Privacy policy.

1. Who we are

This policy is issued by the operator of the boldmail.io service, hosted in Frankfurt, Germany. For privacy requests write to hello@boldmail.io.

We have not published a company-register line (Impressum) on this site. When that entity copy is confirmed, this section will name the controller in full. Until then, hello@boldmail.io is the contact for data-protection requests.

2. What this covers

It covers:

• this marketing website (boldmail.io);
• the console (console.boldmail.io);
• the HTTP API, hosted MCP, and IMAP/SMTP access to @boldmail.io mailboxes.

It does not cover websites, models, or mail servers you connect on your side — including webhook endpoints you give us, and the inboxes of people you email.

3. Two roles

Account and service data. We are the controller for the data needed to run your account: identity, credentials, organization and inbox metadata, security logs, and delivery telemetry.

Mailbox content. Mail you and your agents send or receive is your content. You (or your organization) are the controller of that content. We process it to provide the mailbox — store it, index it, hand it to IMAP/API/MCP, and deliver outbound copies. Do not put special-category data in email unless you have your own lawful basis. Email is not a sealed channel.

4. The marketing site

This website sets no cookies and loads no analytics. The only third-party request is Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which sees your IP address and browser headers. We intend to self-host those fonts; until we do, that request still happens.

If you only read this site and never open the console or API, that is the processing.

5. Data we collect

Account

When you sign up or claim an inbox we store the email address you prove, a password hash if you set one, organization and inbox identifiers, and the @boldmail.io username. We never store the password itself.

If you sign in with Google we receive a stable Google subject identifier, email, and basic profile (name). The scope is openid email profile only. We do not request Gmail, Drive, Calendar, or any other Google API. Google tokens are used to complete sign-in and are not given to MCP clients, API keys, or mail apps.

Agent sign-up does not take an owner email. A human later opens a claim link and proves their email. Claim tokens and confirmation codes are stored as hashes, expire in minutes, and are single-use.

Mailbox and delivery

We store message content, headers, attachments (v1 maximum 10 MB), folders, flags, threads, labels, drafts, and search indexes in the EU mail store. Outbound sends create a delivery record. Amazon SES may return bounce and complaint events, which we attach to that record.

If you configure a webhook, we store the URL and a signing secret, and we POST event payloads to that URL. Whatever host you point us at becomes a recipient of those events. We do not control that host.

Credentials and sessions

API keys, MCP tokens, and mail-app passwords are shown once where required and stored as verifiers or encrypted material — not as recoverable secrets in logs or URLs. Browser sessions use cookies on the console (see Cookies). Idle session expiry is 12 hours; absolute expiry is seven days.

Operations

We keep IP addresses, user agents, timestamps, and request identifiers as needed to rate-limit, debug, and stop abuse. Platform operators can inspect account and inbox metadata and health. That role is not a mailbox-content bypass.

6. Why we process it

• Contract (Art. 6(1)(b) GDPR) — create and run the mailbox, authenticate you, deliver and receive mail, expose API/IMAP/MCP, send webhooks you configured.
• Legitimate interests (Art. 6(1)(f)) — keep the service up, prevent spam and account takeover, measure coarse operational health. You can object; see Rights.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data (for example a binding order).

We do not sell personal data. We do not run advertising profiles. We do not make automated decisions with legal or similarly significant effects beyond ordinary abuse and send-limit enforcement.

7. Who we share with

We have not published a separate subprocessors list or a DPA. The processors we actually use today:

• DigitalOcean — the FRA1 host that runs this site, the API, the console and the mail store. Frankfurt, Germany.
• Amazon Web Services (SES) — outbound internet mail is handed to SES in eu-north-1 (Stockholm) for transport, plus bounce and complaint feedback. AWS is a US company.
• Google — fonts on this marketing site; Google sign-in if you choose that button. Identity only, not mailbox access.

We also disclose data when you tell us to (a recipient of mail, a webhook URL, an IMAP client, an MCP host you connected) or when the law requires it.

If you need a data-processing agreement, write to hello@boldmail.io. We will not pretend one exists until it does.

8. Where data lives

Mailbox content is stored and processed in the EU. The public edge is Frankfurt.

That is not the same as “nothing ever leaves the EU.” Outbound messages go to their recipients, wherever those inboxes are. SES in Stockholm handles that transport. Google Fonts and Google sign-in involve Google. A webhook you point at a US URL leaves with the event. We will not claim otherwise.

Where a transfer to the United States occurs, we rely on the provider’s GDPR transfer mechanism (typically the Data Privacy Framework and/or standard contractual clauses). Ask us if you need the current details for a named processor.

9. Cookies

This marketing site: none of ours.

Console: strictly necessary cookies only — an HttpOnly session cookie, a CSRF cookie, and short-lived cookies used to bind a Google sign-in to the same browser. No analytics cookies, no advertising cookies, no consent banner for optional tracking because there is none.

Hosted MCP does not authenticate with browser cookies. It uses OAuth tokens or an API key.

10. How long we keep it

Account and mailbox data last for as long as the account is open. Delete messages, inboxes or the account through the console or API when you want them gone; we then remove them from the live store through the supported deletion paths. We do not advertise crypto-erasure.

Backups, logs and delivery records are kept only as long as needed to operate, secure and debug the service, or to meet a legal duty, then deleted or aggregated. Session cookies expire as above. Claim and email-confirmation codes expire in ten minutes.

We have not published numeric backup retention, RTO or RPO. Do not treat this policy as a recovery SLA.

11. Your rights

If GDPR applies to you, you can ask us to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent where we relied on it. You can also complain to a supervisory authority. For processing in Frankfurt that is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), or the authority where you live or work.

Write to hello@boldmail.io. We may need to verify that the request comes from the account holder. Mailbox content is primarily yours to export: IMAP is the product, and you can take messages in a standard format without asking us.

12. Children

The service is for organizations and developers. It is not directed at children under 16. If we learn we have an account for a child, we will close it.

13. Changes

We will update this page when the processing changes in a material way — a new processor, a named legal entity, self-hosted fonts, a published DPA. The date at the top is the effective date. Continued use after a change means the new text applies. If a change is significant we will also note it in the console or by email when we have an address for you.