Privacy Policy

This Privacy Policy explains how Alatas Software, a company registered in the Netherlands (KvK no. [KvK number], registered office at [registered address]) (“Devmailr”, “we”, “us”, or “our”), collects, uses, and protects your personal data when you use the Devmailr website, web application, and API (the “Service”). We are the data controller for that data. This policy should be read together with our Terms of Service.

1. Data We Collect

• •
  Account data: Your email address and a securely hashed (bcrypt) password. We never store your password in plain text.
• •
  Email content: Messages, including subject, sender, body, and attachments, that are delivered to the disposable mailboxes you create. This Content is stored only for your plan’s retention period and then deleted.
• •
  Technical and access data: IP addresses and timestamps associated with sign-up, login, and API key usage, kept as a security and abuse-prevention log.
• •
  Payment data: If you subscribe to a paid plan, payment is handled by Stripe. We receive billing status and subscription details, but we do not store your full card details — Stripe does.
• •
  GitHub OAuth data: If you sign in with GitHub, we receive your GitHub email address and basic profile information to create or link your account.
• •
  Usage analytics: Aggregated, privacy-conscious analytics about how the site and app are used, collected via DataFast.

2. Legal Bases (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Performance of a contract — to create and operate your account, run your mailboxes, and provide the Service.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve our product (including access logs and analytics), balanced against your rights.
• Legal obligation — to comply with applicable law, including tax and accounting requirements for payments.
• Consent — where required, for example certain analytics; you may withdraw consent at any time.

3. How We Use Your Data

We use your data to provide and maintain the Service, deliver email to your mailboxes, authenticate you, process payments, communicate with you about your account and service changes, protect against fraud and abuse, and meet our legal obligations. We do not sell your personal data, and we do not read the content of your mailboxes except as strictly necessary to operate, secure, or debug the Service, or where required by law.

4. Data Retention

• Email contentis retained for your plan’s retention period — Free: 24 hours, Indie: 7 days, Pro: no automatic expiry — and is then deleted. You can also delete mailboxes and messages manually at any time.
• Access logs (IP addresses and timestamps) are automatically deleted after 90 days.
• Account data is retained for as long as your account is active. When you delete your account, your account data, mailboxes, and associated Content are removed.
• Payment records may be retained for longer where required by tax and accounting law.

5. Sub-processors

We rely on the following trusted third-party service providers to operate the Service. Each processes personal data only on our behalf and under appropriate data protection terms:

6. International Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), including in the United States — for example, email is received and stored via AWS in the us-east-1 region. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent transfer mechanism.

7. Your Rights

Under the GDPR you have the right to access, rectify, or erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. You can exercise many of these directly in your account settings (for example, deleting mailboxes or your account), or by contacting us.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

8. Cookies

We use a strictly necessary cookie to keep you signed in (a secure, httpOnly refresh token). We also use DataFast analytics cookies to understand product usage. We do not use advertising or cross-site tracking cookies.

9. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS), hashed passwords, scoped and hashed API keys, and access controls. No method of transmission or storage is completely secure; because mailboxes are disposable, you should not use them to receive sensitive personal, financial, or confidential information.

10. Children

The Service is not directed to children. You must be at least 16 years old to use Devmailr, and we do not knowingly collect personal data from children under that age.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. For material changes we will provide reasonable notice where practicable.

12. Contact

For any privacy questions or to exercise your rights, email us at hello@devmailr.app.