DATA PROTECTION NOTICE & PRIVACY COMMITMENT

Privacy Policy

MeshMail is committed to protecting the privacy, confidentiality, and data sovereignty of our clients. This policy explains how we collect, process, store, and safeguard your personal information and technical infrastructure data.

Effective Date: November 4, 2026GDPR (EU/UK) & CCPA/CPRA AlignedView Terms of Service
Production Draft Notice (Requires Founder & Legal Review):This Privacy Policy is a production draft. Sub-processor agreements, Data Protection Officer designation, specific telemetry retention schedules, and Data Processing Addendum (DPA) execution terms require final verification by MeshMail founders and legal counsel.
Our Data Hygiene Guarantee:We never sell, rent, or monetize your contact lists, prospect data, or personal details. MeshMail functions as an infrastructure automation engine. In our Automated Warmup Network, all exchanged messages are synthetic peer simulations; MeshMail never reads, parses, or exposes your proprietary cold outreach copy or prospect databases.

Policy Sections

1. Scope & Legal Identification2. Data Controller vs. Data Processor3. Categories of Data Collected4. Warmup Network & Data Isolation5. Legal Bases for Data Processing6. Sub-Processors & Data Disclosures7. Cross-Border Data Transfers8. Security Standards & Encryption9. Data Retention & Deletion10. Your Rights (GDPR & CCPA/CPRA)11. Cookies & Telemetry12. Data Protection Officer (DPO)

01.Scope & Legal Identification

This Privacy Policy applies to the websites usemeshmail.com, app.usemeshmail.com, the MeshMail application programming interface (API), and all associated tools, documentation, and services provided by MeshMail (“MeshMail”, “we”, “us”, or “our”).

This document informs you of our policies regarding the collection, use, retention, and protection of personal data when you interact with our platform, and the choices available to you regarding your information.

02.Data Controller vs. Data Processor Roles

Under the European Union General Data Protection Regulation (GDPR) and similar data protection statutes, MeshMail operates in two distinct legal capacities:

MeshMail as Data Controller

Account & Billing Data

We act as Data Controller for your user account information, admin email addresses, contact details, organization name, authentication credentials, billing records, and direct customer support communications.

MeshMail as Data Processor

Infrastructure & Telemetry

When you configure secondary domains, deploy mailboxes, connect sequencers, or route email messages through MeshMail, you act as the Data Controller, and MeshMail processes technical DNS records, routing headers, and telemetry strictly on your behalf.

03.Categories of Data We Collect

We collect personal and technical information in the following categories:

  • Identity & Profile Data: Full name, professional email address, organization name, job title, and salted cryptographic password hashes.
  • Financial & Billing Data: Payment card expiration, last 4 digits of payment cards, card brand, and transaction history. All payment card tokenization and transactions are managed directly by Stripe, Inc. in compliance with PCI-DSS Level 1. MeshMail never stores full credit card numbers or security CVV codes.
  • Domain & Infrastructure Metadata: Registered domain names, Cloudflare zone IDs, SPF records, DKIM 2048-bit cryptographic public keys, DMARC policies, custom tracking domains, and Google Workspace user IDs.
  • Fleet Deliverability Telemetry: Anonymized bounce event codes, delivery timestamps, bounce rate percentages, spam complaint ratios, and warmup ramp progress counters.
  • System & Diagnostic Logs: IP addresses, browser user-agent strings, login timestamps, API access tokens, and error traceback logs for security monitoring.

04.Automated Warmup Network & Strict Data Isolation

Zero Exposure of Customer Prospect Lists or Outreach Copy

A common concern with cold email infrastructure is whether warmup networks inspect or cross-contaminate proprietary prospect databases. MeshMail enforces strict cryptographic and logistical isolation:

  • Synthetic Warmup Content: Warmup emails exchanged between mailboxes in our peer network consist entirely of computer-generated, synthetic conversational templates designed solely to establish positive IP and domain reputation with mailbox providers.
  • No Inspection of Outbound Campaigns: MeshMail does not inspect, read, scrape, store, or analyze the contents of your actual outbound cold sales messages, recipient prospect lists, or CRM records.
  • Data Segregation: Your customer data, API credentials, and domain assets remain completely isolated within your tenant workspace.

05.Legal Bases for Processing (GDPR Article 6)

We process your personal data only when an established lawful basis applies:

Performance of a Contract (Art. 6(1)(b)):Processing necessary to provision your domains, create Google Workspace mailboxes, configure Cloudflare DNS records, and maintain your account.
Legitimate Business Interests (Art. 6(1)(f)):Processing necessary to detect fraudulent signups, prevent illegal spam abuse, execute automated circuit-breaker deliverability protections, and secure our network infrastructure.
Compliance with Legal Obligations (Art. 6(1)(c)):Processing necessary to satisfy corporate accounting, tax documentation, ICANN domain registration regulations, and lawful subpoenas.

06.Sub-Processors & Infrastructure Partners

MeshMail engages reputable, enterprise third-party sub-processors to deliver core infrastructure components. Each sub-processor undergoes security reviews and is bound by Data Processing Agreements (DPAs):

Sub-ProcessorService RoleEntity LocationData Safeguard
Google LLC (Google Cloud / Google Workspace)Provisioning genuine Google Workspace mailboxes, webmail interfaces, and mailbox storage.United States & Global RegionsGoogle Cloud Data Protection Addendum & EU Standard Contractual Clauses (SCCs)
Cloudflare, Inc.Authoritative DNS management, automated DNS record provisioning (SPF/DKIM/DMARC), and edge DDoS protection.United States & Global Anycast NetworkCloudflare Data Processing Addendum & SOC 2 Type II Certification
Stripe, Inc.PCI-DSS Level 1 payment processing, recurring billing subscriptions, and invoicing.United States & Global RegionsPCI-DSS Level 1 Service Provider & Binding Corporate Rules
ICANN-Accredited Registrar PartnersRegistering secondary domain names, WHOIS privacy protection, and domain lifecycle management.United States & European UnionICANN Registrar Data Escrow & Privacy Protection Standards
Amazon Web Services (AWS) & Vercel, Inc.Cloud hosting, database persistence, and API orchestration.United StatesSOC 2 Type II, ISO 27001 Certification & EU-US Data Privacy Framework

We do not sell, rent, license, or exchange personal data with third-party advertising brokers or data aggregators.

07.Cross-Border Data Transfers

MeshMail is headquartered in the United States and operates global infrastructure networks. If you are accessing the Services from the European Economic Area (EEA), the United Kingdom, or Switzerland, your data may be transferred to and processed in the United States.

To guarantee that your personal data receives equivalent protection, we ensure that transfers comply with Chapter V of the GDPR by utilizing the European Commission's approved Standard Contractual Clauses (SCCs) and relevant adequacy frameworks.

08.Enterprise Security Standards & Cryptography

MeshMail implements rigorous physical, organizational, and technical safeguards to prevent unauthorized data access, destruction, or disclosure:

In-Transit Encryption
All data transmitted across our web interfaces and APIs is encrypted using modern TLS 1.3 / HTTPS cryptographic protocols.
At-Rest Encryption
All stored database records, access tokens, and backups are encrypted using enterprise AES-256 cipher suites.
Access Governance
Strict role-based access controls (RBAC), multi-factor authentication (MFA), and automated credential rotation for API keys.

09.Data Retention & Permanent Deletion Lifecycle

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required to satisfy legal, accounting, and regulatory obligations:

  • Active Accounts: User account credentials, domain settings, and configurations are retained while your subscription is active.
  • Telemetry & Audit Logs: Operational delivery logs, DNS checks, and bounce telemetry are automatically purged on a rolling 90-day cycle.
  • Account Closure: Upon termination of your workspace or receipt of a verified deletion request, all personal data is permanently deleted from our active databases within thirty (30) days, except for statutory accounting and billing records retained to satisfy tax compliance laws.

10.Your Privacy Rights (GDPR & California CCPA/CPRA)

Depending on your geographic location and applicable local data privacy laws, you possess statutory rights regarding your personal information:

Right of Access & Portability: You may request copies of personal data held about you in an organized, machine-readable format.
Right to Rectification: You may correct inaccurate or incomplete data directly in your account dashboard.
Right to Erasure (“Right to be Forgotten”): You may request that we delete your personal data from our servers.
California Specific Rights: We do not sell or share personal data for cross-context behavioral advertising. You possess the right to non-discrimination for exercising your CCPA rights.

To exercise any of these rights, email our compliance team at privacy@usemeshmail.com. We respond to all verified requests within thirty (30) days.

11.Cookies & Local Storage

We use strictly necessary cookies to ensure the proper functionality of our website and dashboard. These cookies maintain your authenticated login session, preserve UI preferences, and prevent Cross-Site Request Forgery (CSRF) attacks.

We do not employ intrusive third-party cross-site behavioral tracking cookies. You may configure your browser to reject cookies, though doing so may prevent access to authenticated console features.

12.Data Protection Officer & Inquiries

MeshMail has designated a Data Protection Officer to supervise compliance with this Privacy Policy and global privacy regulations. If you have questions, complaints, or wish to execute a custom enterprise Data Processing Addendum (DPA), please contact:

MeshMail Data Protection Office

Direct inquiries regarding GDPR, CCPA, or sub-processor verifications:

privacy@usemeshmail.com
Terms of ServiceRefund Policy