the lawfulness of prior processing.

Self-service tools are available in Settings → Account. Manual requests: privacy@miramail.io.

9. Cookies

We use strictly-necessary cookies (session, CSRF) without consent — they are required to operate the Service. Analytics cookies (Plausible) are loaded only if you accept analytics in the cookie banner. We do NOT use third-party advertising or retargeting cookies, ever.

10. Children's Privacy

The Service is not intended for users under 16. We do not knowingly collect data from children. If you believe we hold data on a minor, contact privacy@miramail.io and we will delete it.

11. Supervisory Authority

You have the right to lodge a complaint with the Commission for Personal Data Protection (Комисия за защита на личните данни) (the supervisory authority in Bulgaria) or with your local supervisory authority in the EU/EEA Member State of your residence, place of work, or place of the alleged infringement.

12. Security

We use industry-standard measures: TLS for in-transit data, encryption at rest for databases, bcrypt for password hashes, principle of least privilege for staff access, append-only audit logging on administrative actions. Report suspected vulnerabilities to security@miramail.io.

13. Changes to This Policy

We post material changes here with a new "Effective" date and notify account holders by email at least 30 days in advance.

14. Contact

Privacy questions: privacy@miramail.io Data Protection Officer: dpo@miramail.io