MAILRAFT / PRODUCT
Privacy
This policy describes what MailRaft collects, why we collect it, how we store it, who we share it with and how you control it. It applies to the production product at https://mailraft.com and all MailRaft-operated subdomains.
Effective date: 2026-10-09. Material changes are summarized here with a dated note; the latest full technical reference lives at https://docs.mailraft.com/v1/privacy.
Who is responsible for your data
The data controller for MailRaft is Bisso Technologies Ltd, Tanzania. Contact: contact@mailraft.com. The primary regulatory anchor is the Tanzania Personal Data Protection Act 2022. Applicable privacy and email laws depend on the people and jurisdictions involved. Qualified legal review, necessary notices and consents are required before processing customer mail; this beta notice is not a certification of compliance.
What we collect
- Account data: name, email, workspace name, authentication identifiers from the identity provider you use to sign in.
- Workspace data: company settings, member roles, approvals audit, operation history.
- Integration data: provider-side identifiers and encrypted credentials for providers you explicitly connect.
- Message content: email from authorized connected mailboxes, plus drafts and approved outbound content.
- Operational metadata: IP address, user agent and session identifiers of authenticated requests, kept for security and audit.
What we do not collect
- No tracking cookies on the marketing site.
- No third-party analytics on authenticated surfaces.
- No message content from unrelated mailboxes you have not connected.
- No contact data from your device address book.
Why we collect it
- To provide the product you signed up for.
- To enforce tenant isolation, approvals and suppression.
- To respond to abuse reports and security incidents.
- To comply with legal obligations such as records of consent and bounce handling.
Where it lives
Production data is stored in a dedicated self-hosted database on infrastructure operated by Bisso Technologies Ltd. Provider credentials are encrypted at rest with per-tenant keys. API keys are stored as high-entropy hashes; the raw value is shown exactly once at creation and never recorded.
Who we share it with
- The third-party providers you explicitly connect, strictly for the scope you approved (for example, Amazon SES for outbound mail; Google Workspace readonly for inbound mailboxes).
- No advertising networks, no marketing data brokers, no cross-tenant sharing of any kind.
- Law enforcement only in response to a lawfully issued order, after legal review, with the narrowest possible scope.
Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services (SES, SNS) | Outbound email and bounce/complaint events | eu-north-1 |
| Google LLC (Workspace OAuth) | Readonly Gmail connection | Global |
| Cloudflare | DNS and TLS edge | Global |
| Bisso Technologies infrastructure | Application and database hosting | Owner-managed |
How long we keep it
- Account and workspace data: retained during the controlled beta. The account-deletion schedule and scope require confirmation with the operator before customer onboarding; automated account erasure is not available.
- Approvals and audit records: retained to meet legal and anti-abuse obligations even after an operation completes.
- Message content: the owner-triggered 30-day database cleanup clears old message body and addressing fields and expires attachments. It does not delete all copies in drafts, approvals or upstream mailboxes. There is no configurable retention schedule or automatic full-account erasure.
- Backups and upstream mailstores have separate retention and deletion procedures. Database cleanup does not erase backups. A verified retention schedule and recovery-key custody remain customer-launch gates.
International transfers
SES processing occurs in AWS Europe (Stockholm) eu-north-1. Google, Cloudflare and recipient providers may process data in other countries. Applicable transfer arrangements must be reviewed before customer onboarding; no completed safeguards assessment is claimed here.
Your rights
- Access the data we hold about you by writing to contact@mailraft.com.
- Request correction of inaccurate account or workspace data from the operator.
- Request access or an export from the operator. A self-service workspace export job is not implemented.
- Request deletion from the operator, who must confirm the applicable scope, timing, backup handling and records retained for legal or abuse prevention purposes.
- Lodge a complaint with the Tanzania Personal Information Protection Commission, or your local supervisory authority.
Security
See the Security policy at https://mailraft.com/security for the specific controls. All reported security issues are routed to contact@mailraft.com and handled by the operator; response timing is not guaranteed during beta.
Children
MailRaft is a business product and is not directed to anyone under 16. We do not knowingly collect data from children.
Contact
Written data subject requests: contact@mailraft.com. We respond within statutory deadlines; identity verification is proportional to the scope of the request.