Who we are
Prodmail is run by HODL LABS - FZCO (licence 45659, IFZA), a company registered in the United Arab Emirates at Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. We're the data controller for the information described here. You can reach us at privacy@prodmail.io.
What we collect
Things you give us
- Account details: your username, a hash of your password (never the password itself), and the aliases and domains you add.
- Your mail: the messages you receive, send and draft, including attachments, headers and the addresses on them. This is the service; we can't run it without storing it.
- Team details: the names of teams and shared mailboxes you create, who is a member, and the access grants between them.
- Support messages: anything you write to help@prodmail.io.
Things we record while you use the service
- Sessions: for each sign-in, the device name you gave it, the IP address and approximate region it last connected from, the browser, and when. This is what Settings, Sessions shows you.
- Sign-in attempts: the username and IP address of failed attempts, kept for fifteen minutes to enforce the sign-in pause.
- Audit log: who granted, revoked, invited or removed what in a team, and when. Visible to that team's admins.
- Delivery logs: for each message we accept or send, the sender and recipient addresses, size, timestamps, and the result reported by the other mail server. Not the content.
- Server logs: request paths, status codes, timing and IP addresses, used to keep the service running and to investigate abuse.
Things we don't collect
- No advertising identifiers, no tracking pixels of our own, no third-party analytics on the webmail.
- We don't scan the content of your mail to build a profile of you. Spam filtering looks at each message on its own and keeps no record of you from it.
Why we use it
| Purpose | What's used | Legal basis |
|---|---|---|
| Delivering, storing and showing your mail | Your mail, account and team details | Performing our contract with you |
| Keeping accounts secure | Sessions, sign-in attempts, server logs | Our legitimate interest in preventing abuse |
| Filtering spam and malware | Incoming messages | Performing our contract; legitimate interest |
| Billing | Account details, invoices | Performing our contract; legal obligation |
| Answering support | Your messages to us, account details | Performing our contract |
| Telling you about outages or changes to these terms | Your primary address | Legitimate interest; legal obligation |
We never use your data for advertising, and we don't send marketing mail.
Who else sees it
- Mail servers you correspond with. When you send a message, it goes to the recipient's provider; that's how email works. Our outbound provider, [outbound provider], relays it and sees the message in transit.
- Hosting and delivery. Our servers and backups run on [hosting provider] in [region], and Cloudflare sits in front of this website and the webmail for network delivery and protection. Both process data on our instructions under a data-processing agreement.
- Payments. [payment provider] handles card details. We never see your full card number.
- Your team's admins can see the audit log and who has access to which shared mailbox. They can't read your personal mailbox.
- Authorities, only when a valid legal order compels us, and only the minimum it covers. We'll tell you unless we're legally barred from doing so, and we publish the number of requests we receive each year.
We don't sell data. We don't share it with advertisers, data brokers or anyone else not listed above.
How long we keep it
| Data | Kept for |
|---|---|
| Your mail and account | Until you delete it or close your account, then 30 days in case you change your mind, then gone |
| Backups | Rolling 30 days; deleted data ages out of backups within that window |
| Sessions | Until you end them, or 90 days after their last use |
| Failed sign-in attempts | 15 minutes |
| Delivery and server logs | 30 days |
| Audit log | For the life of the team, then 12 months |
| Invoices | As long as tax law requires, typically 7 years |
How we protect it
- Mail and attachments are encrypted at rest. Every connection to the webmail and API is over TLS, and we require TLS when talking to other mail servers wherever they support it.
- Nobody at Prodmail can open a mailbox through the product without a grant from its owner or team, and every grant is logged.
- Access to production systems is limited to the people who run them, uses hardware keys, and is logged.
- If we ever discover a breach affecting your data, we'll tell you within 72 hours of confirming it, with what happened and what we're doing about it.
Your rights
Wherever you live, you can ask us to:
- Show you what we hold about you. Most of it is already visible in the app; for the rest, email us.
- Correct anything that's wrong.
- Export your mail. Any message downloads as an
.emlfile, and we'll prepare a full archive on request. - Delete your account and everything in it.
- Object to a use based on legitimate interest, or restrict processing while we sort out a dispute.
Write to privacy@prodmail.io from your Prodmail address and we'll act within 30 days. If you're in the EEA or UK and think we've got something wrong, you can also complain to your local data-protection authority. We're based in the UAE and handle personal data in line with the UAE Personal Data Protection Law as well as the GDPR for people in Europe.
Cookies
The webmail uses one cookie, which holds your session. It's marked HttpOnly and Secure, is only sent to our own domain, and ends when you sign out or end the session. This website uses no cookies at all.
Children
Prodmail is for people aged 16 and over. If you believe a younger person has an account, tell us and we'll close it.
Changes to this policy
If we change anything that matters, we'll email your primary address at least 14 days before it takes effect and note the change at the top of this page. Minor wording fixes may be made without notice.