Data protection
GDPR and data protection at Mail.Land
Written for data protection officers: where your data is hosted, which providers process it and where, how long it is kept, and the terms that govern it.
A note on compliance
Hosting data in the EU does not by itself make a service GDPR compliant, and we do not use a compliance badge. This page sets out the facts, so that you can assess Mail.Land against your own obligations. The Data Processing Agreement and the Privacy Policy are the binding documents; if this page and those documents differ, they prevail.
Who is responsible for what
- Mail.Land is operated by VENTRYA LTD, a company registered in England and Wales.
- For the email you send through Mail.Land and the recipient data in it, you are the controller and we are your processor, under our Data Processing Agreement (Article 28 GDPR).
- For your account data, and for limited data we use to prevent abuse and protect our sending infrastructure, we are an independent controller. Our Privacy Policy describes that processing.
Where your data is hosted
The primary copy of your data is in Germany.
| What | Where |
|---|---|
| Application, API, databases, mail servers, stored inbound email and attachments, data exports, monitoring and logs | Hetzner, Germany (Nuremberg and Falkenstein) |
| Encrypted secondary backup copy | Infrastructure operated by VENTRYA LTD in Warsaw, Poland (EU) |
| Fallback sending of Mail.Land system notifications | Scaleway, France (Paris) |
| Payments and billing | Stripe, Ireland and the United States |
| DNS, web traffic proxy and DDoS protection | Cloudflare, global network |
| Link safety checks | Google Cloud Web Risk, global |
Where data can leave the EU
We do not describe Mail.Land as EU-only, because three of our sub-processors may process limited data outside the EU, including in the United States:
- Cloudflare: terminates TLS for proxied web traffic and processes web request data in transit, such as IP addresses and request metadata, and the identity and access logs of our operators, on its global network.
- Stripe: billing contact details and payment data, in Ireland and the United States.
- Google: the full addresses of links in your campaigns and of clicked tracked links, including any query parameters, so any personal data inside a link is sent too. We do not send recipient email addresses separately.
These transfers are covered by the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the EU-U.S. Data Privacy Framework (with its UK Extension), as Schedule A of the DPA sets out for each provider. VENTRYA LTD is established in the United Kingdom, which has an EU adequacy decision.
Sub-processors
The full list, with legal entities and contract references, is Schedule A of the DPA.
| Provider | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| HetznerHetzner Online GmbH | Hosting: compute, databases, mail servers, object storage, monitoring and logs | Germany (Nuremberg, Falkenstein) | None required (EU) |
| CloudflareCloudflare, Inc. | DNS, reverse proxy and DDoS protection for web traffic; access control for operator panels | Global edge network | Standard Contractual Clauses and the EU-U.S. Data Privacy Framework |
| ScalewayScaleway SAS | Fallback sending of Mail.Land system and transactional notifications | France (Paris) | None required (EU) |
| StripeStripe Payments Europe, Limited | Payment processing and billing | Ireland and the United States | Standard Contractual Clauses and the EU-U.S. Data Privacy Framework |
| GoogleGoogle LLC | Checking links for phishing, malware and unwanted software (Web Risk API) | Global (Google Cloud) | Standard Contractual Clauses and the UK Addendum; Google LLC also participates in the EU-U.S. Data Privacy Framework |
We notify the Owner and Admin users of your account by email at least 14 days before we add or replace a sub-processor. You can object on reasonable data protection grounds within 14 days (DPA Section 8).
Other providers named in our Privacy Policy
- Microsoft (Microsoft Ireland Operations Limited): Machine-translates the public incident and maintenance text of our status page (Azure AI Translator, Sweden Central). It receives no personal data, so it is not a sub-processor.
How long data is kept
From Section 7 of our Privacy Policy. Email processing data follows your plan.
| Data | Retention |
|---|---|
| Email processing data | 30 days on Free, 90 days on Pro, 180 days on Max |
| Complaint and bounce reference data (message ID and recipient address) | 60 days from sending |
| Raw analytics events | 2 years |
| Hourly aggregated analytics | 3 years |
| Daily aggregated analytics | 5 years |
| Link safety screening results | 30 days after the link was last used; 180 days if the link was flagged as unsafe |
| Account data | While the account is active, plus 30 days after deletion |
| Billing and payment records | 7 years |
| Support communications | 2 years |
The Privacy Policy lists further categories, including acceptance and sanctions screening records.
Deletion, export and data subject requests
- Your account's Owner can export the account's data as a ZIP file of JSON documents from the dashboard.
- The Owner can schedule deletion of the whole account with a grace period of 7 to 90 days, and cancel it before that date.
- When the service ends, we delete or return your personal data within 30 days of your instruction, and without an instruction we delete it, except where the law requires us to keep specific data.
- After that, Section 9.1 of the DPA allows us to keep, only for the stated purposes: encrypted backups until they are overwritten in the ordinary rotation, the suppression, complaint and bounce records needed to avoid mailing people again, and records we keep as an independent controller.
- A request from one of your recipients about their data goes to you, as controller. We help you answer it, as Section 4 of the DPA sets out.
- For your own data, write to our privacy contact. We reply within 30 days.
Open and click tracking
Open tracking is off by default for marketing and transactional email. Click tracking is on by default for marketing email and off by default for transactional email. Settings that already applied to a domain before 4 November 2026 stay as they were until you change them. You can switch tracking off for your whole account; in the EU and the UK this kind of tracking may need the recipient's consent, which you decide as controller.
Breach notification
If a personal data breach affects your data, we notify you without undue delay after becoming aware of it, as Article 33(2) of the GDPR requires. The notice goes to your designated security contact or, if none has been designated, to your account's Owner and Admin users.
The Data Processing Agreement
- The DPA covers the requirements of Article 28 GDPR and the UK GDPR. It forms part of our Terms of Service and takes effect when you accept them.
- When we publish a new version, it applies once an Owner or Admin of your account accepts it in the dashboard; until then, the previous version applies.
- If the EU adequacy decision for the United Kingdom stops applying, the Standard Contractual Clauses (Module Two) apply between you and us.
- Audits start with your written questions and our documentation; Section 4 of the DPA sets out when an audit or inspection follows.
Privacy contact
For privacy questions, data subject requests and DPA questions, write to our privacy contact. You can also complain to the UK Information Commissioner's Office or to the data protection authority in your country.
- Email:
- [email protected]
- Postal address:
- VENTRYA LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Frequently asked questions
Is Mail.Land GDPR compliant?
We do not use a compliance seal. We offer an Article 28 DPA, host the primary copy of your data in Germany, list every sub-processor with its transfer safeguard, and give you export and deletion. Whether your use is lawful also depends on your own lawful basis for sending.
Does any data leave the EU?
Yes, in limited cases: Cloudflare, Stripe and Google may process limited data outside the EU, under the safeguards listed above. The primary copy of your data stays in Germany.
Do you sell personal data?
No. We do not sell personal data to third parties.
How will we hear about a new sub-processor?
By email to your account's Owner and Admin users, at least 14 days in advance, with the provider, the processing and its location.
Need something for your assessment?
Write to our privacy contact, or read the DPA and its sub-processor list.