Privacy policy
Last updated:
This policy explains which personal data [Legal entity name] (“we”) collects when you visit your-email.eu, request access, or use the console at app.your-email.eu and its API, why we collect it, how long we keep it and what your rights are.
When your organisation sends mail through the service, the personal data inside those messages (recipient addresses, subjects, bodies) is processed on your organisation's behalf under the Data processing agreement, not under this policy. Your organisation is the controller of that data; we are its processor.
Who is responsible
[Legal entity name], [Registered address], [Trade register number], VAT [VAT number], is the controller for the processing described here. Write to privacy@your-email.eu for anything concerning your personal data.
Visiting the website
your-email.eu is a static website. It sets no cookies and uses no analytics, tracking pixels or third-party scripts; the content security policy served with every page blocks them.
If you switch language, the choice is stored in your own browser (localStorage, key “yee-lang”) so the next visit opens in that language. It is never sent to us. Clearing the site's data removes it.
The website is delivered through Cloudflare's network. To serve pages and block attacks, Cloudflare processes connection data — IP address, user agent, requested URL, time — and keeps it in short-lived logs. The legal basis is our legitimate interest in running a secure and available website (Art. 6(1)(f) GDPR).
Requesting access
The request-access form asks for your work email address and a monthly volume band, and records the language of the page you used. We use this only to contact you about onboarding your organisation. There is no newsletter and the address is not added to any marketing list. The form is handled by a function running on Cloudflare's network, so Cloudflare processes the submission on our behalf before it reaches us.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If no organisation is created, we delete the request 12 months after our last exchange. If one is, the request becomes part of the organisation's records.
Using the console
When your organisation invites you to the console, we process:
- Account data: your name, email address, password (stored hashed, never readable), whether your address is verified, the organisations you belong to and your role in each.
- Tokens: when each API token issued to you was last used.
- Configuration you create: domains, senders and aliases, TLS policies, API keys and nodes. API keys, SMTP passwords and node tokens are shown once at creation and stored only as hashes.
- Correspondence: what you write to us by email.
Legal basis: performance of the contract with your organisation (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
We keep this data for as long as you are a member of an organisation. When your account or your organisation is deleted we delete it from live systems within 30 days and from backups within a further 90 days, except for what accounting or other legal obligations require us to keep.
Mail data — our role as processor
Messages, recipients, delivery events and node log lines are processed on your organisation's documented instructions. What reaches us depends on how a message is submitted; the GDPR compliance page and the Data processing agreement describe it in detail.
A recipient who has questions about a message should contact the organisation that sent it, which is the controller. We assist that organisation as its processor and do not answer such requests on our own behalf, except to forward them.
Who receives your data
We share personal data only with the providers that host or operate parts of the service, each bound by a data processing agreement:
- Cloudflare, Inc. — delivery and protection of your-email.eu, and the function that receives the request-access form.
- [Hosting provider of the console and shared nodes, EU data centres] — the console, its database and the shared sending nodes.
- [Provider of our own mailboxes] — the mailboxes we write to you from.
We do not sell personal data and do not share it with advertisers. We disclose it to authorities only where the law obliges us to.
Transfers outside the European Union
The console, its database and every shared node run in data centres inside the European Union, and no mail data is processed outside it.
The website's delivery network is operated by Cloudflare, a company headquartered in the United States. EU visitors are served from Cloudflare's European points of presence; where Cloudflare processes connection data in the United States, the transfer is covered by the EU–US Data Privacy Framework and by the standard contractual clauses in Cloudflare's data processing addendum.
Your rights
Under the GDPR you may ask us for:
- access to the personal data we hold about you, and a copy of it;
- correction of inaccurate data;
- erasure, where we no longer have a reason to keep it;
- restriction of processing while a request is examined;
- a portable copy of data you gave us;
- objection to processing based on legitimate interest.
Send requests to privacy@your-email.eu. We answer within one month. If you believe we process your data unlawfully, you can lodge a complaint with [Supervisory authority of the country of establishment], or with the supervisory authority of the EU country where you live or work.
Security
All connections to the website, the console and the API use TLS. Passwords and every credential the platform issues are stored as hashes. Access to production systems is limited to the people who operate them, and each organisation's data is isolated from every other organisation's at the application level. The Data processing agreement lists the measures in full.
Changes to this policy
We publish changes on this page and update the date at the top. Changes that affect console users are also announced by email to the administrators of each organisation before they take effect.