1. Introduction

VENTRYA LTD, a company incorporated in England and Wales under company number 16505638, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, trading as Mail.Land ("MailLand," "we," "us," or "our") operates the Mail.Land email delivery platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Service, visit our website, or interact with us in any capacity.

MailLand serves two distinct roles with respect to personal data processing, and it is important to understand the difference:

Data Controller: When we collect and process personal data about our account holders, website visitors, and prospective customers, MailLand acts as the data controller. This means we determine the purposes and means of processing that data, and this Privacy Policy governs how we handle it.
Data Processor: When our customers use the Service to send emails, MailLand processes email recipient data (such as recipient email addresses and message content) on behalf of our customers. In this capacity, MailLand acts as a data processor. Our customers are the data controllers of their end-user data, and our processing of that data is governed by our Data Processing Agreement (DPA).

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

We collect information in several categories depending on how you interact with our Service. The type and amount of information collected varies based on your use of the platform.

2.1 Account Data

When you create an account or use the Service, we collect information that you provide directly to us, including:

Full name and email address
Company name and business details
Billing address and invoicing information
Payment information (credit card details are processed and stored securely by our payment processor, Stripe, and are never stored on our servers)
Phone number (when provided for account verification or support)

2.2 Usage Data

We automatically collect certain information about how you access and use the Service, including:

Log data such as your IP address, browser type and version, device information, and operating system
Feature usage patterns, including which parts of the dashboard you access and how frequently
API call logs, including timestamps, endpoints accessed, and response codes
Email sending statistics, such as volumes, delivery rates, and engagement metrics at the account level

2.3 Email Processing Data

When our customers use the Service to send emails, we process the following data on their behalf as a data processor:

Recipient email addresses
Message metadata, including subject lines, timestamps, and sender information
Delivery status information such as delivered, bounced, or deferred
Engagement events, including email opens and link clicks, when tracking is enabled by the customer

This data is processed solely on behalf of our customers and in accordance with their instructions. Our customers are responsible for ensuring they have an appropriate legal basis for sending emails to their recipients and for providing their own privacy disclosures. Please refer to our Data Processing Agreement for details on how we handle this data.

3. How We Use Your Information

We use the information we collect as data controller for the following purposes:

Service Delivery and Operation: To provide, maintain, and operate the Service, including email sending, delivery optimization, analytics, and technical support.
Account Management: To create and manage your account, authenticate your identity, and provide customer support.
Billing and Payments: To process payments, manage subscriptions, send invoices, and handle billing-related inquiries.
Platform Improvement and Analytics: To analyze usage patterns, diagnose technical issues, and improve the functionality, performance, and reliability of the Service.
Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, abuse, and security threats, including enforcing our Acceptable Use Policy.
Communications: To send you service-related notifications (such as maintenance updates, security alerts, and account notifications) and, with your consent, marketing communications about new features and product updates. You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us.
Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Performance of a Contract (Article 6(1)(b)): Processing is necessary for the performance of our contract with you, including providing the Service, managing your account, processing payments, and delivering email on your behalf.
Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate interests, provided those interests are not overridden by your rights. Our legitimate interests include maintaining the security and integrity of the Service, preventing fraud and abuse, improving our platform and user experience, and conducting internal analytics.
Consent (Article 6(1)(a)): Where we rely on your consent, such as for sending marketing emails or placing non-essential cookies. You may withdraw your consent at any time without affecting the lawfulness of processing that occurred before withdrawal.
Legal Obligation (Article 6(1)(c)): Processing is necessary to comply with legal obligations to which we are subject, including tax record-keeping requirements, responding to valid legal processes, and cooperating with law enforcement where required by law.

We do not sell your personal data to third parties. We share your information only in the limited circumstances described below:

5.1 Sub-processors and Service Providers

We engage trusted third-party service providers to assist in operating and improving the Service. These sub-processors process data on our behalf and are contractually bound to protect your information. They include:

Infrastructure Providers: Cloud hosting, content delivery networks (CDNs), and data storage services that power our platform.
Payment Processors: Stripe processes all payment transactions. Your payment card details are handled directly by Stripe and are subject to Stripe's Privacy Policy.
Analytics Providers: Services that help us understand how users interact with our platform, used in aggregate to improve the Service.
Email Verification Services: Third-party verification tools used to validate email addresses as part of our email validation feature.
Status Page Translation: Microsoft (Azure AI Translator) machine-translates only the public incident and maintenance text of our status page. It receives no personal data.

5.2 Law Enforcement and Legal Requests

We may disclose your information if required to do so by law or in response to valid legal process, such as a court order, subpoena, or government request. We will make commercially reasonable efforts to notify you of such requests unless prohibited by law or court order.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you via email or prominent notice on our website of any change in ownership or use of your personal data, as well as any choices you may have regarding your data.

6. International Data Transfers

MailLand is operated by VENTRYA LTD, a company registered in England and Wales, and your information is primarily processed and stored on servers in the European Union (Germany, Hetzner), with encrypted backup copies in Poland (EU) on Ventrya-operated infrastructure. Some sub-processors (Cloudflare for network delivery and Stripe for payments) may process limited data outside the EU under the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

For users located in the European Economic Area (EEA) or the United Kingdom (UK), we ensure that any transfer of personal data to countries outside the EEA or UK that have not received an adequacy decision is protected by appropriate safeguards, including:

Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses as the primary mechanism for transferring personal data to third countries, including the United States.
Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission or the UK government recognizing certain countries as providing an adequate level of data protection.

For detailed information about the specific transfer mechanisms and safeguards we employ, please refer to our Data Processing Agreement.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods are as follows:

Data Category	Retention Period
Account data	Duration of active account plus 30 days after account deletion
Billing and payment records	7 years (as required for tax and legal compliance)
Raw analytics events	2 years
Hourly aggregated analytics (linked to your account)	3 years
Daily aggregated analytics (linked to your account)	5 years
Email processing data	For the retention period of your plan: 30 days on Free, 90 days on Pro and 180 days on Max. This category excludes the analytics events and aggregated data listed above, which follow their own retention periods.
Complaint and bounce reference data (message ID and recipient address)	60 days from sending, used only to honour complaints and bounces that arrive after your plan's retention period.
Support communications	2 years

When data reaches the end of its retention period, it is securely deleted or anonymized so that it can no longer be associated with you. Aggregated analytics data remains linked to your account for its full retention period and is deleted — never anonymized or retained indefinitely — when your account is deleted. The retention period for email processing data is set by your plan, not by a setting in your account, and it applies to email processing data only, not to analytics events or aggregated data.

8. Your Rights

Depending on your location and applicable law, you may have certain rights regarding your personal data. We are committed to honoring these rights and facilitating your ability to exercise them.

8.1 Rights Under the GDPR (EEA and UK Residents)

If you are located in the EEA or UK, you have the following rights under the GDPR:

Right of Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may request that we correct any inaccurate or incomplete personal data.
Right to Erasure: You may request that we delete your personal data, subject to certain exceptions (such as data we are required to retain by law).
Right to Restriction of Processing: You may request that we restrict the processing of your personal data under certain circumstances.
Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format.
Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

8.2 Rights Under the CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
Right to Delete: You may request that we delete the personal information we have collected about you, subject to certain exceptions.
Right to Opt-Out of Sale: We do not sell personal information. As such, there is no need to opt out. However, should our practices ever change, we will provide a clear mechanism for you to exercise this right.
Right to Non-Discrimination: You will not receive discriminatory treatment for exercising any of your CCPA rights.

8.3 Exercising Your Rights

To exercise any of the rights described above, please contact us at [email protected]. We will respond to your request within 30 days. In certain cases, we may need to verify your identity before processing your request. If we are unable to fulfill your request, we will provide you with an explanation.

If your request relates to data that MailLand processes on behalf of one of our customers (as a data processor), we will direct you to the relevant customer, as they are the data controller responsible for responding to your request.

9. Children's Privacy

The Service is designed for businesses and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that information from our systems.

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at [email protected] so that we can take appropriate action.

10. Security Measures

We take the security of your data seriously and implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in Transit: All data transmitted between your browser or application and our servers is encrypted using TLS 1.2 or higher.
Backup Encryption: Off-site backup repositories containing Customer Personal Data are protected using client-side encryption. Encryption key material is controlled by VENTRYA LTD and is not stored with the backup storage provider.
Access Controls: Mail.Land application and administrative interfaces use role- and permission-based authorization. Infrastructure access is separately limited to authorized operators.
Automated Security Scanning: Software dependencies are checked through automated CI security scanning, including configured failure gates for high- and critical-severity findings.
Incident Response: We maintain a documented incident response plan to ensure timely detection, containment, and notification in the event of a data breach.
Employee Training: All employees with access to personal data receive regular security awareness training covering data protection best practices and threat recognition.

While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents in accordance with applicable law.

11. Status Page (status.mail.land)

Mail.Land operates a public status page at status.mail.land, where anyone can see the current state of the Service and subscribe to updates. VENTRYA LTD is the data controller for subscriber data, as for the rest of this Privacy Policy.

11.1 Data We Collect When You Subscribe

When you subscribe to status updates, we collect:

Your email address or, for a webhook subscription, the webhook URL
The language you chose
The timestamps of your confirmation and, if applicable, your unsubscription

Subscriptions use double opt-in: until you confirm your address, we send nothing except the confirmation email. Every update email contains a one-click unsubscribe link and a List-Unsubscribe header. These emails contain no tracking pixels and no link tracking.

11.2 Legal Basis and Retention

We process subscriber data on the basis of your consent (Article 6(1)(a) GDPR), which is your subscription. You may withdraw your consent at any time by unsubscribing, without affecting the lawfulness of processing carried out before withdrawal. Retention periods:

Sign-ups that are never confirmed are deleted after 7 days.
Addresses that have unsubscribed are purged 30 days after unsubscribing.

11.3 Service Providers for the Status Page

The status page uses the following service providers:

Cloudflare: Hosts the status page, its database and the subscriber list (Cloudflare Workers, D1 with a Western Europe location hint, and R2 in the EU jurisdiction). Cloudflare Turnstile protects the subscribe form against automated sign-ups.
Scaleway SAS: Its Transactional Email service (Paris, fr-par) sends the confirmation and update emails.
Microsoft Ireland Operations Limited (Microsoft): Azure AI Translator (resource in Sweden Central) machine-translates the public incident and maintenance text written by MailLand staff. It never receives subscriber data.

11.4 Cookies and Local Storage

The status page sets no cookies. It stores two functional keys in your browser's local storage, which are listed in our Cookie and Local Storage Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable laws. When we make changes, we will update the "Last updated" date at the top of this page.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide at least 30 days' prior notice through one or more of the following methods: an email to the address associated with your account, a prominent notification within the Service dashboard, or a banner on our website.

Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue your use of the Service before the changes take effect.

13. Contact Us

For privacy questions and data-subject requests, contact our Privacy Contact at [email protected].

VENTRYA LTD, trading as Mail.Land
Email: [email protected]
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

If you are located in the European Economic Area and believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with your local supervisory authority. You can find the contact details of your national data protection authority on the European Data Protection Board website. We encourage you to contact us first so that we can address your concerns directly.

Privacy Policy