Contents
Contents
§1Who we are#
Mailomia is operated by IKL CONSULTING, a French simplified joint-stock company (SAS) registered with the Marseille Trade and Companies Register under number 983 375 643, with its registered office at 16 allée Sacoman, 13016 Marseille, France. For the data described in this policy, we are the data controller. You can reach us about your data at contact@mailomia.com.
§2What this policy covers#
This policy explains how we handle the personal data of:
- visitors to our website, mailomia.com;
- our customers and the people who use their Mailomia account.
It does not cover the contact lists our customers manage in Mailomia. For that data, the customer is the controller and we act as their processor, under the Data Processing Agreement in our Terms of Service.
§3If you received an email sent with Mailomia#
Emails sent with Mailomia come from our customers, not from us. The sender decides why and how your data is used. To unsubscribe, use the link at the bottom of the email. To access or delete your data, contact the sender directly. If you cannot reach them, write to us and we will forward your request.
§4Data we collect#
When you visit our website
Our web server records technical data in its logs, such as your IP address, the page requested, the date and your browser type.
We also use Google Analytics on mailomia.com to measure its audience: pages visited, how you arrived (search engine, link, social network), your approximate location (country, city), your device and browser, and how long you stay. Google Analytics sets cookies for this purpose (see section 9). We use no advertising tools on the website.
When you create and use an account
- Account details: first and last name, email address, password (stored only as a one-way hash), language and time zone. Optionally, your phone number, birth date and company details (name, address, VAT number) if you enter them.
- Google sign-in: if you use "Continue with Google", we receive from Google your Google account identifier, email address, name, and whether Google has verified the email address. We do not receive your Google password, and we do not access any other Google data.
- Billing: Stripe handles payments. We receive your Stripe customer identifier, plan, subscription status and invoice details. Your card details go to Stripe and never reach our servers.
- Amazon SES connection: the access role identifier or access keys you provide to connect your AWS account, your sending domains and the sending statistics Amazon returns.
- Usage and security data: IP address and browser information at sign-in, session records, failed login attempts, and a log of actions in your account, such as creating a list or sending a campaign.
- Messages you send us: the content of your support requests and emails.
§5Why we use it#
| Purpose | Legal basis |
|---|---|
| Creating your account, providing the service, sending service emails (account confirmation, password reset, quota and sending notices) | Performance of our contract with you |
| Billing, invoicing and tax compliance | Performance of the contract and legal obligations |
| Securing the service: preventing fraud, abuse and spam, limiting login attempts, investigating incidents | Our legitimate interest in keeping the service and its users safe |
| Answering your questions and support requests | Performance of the contract, or our legitimate interest when you are not a customer |
| Improving the service using aggregate usage information | Our legitimate interest |
| Measuring the audience of our website with Google Analytics | Our legitimate interest in understanding how visitors find and use our website |
We do not sell your data, and we do not use it for advertising.
§6Who we share it with#
Only our team members who need it can access your data. We also rely on these providers:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of our servers and databases | Germany, EU |
| Stripe Payments Europe, Ltd. | Payments, invoicing and tax calculation | Ireland, EU, with transfers to the United States |
| Amazon Web Services EMEA SARL | Delivery of our service emails (confirmation, password reset, notices) | Amazon Web Services data centers |
| Google Ireland Limited | Sign-in with Google, only if you use it; audience measurement of our website (Google Analytics) | Ireland, EU, with transfers to the United States |
We may also disclose data when the law requires it, or to protect our rights, for example in the event of a dispute or fraud. If our business is sold or merged, your data may transfer to the new owner, who will remain bound by this policy.
§7Transfers outside the EU#
We host your data in the European Union. Stripe and Google (including Google Analytics) may transfer some data to the United States. These transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
§8How long we keep it#
| Data | Retention |
|---|---|
| Account data | As long as your account is open, then 30 days after it is closed |
| Invoices and accounting records | 10 years, as French law requires |
| Security logs, session records and action log | 12 months |
| Failed login attempts | Up to 1 hour |
| Website server logs | 30 days |
| Website audience data (Google Analytics) | 14 months |
| Support conversations | 3 years after our last exchange |
§9Cookies and local storage#
On our website, we use Google Analytics cookies to measure our audience. In the app, we use only what the service needs to work. We use no advertising cookies.
| Name | Where | Purpose | Duration |
|---|---|---|---|
mm_ui_rt (cookie) | app.mailomia.com | Keeps you signed in. Secure, not readable by scripts. | 30 days |
mm_google_oauth (cookie) | app.mailomia.com | Protects the Google sign-in against forgery | 10 minutes |
_ga, _ga_CDX8ZM56Z4 (cookies) | mailomia.com | Google Analytics: distinguish visitors and their sessions to measure the audience | Up to 13 months |
mm_lang (local storage) | Website and app | Remembers your language | Until you clear it |
mm_theme, mm_onboarding_dismissed (local storage) | app.mailomia.com | Remembers your display settings and dismissed tips | Until you clear it |
Emails our customers send with Mailomia may contain open and click tracking. That tracking is set up by the sender and is covered by the sender's own privacy policy.
§10Security#
We protect your data with encryption in transit, hashed passwords, short-lived sessions, login rate limiting, restricted access to our servers, and regular backups. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
§11Your rights#
Under the GDPR, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. You can also give instructions about what happens to your data after your death.
You can correct most of your data yourself in the application, under My account. For anything else, write to contact@mailomia.com. We answer within one month. We may ask you to prove your identity.
If you believe we have not respected your rights, you can file a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority in your country.
Mailomia is not intended for children under 16, and we do not knowingly collect their data.
§12Changes#
We may update this policy. The date at the top shows the latest version. If a change is significant, we tell you by email or in the application before it takes effect.