Privacy
Privacy policy.
What we collect, why, who handles it, how long we keep it, and what you can do about it. Version 1.0, last updated 13 November 2026. Mailtruss is in developer preview.
Who we are and what this covers
Mailtruss is operated from India. In this policy “Mailtruss”, “we” and “us” mean the operator, and the “Service” means our website, dashboard, API and related tools at mailtruss.com.
This policy covers two groups of people. Customers create an account and use Mailtruss to send email. Recipients are the people our customers send email to, and the people who are in our customers’ contact lists.
Our role differs between them. For a customer’s own account, billing and usage data we are the Data Fiduciary (under India’s Digital Personal Data Protection Act, 2023, the “DPDP Act”) and the controller (under the EU and UK GDPR). For the email content, contacts and recipient data that a customer sends through Mailtruss, the customer decides what is collected and why, and we are only their Data Processor (DPDP Act) or processor (GDPR), acting on their instructions under our Data Processing Addendum. If you received an email sent through Mailtruss, the sender is the right first contact about it.
This policy is written to meet the requirements of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and to follow the DPDP Act as its provisions come into force. It also describes the information the GDPR requires us to give to people in the European Economic Area and the United Kingdom.
The personal data we collect
| Category | What | From whom and why |
|---|---|---|
| Account data | Name, email address, a salted hash of your password, sign-in sessions, the organization(s) you belong to and your role, invitations | Customers. To create and secure your account and give you access. |
| Sending data | Messages you ask us to send (sender, recipients, subject, body, attachments, headers, tags), your contacts and their tags, segments, broadcasts and templates | Customers, and through them recipients. To deliver the email and show you what happened. We process this as your processor. |
| Delivery data | Delivery, bounce, complaint and delay events, the response from the receiving mail server, suppression lists | Generated while delivering. To show delivery status, protect sender reputation and avoid repeat bounces. |
| Technical and security data | IP address, user agent, request logs (path, status, timing, and request and response bodies with secrets removed and large bodies shortened), audit log of changes in your organization, API key identifiers (never the key itself) | Customers. To operate, secure and debug the Service, enforce limits and investigate abuse. |
| Billing data | Plan, subscription status, invoices. Card details are entered with, and held by, our payment processor, never by us | Customers, once paid plans are available. |
| Support data | What you write to us and our replies | Anyone who contacts us. |
| Website analytics | Page views of our public pages, pseudonymous, only if you accept analytics (see “Cookies”) | Visitors who consent. |
We do not track opens or clicks. We do not add tracking pixels to your email and we do not rewrite your links. We do not run advertising or marketing trackers, and we do not use email content to profile anyone or to train any model.
Mailtruss is not designed to receive sensitive personal data such as health, financial account or government identifier numbers. Customers are responsible for not sending such data in email unless they have a lawful basis and appropriate safeguards.
Why we use it, and the basis for doing so
- To provide the Service you asked for: authenticate you, deliver your email, show delivery results, enforce plan limits, send service messages (verification, password reset, invitations, security notices). Basis: your consent given when you create the account, and the performance of our contract with you.
- To keep the Service secure and fair: detect abuse, protect sender reputation, prevent fraud, investigate incidents. Basis: legitimate use and our legitimate interests (GDPR), and our duty to maintain reasonable security under Indian law.
- To comply with law: respond to lawful orders and keep records the law requires. Basis: legal obligation.
- To improve the product: counting visits to public pages (only with your consent) and a few anonymous product milestones such as “an organization was created”. These carry no email address, name or message content. Basis: consent for the cookie-based analytics, legitimate interests for anonymous counts.
We do not sell personal data and we do not use it for any purpose incompatible with those above. You may withdraw consent at any time; withdrawing does not affect what we already did lawfully, and may mean we can no longer provide the Service.
Who we share it with
We share personal data only with the service providers that run Mailtruss, and only what each needs. Categories are listed on our sub-processors page:
- an email delivery infrastructure provider (United States), which carries messages to receiving mail servers and reports delivery events;
- a cloud hosting and edge network provider, which runs the website, API and background jobs and stores attachments;
- a managed database provider (United States), which stores the data described above;
- our payment processor and merchant of record (Dodo Payments), once paid plans are available;
- a product analytics provider (PostHog, European Union hosting), only with your consent.
We also disclose personal data where we are required to by a court, a government authority or law enforcement acting under Indian law, or where it is needed to protect the rights, property or safety of Mailtruss, our customers or others. Where the law allows, we tell the affected customer first. If Mailtruss is merged with or acquired by another business, the data may transfer to it, and we will tell you and respect this policy. Providers act under written contracts that limit their use of the data and require appropriate security.
Where your data is processed
We operate from India. Our providers process data in the United States and, for analytics, the European Union. By using the Service you understand that your data will be transferred to and processed in those countries. The DPDP Act permits transfers outside India except to countries the Government of India restricts by notification; we do not use providers in any restricted country. For customers in the EEA and UK, the Data Processing Addendum incorporates the Standard Contractual Clauses (and the UK Addendum) for the transfer of personal data to us.
How long we keep it
Mailtruss is in developer preview and does not yet delete data automatically. We are building retention limits, and this page will change when they exist. Until then:
- Messages, delivery events, logs and contacts stay in your organization until you delete them or ask us to. You can delete contacts, templates and domains yourself in the dashboard.
- When an owner deletes an organization in Settings, it is marked deleted and its access and sending stop at once. The data is not erased at that moment: we erase it, permanently, when you ask (see “Your rights”), and in any case within 30 days of a verified written request.
- Account data is kept while your account exists. We erase it within 30 days of a verified request, except what we must keep by law.
- Security and access logs, and records we need for accounting, tax or to defend a legal claim, are kept for as long as the law requires, which for certain logs is at least one year, and then erased.
- Backups made by our database provider roll off on the provider’s own schedule, after which deleted data no longer exists in them. We do not restore deleted data from a backup into the live Service.
Security
We use reasonable security practices proportionate to the data: API keys are shown once and stored only as one-way hashes, passwords are salted and hashed, webhook signing secrets are encrypted, traffic is encrypted in transit, every query is scoped to the organization it belongs to, access is limited by role and sensitive values are removed from logs. The security page describes these controls and, as importantly, what we do not claim: Mailtruss has no third-party security audit or compliance certification yet.
If a personal data breach affects you we will notify the affected customers without undue delay, and in any case within 72 hours of becoming aware where it affects personal data they control, and we will notify the Data Protection Board of India and affected people as the DPDP Act and its Rules require. Report a vulnerability to security@mailtruss.com.
Cookies and similar technologies
We use cookies and local storage only for the purposes below. We do not use advertising or cross-site tracking cookies.
| Name | Purpose | Kept | Type |
|---|---|---|---|
better-auth.session_token | Keeps you signed in | Until you sign out, or up to 7 days | Essential |
ms_org | Remembers which organization you are working in | 1 year | Essential |
ms_project | Remembers the project filter you chose | 1 year | Essential |
ms_nav | Remembers whether the sidebar is collapsed | 1 year | Preference |
theme | Remembers light or dark mode (local storage) | Until cleared | Preference |
mt_consent | Remembers your cookie choice (local storage) | Until cleared | Essential |
ph_* | Pseudonymous visit counting by PostHog on our public pages. Off unless you press “Accept all”. | 1 year | Analytics (consent) |
Analytics runs only on our public pages (home, documentation, changelog, security and legal pages), never inside the dashboard and never on the sign-in pages. It does not record sessions or what you type, it does not build profiles of individuals, it goes through our own domain, and it stays off if your browser sends “Do Not Track”. Choose “Essential only” to keep it off, and use “Cookie settings” in the footer to change your mind at any time; doing so deletes what analytics stored in your browser.
Your rights
Under the DPDP Act, as a Data Principal you may: obtain a summary of the personal data we hold and how we process it; ask us to correct, complete or update it; ask us to erase it; withdraw consent; have your grievance addressed; and nominate another person to exercise these rights if you die or become incapacitated.
Under the GDPR and UK GDPR, you may also ask for a copy of your data in a portable format, restrict or object to processing, and lodge a complaint with your supervisory authority.
To use any of these, write to privacy@mailtruss.com from the email address on the account (or tell us which address it concerns). We will confirm your identity, because we must not hand data to the wrong person, and we will reply within 30 days. Customers can do much of this themselves in the dashboard. If your request concerns email that a customer sent you, the customer is responsible for it; we will pass your request on or act on the customer’s instruction, and we will tell you which.
If a customer turns on open or click tracking for a sending domain, we record when a message is opened or a link is clicked (time and browser user agent) and show it to that customer. Tracking is off unless the customer enables it, and the customer is responsible for telling its recipients. Links in tracked messages go through a Mailtruss address before reaching the destination.
Recipients can use the unsubscribe link in any marketing email sent through Mailtruss to stop that sender’s marketing mail. This stops marketing broadcasts. It does not stop messages a customer sends because of your own actions, such as receipts and password resets.
Children
Mailtruss is a business tool for adults. The DPDP Act treats anyone under 18 as a child, and we do not knowingly process the personal data of children. You must be at least 18 to create an account. If you believe a child has an account, tell us at privacy@mailtruss.com and we will delete it.
Grievance Officer and complaints
As required by the Information Technology Act and the DPDP Act, our Grievance Officer is the Grievance Officer of Mailtruss. Write to grievance@mailtruss.com.
We will acknowledge your complaint within 3 working days and resolve it within 30 days. If you are not satisfied you may complain to the Data Protection Board of India once it is constituted and operating, and, if you are in the EEA or UK, to your supervisory authority.
Changes to this policy
We will update this page when our practices change, change the date and version below, and for material changes tell account owners by email before the change takes effect. Earlier versions are available on request.
Questions about privacy: privacy@mailtruss.com. All other questions: hello@mailtruss.com.