Privacy Policy
The short version
- We collect what we need to run your account and the mail client, and nothing to advertise with. No ad trackers, no selling data.
- Your mailboxes' content is yours. We store it encrypted to show it to you, we process it only on your instructions, and staff don't read it.
- Message bodies are cached for 30 days and then fetched again from your provider when you open them.
- You can see, correct, export or delete your data. Download all of it yourself in Settings → Account, or write to privacy@mailpitcher.com.
1. Who is responsible
For the data described in sections 3 to 5, the controller is [COMPANY NAME], [REGISTERED ADDRESS], Latvia (registration number [REGISTRATION NUMBER]). Contact for anything about privacy: privacy@mailpitcher.com.
Your mailboxes and recipients are different. When you connect a mailbox, import contacts or send campaigns, you decide what happens to that data, so you are its controller and we are your processor. Our Data Processing Addendum covers that. If you are someone who received an email sent with Mailpitcher, see section 8.
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address, name (optional), account settings, plan | Create and run your account, sign you in, send service messages | Contract (6(1)(b)) |
| Only if you use Sign in with Google: your name, email address and Google account ID, received from Google | Sign you in, and make sure only the Google account you first used can sign in to your account that way. We ask Google for nothing else: we don't get access to your Gmail, contacts or other Google data | Contract (6(1)(b)) |
| Mailbox connection details: server addresses, app password or provider sign-in token, encrypted | Connect to your mailbox to show and send mail | Contract (6(1)(b)) |
| Your mail, contacts, campaigns, templates, projects (content you put in or sync) | Provide the mail client and outreach features | We process it for you as processor (see the DPA) |
| Security data: IP address, browser/device, sign-in and security events, trusted devices, two-step sign-in secret (encrypted) | Keep accounts secure, detect abuse, investigate incidents | Legitimate interests in security (6(1)(f)) and legal obligation (6(1)(c)) |
| Bot check on the waitlist, contact and sign-in forms (Cloudflare Turnstile): your IP address and technical signals from your browser and device, processed by Cloudflare when the form loads and when you send it | Tell people from automated abuse, so bots can't use our forms to send email to strangers or flood our inbox. It sets no tracking or advertising cookies, and we receive only a pass or fail | Legitimate interests in security (6(1)(f)) |
| Usage counts: emails sent per day per mailbox, sync status, errors | Enforce sending caps, keep the service healthy, plan capacity | Contract (6(1)(b)), legitimate interests (6(1)(f)) |
| Billing details: name, billing address, VAT number, payment status (card data stays with Stripe) | Charge for paid plans, issue invoices, keep accounting records | Contract (6(1)(b)), legal obligation (6(1)(c)) |
| Messages you send us (support, feedback) | Answer you and improve the product | Legitimate interests (6(1)(f)) |
| Contact form on this website: your name (optional), email address, topic and message, plus your IP address, which is held in server memory for at most a day to limit abuse and not stored with your message | Answer you (for example, set up the free trial you asked for) | Steps you ask for before a contract (6(1)(b)), or legitimate interests in answering you and preventing abuse (6(1)(f)) |
| Website visits, only if you accept analytics cookies: pages viewed, the page you came from, device and browser type, approximate location (derived from your IP address, which Google Analytics doesn't store) | See which pages people find useful and improve the website | Consent (6(1)(a)), which you can withdraw any time under "Cookie settings" at the bottom of every page |
| Waitlist: email address, the page you signed up on, the date, and which version of this notice you saw (plus where you first came from, below, if you accepted analytics cookies) | Confirm your address and send your invite | Consent (6(1)(a)), which you can withdraw any time |
| Where you first came from, only if you accept analytics cookies on this website: the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the name of the website that sent you (not the page), the first page you landed on and the date. If you then join the waitlist or create an account, we store this with it, together with the random Google Analytics ID of your visit | Know which channels (search, a post, an article, an ad) bring people who sign up and pay, so we spend our time on those | Consent (6(1)(a)), which you can withdraw any time: "Cookie settings" at the bottom of every page removes the cookie, and privacy@mailpitcher.com removes what's stored with your account |
| Purchases, only if your website visit accepted analytics cookies (so the Google Analytics ID above was kept): when a payment for your account succeeds, our server reports it to Google Analytics as a "purchase" with the amount, currency, plan, invoice number and whether it's a renewal, together with that random ID. Never your email, name or other account details | See which channels lead to paying customers, not just visits | Consent (6(1)(a)), given with the analytics cookies; write to privacy@mailpitcher.com and we stop and delete the stored ID |
| Your answer to "Where did you hear about us?", asked once after you sign up (optional; Skip stores only that you skipped) | Know which channels work, including the ones links can't show (a friend, a podcast) | Consent (6(1)(a)): answering is up to you |
| Your rating in "How is it going so far?" (1 to 5 stars, asked once, 14 days after your first full payment; optional), and, if you choose to write one, what we should fix | Learn how the product is working for people and fix what isn't. A written answer reaches our support inbox so we can reply | Legitimate interests in improving the product (6(1)(f)) |
Only an email address is required, to create and sign in to an account (or to join the waitlist). Everything else is optional or needed only for the feature you choose: without mailbox details we can't connect that mailbox, and without billing details we can't sell you a paid plan.
Our servers also keep technical logs (for example the time of a request, the IP address, and errors, which can include your account's email address) to run and secure the Service, under the same legitimate interests in security.
We don't use your data for automated decisions with legal or similarly significant effects, and we don't profile you for marketing.
3. How we handle your mailboxes
- Credentials and tokens are encrypted at rest with a key kept separate from the database. Connections to mail providers always use TLS.
- We sync folders, message headers and metadata (sender, recipients, subject, dates, flags) so you can list and search mail. Message bodies are cached encrypted for 30 days and then dropped; opening an older message fetches it again from your provider.
- Our admin tools show account and connection health only (for example "connected" or "sync error"). They don't show subjects, bodies, senders or recipients.
- If you use the MCP server, the AI tool you connect receives the data it asks for using your token. That tool's provider handles it under its own terms; you can revoke tokens at any time.
- Disconnecting a mailbox deletes its credentials and synced copy from our live systems right away.
- Images you add to signatures, templates or campaign emails are stored by us and served publicly at a long, unguessable address, because your recipients' mail apps need to load them. Don't put anything private in them.
4. The waitlist
When you join the waitlist we send one confirmation email. If you don't confirm within 7 days, we delete your address. Once confirmed, we'll email you only about access to Mailpitcher (your invite and launch news). Every email has a link to leave the list, which deletes your address at once. We delete the waitlist entirely within 12 months of the public launch.
5. Cookies and similar technology
We use only cookies that are strictly necessary, so we don't ask for consent to them:
- Session cookie (app): keeps you signed in. Expires after 14 days without use and at most 30 days after sign-in.
- Trusted-device cookie (app, only if you use two-step sign-in): remembers a device you trusted, so the code is asked as often as you chose. Up to 400 days; you can forget devices in Settings.
- Google sign-in cookie (app, only if you use Sign in with Google): links your browser to the sign-in it started, so nobody else can finish it. Deleted when you come back from Google, and after 10 minutes at the latest.
- Your browser's local storage keeps interface preferences, such as theme and dismissed tips. It stays on your device.
On this website (not in the app), with your consent only:
mp_src: where you first came from (e.g. a search engine or a link), so we know which channels work; no identifiers; 90 days. It holds only the campaign tags of the link, the referring website's name, the first page you saw and the date. It's set for mailpitcher.com and its subdomains, so the app can read it once when you create an account. Set only after you click "Accept", and removed if you withdraw.- Google Analytics cookies (
_gaand_ga_…, up to 2 years): count visits and show which pages are read. Nothing from Google loads until you click "Accept" in the cookie banner: before that, no script, no cookies and no data (not even your IP address) go to Google. Your choice is kept in your browser's local storage, and you can change it any time under "Cookie settings" at the bottom of every page; withdrawing removes these cookies. We keep Google Analytics data for 14 months, don't use Google's advertising features, and don't share the data with Google for its own purposes.
The website has no advertising cookies. Cloudflare may process technical request data (such as IP address) to deliver and protect the site.
6. Who processes data for us
We use these service providers (processors), each under a data-processing agreement. We'll update this list before adding a new one that handles personal data.
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| DigitalOcean, LLC | Application servers, database and server backups | Frankfurt, Germany (EU) | — |
| Vultr Holdings, LLC | Network relay that carries mail connections between our servers and mail providers. It sees only encrypted traffic. | Frankfurt, Germany (EU) | — |
| Cloudflare, Inc. | DNS, network protection and hosting of this website, and Cloudflare Turnstile, the bot check on our waitlist, contact and sign-in forms | Global network | EU–US Data Privacy Framework, Standard Contractual Clauses |
| Resend, Inc. | Sending our own emails: sign-in links, waitlist confirmations, invites, security alerts | United States | EU–US Data Privacy Framework, Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payments and invoices (once paid plans open) | EU, with transfers to the US | EU–US Data Privacy Framework, Standard Contractual Clauses |
| Google Ireland Limited | Website analytics (Google Analytics), only if you accept analytics cookies on this website; and purchase events sent by our server, only for accounts whose website visit accepted them | EU, with transfers to the US | EU–US Data Privacy Framework, Standard Contractual Clauses |
| Microsoft Corporation | Only if you choose "Sign in with Microsoft" to connect an Outlook or Microsoft 365 mailbox | As set by your Microsoft account | Microsoft's own terms with you |
| Google LLC | Only if you choose "Sign in with Google" to sign in: Google confirms who you are and sends us your name, email address and Google account ID | As set by your Google account | Google's own terms with you |
Your mail provider (for example Google or Microsoft) isn't our processor: you have your own relationship with them, and we connect to them on your behalf. We share data with authorities only when the law requires it, and we push back on requests that aren't lawful.
7. Transfers outside the EU/EEA
Our servers and database are in the EU. Where a provider above processes data outside the EU/EEA, the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on Standard Contractual Clauses, with extra safeguards where needed. Ask us for a copy of the relevant safeguards at privacy@mailpitcher.com.
8. If you received an email sent with Mailpitcher
The person or company who emailed you used Mailpitcher as their mail software. They decided to contact you and are responsible for it, so they're the controller of your data; contact them first. We process the data only on their behalf. If you can't reach them, or want to report abuse, write to abuse@mailpitcher.com with the email (including headers), and we'll look into it. We act on credible spam complaints under our Acceptable Use Policy.
9. How long we keep data
- Account data: while your account exists. When you delete your account (Settings → Account), it switches off at once and everything in it is erased 24 hours later; until then the link we email you keeps it. Erased data leaves backups within a further 30 days. We keep only a line in our records that an account was erased, without your address.
- Synced mail: while the mailbox is connected; bodies for 30 days at a time (see section 3).
- Security log (sign-ins, refused attempts, admin actions): 12 months.
- Sign-in links: work once, for 10 minutes; deleted within a day after they expire.
- Backups: copies of our server made by DigitalOcean in the same EU data centre, replaced on a rolling basis; each one is gone within 30 days.
- Technical logs: up to 30 days.
- Invoices and accounting records: as long as tax law requires (in Latvia, generally 5 to 10 years).
- Messages you send us (privacy requests, abuse reports, support, the contact form): up to 2 years after the conversation is closed, then deleted.
- Waitlist: see section 4.
- Where you came from, and your "Where did you hear about us?" answer: while your account exists (for the waitlist, as long as your entry).
- Ratings ("How is it going so far?"): the number of stars is kept without any link to you after your account is deleted; a written answer is removed from the rating when your account is deleted, and the copy in our support inbox is kept like other messages you send us.
- Images you add (signatures, templates, campaign emails): while your account exists, so emails you've sent keep showing them. Images nothing uses any more are deleted after 90 days.
10. Security
Measures include: encryption in transit (TLS) and at rest for credentials, tokens and cached message content; two-step sign-in, required before connecting real mailboxes or sending; single-use sign-in links instead of passwords; rate limits and abuse controls; least-privilege server access with keys only; and regular backups kept in the EU. If a breach puts your data at risk, we'll notify the supervisory authority within 72 hours where required, and tell you without undue delay.
11. Your rights
Under the GDPR you can ask us to: give you access to your data and a copy of it; correct it; delete it; restrict or object to processing based on legitimate interests; and receive data you gave us in a portable format. Where we rely on consent (the waitlist, analytics cookies and where you came from, the "Where did you hear about us?" answer), you can withdraw it at any time, without affecting what happened before.
You can download a copy of your data yourself, at any time and for free, in Settings → Account → Download your data: one ZIP file with your account and settings, mailbox settings, contacts, lists, suppressions, templates, campaigns with their send history, projects, uploaded files and images, where you came from and your answers to our two in-app questions, and your account's security log, as JSON and CSV. Synced mail isn't in it, because it stays at your email provider; mailbox passwords, sign-in tokens and two-step secrets never are.
You can delete your account yourself in Settings → Account → Delete account. It switches off straight away and is erased 24 hours later, unless you keep it with the link we email you. Messages you sent us (for example a deletion request) are kept as described in section 9.
Write to privacy@mailpitcher.com from the address on your account. We answer within one month (extendable by two months for complex requests, in which case we'll tell you). We may ask you to confirm your identity. It's free, unless requests are clearly unfounded or excessive.
You can also complain to a data protection authority: in Latvia, the Data State Inspectorate of Latvia (Datu valsts inspekcija), or the authority where you live or work. We'd appreciate the chance to fix things first.
12. Children
Mailpitcher isn't meant for anyone under 18, and we don't knowingly collect their data.
13. Changes
We'll post updates here with a new version date. If a change materially affects how we use your data, we'll tell you by email or in the app beforehand.