Privacy policy

1. Who is responsible for your data

MAXKEN, located at Bureau 3, 34 place du Général de Gaulle, 59800 Lille, France, is the controller for data used to manage the mailcontact website, accounts, billing, support, waitlist and service security. Contact Show email address for privacy questions. Our company details are in the legal notice.

For messages received in a customer’s project inbox, the customer determines the purpose of collection and is normally the controller. MAXKEN processes that content on the customer’s behalf to receive, store and deliver messages and configured notifications.

The data processing agreement governs this processing for customers subject to data protection law. When an agency acts for a client, that client may be the controller and the agency its processor; the agency must have authority to appoint MAXKEN and configure recipients.

If you submitted a form or emailed a project address, contact the organisation behind that project first about its use of your message. Its privacy notice applies to that use. We can help identify and relay a request to the relevant account owner without disclosing other users’ information.

2. Data we handle

• Account information: name, email address, profile image when supplied, password hash for password accounts, verification status, plan, account role and creation dates. Passwords are not stored as readable text. Google sign-in, when available and chosen, supplies an account identifier and profile information such as your name, email and image; we do not receive your Google password.
• Billing: selected offer, Stripe customer, subscription and checkout references, payment status and message-pack receipts. Stripe collects checkout details such as your name, email, billing address, tax ID and payment information. mailcontact does not receive or store your full card number.
• Contract evidence: the document version and immutable copy, agreement date, signup method, purchase reference, Stripe terms acceptance and express request for immediate activation. A withdrawal request records your identity, purchase, declaration and submission time, with an email acknowledgement.
• Authentication: session identifiers, expiry dates, IP addresses and browser information, verification and password-reset records.
• Project inboxes and replies: project names, form identifiers, project email addresses, sender and recipient details, subjects, incoming messages and outgoing replies, message identifiers used to group conversations, dates, read status and reply-delivery status. Content comes from account holders, form visitors and email senders.
• Notifications: destination addresses or webhook URLs, delivery status, attempts, timestamps and error summaries. Destinations receive sender details and message content when enabled.
• Shared inboxes: invitation email addresses, inviter, recipient, access role, acceptance dates and membership records. Accepted members can access inbox content within their role, including earlier conversations.
• AI assistant connections: client identifiers, authorised permissions, connection and token records, API-key hashes, expiry and usage information. Assistants receive the conversation data returned by the tools they are authorised to call and can send replies only with that permission.
• Contact and waitlist: your email address, any name you provide, your message and technical information handled by the form provider.
• Security and operation: request metadata, rate-limit counters, usage totals, email deduplication records and an audit trail of administrative changes to accounts.
• Email abuse prevention: local rules identify repeated authentication emails using subjects, content and automation headers. Account-scoped signals retain sender domains, classification flags and timestamps. Suspicious messages may be held separately, with content accessible only to authorised administrators for review. Review and suspension decisions are audited with their reason, without copying message contents into the audit trail.
• Public-page analytics: page views, outgoing-link clicks and configured interactions, with browser, device and request information processed by the analytics service.
• Registration provenance: UTM source, medium, campaign, content and term present when you reach an account form, the form path, available referring website domain and capture date. These details are attached when an account is created for registration and activation reporting. We do not retain full referring URLs, unrelated query parameters or a browsing history. This account attribution is not sent to OpenPanel.
• Optional 30-day attribution: if you accept, a cookie remembers an acquisition source for up to 30 days. It can supply the source of a later registration when no provenance is available on the account form.

Account fields are required to create and secure your workspace. A contact email lets us reply, and a waitlist email lets us send the launch notice you request. Optional form fields and notification destinations are your choice. Avoid sending data that is not needed for the purpose of your message.

3. Purposes and legal bases

• Providing your account and service: performing our agreement with you, including authentication, inbox operation and service emails. Where you act for an organisation, account administration also serves our legitimate interest in providing its service.
• Billing and taxes: performing your purchase agreement, managing subscriptions and payment issues, and meeting accounting and tax obligations.
• Answering enquiries: steps requested before an agreement, or our legitimate interest in responding to support and other correspondence.
• Waitlist updates: your consent when you request launch news. You can withdraw by contacting us; joining the waitlist does not subscribe you to unrelated marketing.
• Security and abuse prevention: our legitimate interests in protecting accounts, preventing spam and keeping the service available.
• Audience measurement: understanding public-page use and improving the website. Where applicable, this relies on our legitimate interest in measuring our audience; any operation requiring consent must have a separate consent basis.
• Registration provenance: understanding which campaign links and referring websites lead to registrations and account activation. You can object or request removal by contacting Show email address.
• Remembering a source for 30 days: your optional consent. Declining prevents this extended memorisation; it does not remove campaign tags already present in a current registration link.
• Legal requests and claims: compliance with applicable obligations and, where relevant, our legitimate interest in establishing or defending legal claims.

The customer chooses the legal basis for collecting messages through their own projects. We do not sell personal data, use inbox content for advertising or train AI models on it. Connected assistant providers follow their own settings and policies. Accepting service terms does not itself give consent to optional tracking or marketing.

4. Recipients and service providers

Data is accessible to the account owner, accepted members of shared inboxes within their role, authorised personnel who need it to operate or support the service, and providers involved in the relevant feature. We may also disclose information where a valid legal obligation requires it.

• OVHcloud: hosting for the application and database, and the operator’s mail infrastructure. OVHcloud data protection information.
• Cloudflare: DNS, HTTPS proxying and CDN delivery for mailcontact.app involve visitor IP addresses, request metadata and data transmitted to the application, including form submissions and inbox requests. Public scripts and static assets can be cached; APIs and private pages bypass shared caching. Email Routing also receives and forwards incoming messages sent to project addresses on mailcontact.cc to our mail infrastructure, involving message contents and routing metadata. Cloudflare serves DNS and redirects for that domain too. Cloudflare privacy policy.
• Postal, hosted on OVHcloud: our mail service receives forwarded project emails and delivers account verification, password resets, enabled email notifications and replies sent from project inboxes. It processes sender and recipient addresses, email contents, conversation identifiers and delivery information.
• Scaleway: off-site storage of encrypted Postal backups, including mail data present in those backups. Scaleway privacy information.
• Stripe: Checkout, Billing, Tax and the customer portal process payment and billing information to complete purchases, manage subscriptions and invoices, calculate taxes and help prevent fraud. Stripe acts as controller or processor depending on the activity. Stripe privacy policy.
• Formspree: processing of previous waitlist requests. The contact form uses mailcontact itself. Formspree privacy policy.
• Google, if you choose Google sign-in: authenticates your Google account and provides the profile data needed for the connection. Google applies its own privacy policy. This sign-in connection does not grant MailContact access to your Gmail messages or Drive files.
• OpenPanel, self-hosted by the operator: audience measurement on public marketing pages, through openpanel.superposed.io and tools-openpanel.superposed.io. This is our own analytics deployment, rather than the hosted OpenPanel service. It is not loaded by the account or inbox layouts.
• Destinations you enable: Discord, Slack and custom webhook services receive notification data. People with access to those channels may be able to read it. These services may act under their own terms and are not all processors appointed by MAXKEN.
• Assistants you connect: services such as ChatGPT, Claude or another MCP client receive the data you authorise them to retrieve. Their provider, account settings and privacy terms determine subsequent processing, including retention and any use to improve their services. MAXKEN does not operate those assistants or set their data-use policies.

Only enable integrations appropriate for the data you collect. Removing a destination or deleting an inbox does not recall messages already delivered to another service.

5. International processing

Hosting the main application with a European provider does not mean every operation takes place in Europe. Cloudflare, Stripe, Google, Formspree, connected assistants and notification services can process data internationally, including outside the European Economic Area.

Transfers subject to the GDPR require an applicable adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses, together with any necessary additional measures. The provider links above describe their arrangements. Contact Show email address to request information or a copy of the safeguards applicable to processing on our behalf. For a destination you configure yourself, also check your agreement with that provider.

6. Cookies, preferences and analytics

Authentication cookies maintain your signed-in session. Sessions are valid for seven days and may be renewed while you use the service. Signing out revokes the current session. Blocking these essential cookies can prevent sign-in from working.

Browser preferences, such as the selected colour theme, may be stored on your device until you change them or clear the site’s browser data.

Current registration links: campaign tags are carried in links between public pages until you reach an account form. This transmission does not use cookies, localStorage, sessionStorage or a visitor identifier. When you choose Google sign-in, provenance is held in the server-side authentication state for up to ten minutes, then consumed by the callback. Essential authentication cookies remain separate. Provenance may be unavailable when a browser omits the referring website or a link does not carry campaign tags.

Optional 30-day cookie: only after you choose Accept, a signed, first-party cookie remembers the first available source for up to 30 days without extending that period on each page visit. At registration, current form provenance takes priority; the remembered source is used only when current provenance is unavailable. A separate preference cookie remembers Accept or Decline for 180 days. Decline deletes the 30-day cookie and stops extended memorisation. When you are signed in, it also removes any account attribution supplied by that remembered source; current form provenance is separate. If you previously registered and are signed out, sign in and choose Decline again or contact us to remove remembered attribution.

Change 30-day attribution preferences

OpenPanel analytics is self-hosted and cookieless. We use it for anonymous audience statistics on public marketing pages: page views, outgoing-link clicks, browser and device categories, and configured interactions. We do not identify visitors by their MailContact account or send names, email addresses or inbox content to analytics. Account screens and private inboxes do not load the script.

OpenPanel can process the request IP address and browser information transiently to derive a daily rotating visitor identifier. This is distinct from a tracking cookie or a permanent account identifier. Our audience measurement is for the operator’s own website statistics, not advertising or cross-site tracking. Contact Show email address to object or ask about this processing. Essential sign-in cookies are separate from analytics.

7. Retention and deletion

• Account and inbox data: account and project data is retained to provide the service until deletion is requested or the relevant data is deleted. Free messages expire 30 days after receipt. Pro and Plus have no automatic message expiry while paid access is active. When paid access ends, existing message history is preserved for 30 days after the effective end date; after that, messages older than 30 days and their linked replies are eligible for deletion by the worker’s hourly cleanup. Resubscribing before deletion stops this expiry. You can delete individual messages and projects at any time; contact us for account deletion.
• Registration provenance: information attached at signup remains with the account until you request its removal or delete the account. Attribution supplied by the optional remembered source is also removed if you withdraw that consent while signed in. Only authorised administrators can view acquisition reporting. The optional browser cookie expires after 30 days.
• Billing records: retained to manage your purchases and subscriptions, then as required for applicable accounting, tax and claims obligations. Closing your account does not automatically erase records that must be kept by law. Stripe applies its own retention requirements to information it controls.
• Agreements and withdrawals: signup evidence remains with your account. Purchase and withdrawal evidence is kept for applicable accounting duties and the establishment or defence of claims. Contract archives without customer data remain available by version. Confirmation emails and acknowledgement records are kept to document the contract and receipt of requests.
• Notifications: app delivery records linked to a message are removed with that message; records linked to a destination are removed with that destination. Copies held by recipients follow their own retention rules.
• Email deduplication: a delivery fingerprint remains until its project is deleted, even after the original message is deleted, to prevent an email retry from recreating it. Usage totals remain with the workspace and do not contain message bodies.
• Email abuse signals and quarantine: records are eligible for deletion after 30 days and are removed by the worker’s hourly cleanup. Releasing or discarding an email immediately removes its quarantine payload; a released email follows normal inbox retention. Signals survive individual project deletion to prevent quota circumvention, and are deleted with the account. Deduplication fingerprints remain for the project’s lifetime so a retry cannot recreate a discarded or expired message.
• Sessions and verification: sessions expire after seven days unless renewed, and email-verification links expire after one hour. Expiry stops the credential from working; it does not mean every associated database record is immediately erased.
• AI authorisations: OAuth access tokens last one hour and refresh tokens up to 30 days, with rotation and a valid account session required. Disconnecting removes the connection’s consent and tokens. API keys expire after the period you select and can be revoked earlier. Expiry or disconnection stops new access; it does not erase content already held by your assistant or recall a reply already queued.
• Mail transport: Postal is configured to retain raw email content for seven days and message metadata for 30 days. These transport records are separate from project inboxes and backups.
• Public-endpoint abuse counters: IP-based identifiers are keyed hashes rather than raw addresses. Expired counters are eligible for cleanup after 24 hours. This does not describe separate authentication records or hosting logs.
• Waitlist: used for the launch notification you requested and removed when that purpose ends or you withdraw consent, subject to any record needed to honour your request.
• Support, security and administrative records: retained for handling the request, investigating incidents and demonstrating account changes; longer retention is limited to an applicable legal obligation or the establishment or defence of a claim.
• Backups: backup copies can remain for up to two years under the operator’s backup policy. Deleting a message from the active service does not immediately remove it from existing backups. Backup access must be restricted to recovery and applicable legal obligations; backups are not a way to recover expired inbox history on request.

Hosting logs and self-hosted analytics have their own retention settings. Contact us for the periods applicable to your request. Information retained for a legal obligation or dispute is restricted to that purpose. Content already copied to a notification destination, shared member or assistant follows the recipient’s own retention arrangements.

8. Security

Measures include password hashing, email verification, authenticated workspace access, server-side access controls, request limits and checks on notification destinations. Administrative access is restricted. HTTPS protects communications with the public service.

Messages must be readable by the service to display them and send the notifications you request; mailcontact is not an end-to-end encrypted mailbox. No system can guarantee absolute security. Keep your account credentials private and report a suspected incident to Show email address.

9. Your privacy rights

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. French law also provides for instructions concerning personal data after death.

Send a request to Show email address or our registered office. Specify the account or project concerned and the right you want to exercise. We may request proportionate information to verify your identity where there is reasonable doubt; do not send an identity document unless needed and requested.

We normally respond within one month. For a complex request, the period may be extended by up to two further months; we will explain the extension within the first month. Requests concerning a customer’s inbox may need to be handled by that customer, with our assistance.

You can lodge a complaint with the French data protection authority (CNIL) or your local competent supervisory authority. We do not use personal data for solely automated decisions producing legal or similarly significant effects. Technical spam and quota controls can reject requests; contact us if you believe they are blocking legitimate use.

10. Policy updates

We will update this document when our processing changes and revise the date above. Significant changes will be communicated by an appropriate means. A new purpose requiring consent will require a separate choice; publishing an updated policy is not consent.