Privacy policy

The short version

We collect the minimum needed to run your mailbox and bill you. We do not read your mail to profile you, we do not sell your data, we do not run advertising trackers, and we do not train AI models on your content. You can sign up without giving us your legal name or phone number.

Who is responsible

EB Holdings, trading as MailToYou, is the data controller for personal data processed through mailtoyou.org. Contact: privacy@mailtoyou.org.

What we collect

Account data

A contact email address, the plan you bought, and your billing history. If you choose to give us a name it may be a pseudonym. We do not require a phone number.

Payment data

Card payments are processed by Stripe, which handles your card details directly under its own privacy policy; we receive only a payment confirmation and limited metadata such as the last four digits and card country. Cryptocurrency payments are processed by our payment provider; we receive confirmation of payment. We never hold full card numbers.

Your mail and files

We store the mail and files you keep with us so we can deliver the service. This content is yours. We access it only where strictly necessary — investigating a fault you have reported, responding to an abuse report, or complying with valid legal process.

Technical logs

Mail servers necessarily log connection and delivery metadata: timestamps, IP addresses, sender and recipient addresses, message sizes and delivery outcomes. We use these to deliver mail, diagnose faults, and detect abuse and compromised accounts. Logs are retained for 30 days and then deleted.

What we do not do

• We do not scan your mail to build advertising or interest profiles.
• We do not sell, rent or share your personal data with data brokers or advertisers.
• We do not use your mail or files to train machine learning models.
• We do not embed third-party advertising or analytics trackers in webmail.
• We do not require identity documents, and we do not run identity verification checks.

Why we are allowed to process it (GDPR)

For customers in the UK and EEA: we process account and content data to perform our contract with you; billing records to meet our legal obligations; and security and abuse-prevention logs under our legitimate interests in keeping the platform safe and deliverable for all users.

Who we share it with

We share data only with the providers needed to run the service, each bound to protect it:

• Our upstream email infrastructure provider, which operates the mail platform and datacenters on our behalf.
• Stripe and our cryptocurrency payment processor, for payments.
• SpamExperts filtering, which processes inbound mail to remove spam, viruses and phishing.
• Professional advisers or authorities where legally required.

Where your data lives

Your mail and files are stored on our infrastructure and on that of the upstream providers we use to deliver the service. Hosting locations may change as the service evolves. If you are resident in the UK or EEA and your data is transferred outside that area, the transfer is made under appropriate safeguards such as Standard Contractual Clauses.

How long we keep it

Mail and files are kept while your account is active. After termination we retain data for a limited wind-down period before permanent deletion, so you have a chance to export. Billing records are kept as long as tax and accounting law requires, typically 6–7 years.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your data, and to receive a copy in a portable format. Your mail is portable by default — it is standard IMAP, so any mail client can download all of it.

Email privacy@mailtoyou.org to exercise these rights. We respond within one month. If you are in the UK or EEA and unhappy with our response, you may complain to your local supervisory authority.

Security

Connections are encrypted in transit with TLS. We support two-factor authentication and per-application passwords. Access to production systems is restricted to staff who need it. Backups are encrypted and stored offsite. Our backups protect against infrastructure failure; they are not a personal archiving service, and you remain responsible for keeping your own copies of data you cannot afford to lose.

We do not offer zero-access encryption — meaning that, as with any standard IMAP host, mail is stored in a form we could technically access. We choose not to, and we limit who can. If your threat model requires that we be technically incapable of reading your mail, use a provider built for that; see our comparison page, where we say so plainly.

Cookies

Our marketing site uses no tracking or advertising cookies. Webmail uses strictly necessary cookies to keep you signed in.

Children

The service is not directed at children under 16. We do not knowingly collect their data.

Changes

We will post updates here and notify account holders by email of material changes.