boldmail ← back to website

boldmail.io / Legal

Privacy policy.

What we collect, why, who sees it, and how to reach us. Written for the service that exists today — not for a subprocessors page we have not published.

Updated 17 October 2026 · Frankfurt, Germany · Also see Terms

1. Who we are

This policy is issued by the operator of the boldmail.io service, hosted in Frankfurt, Germany. For privacy requests write to hello@boldmail.io.

We have not published a company-register line (Impressum) on this site. When that entity copy is confirmed, this section will name the controller in full. Until then, hello@boldmail.io is the contact for data-protection requests.

2. What this covers

It covers:

It does not cover websites, models, or mail servers you connect on your side — including webhook endpoints you give us, and the inboxes of people you email.

3. Two roles

Account and service data. We are the controller for the data needed to run your account: identity, credentials, organization and inbox metadata, security logs, and delivery telemetry.

Mailbox content. Mail you and your agents send or receive is your content. You (or your organization) are the controller of that content. We process it to provide the mailbox — store it, index it, hand it to IMAP/API/MCP, and deliver outbound copies. Do not put special-category data in email unless you have your own lawful basis. Email is not a sealed channel.

4. The marketing site

This website uses our HumbleMetrics installation at humblemetrics.com to measure visits and signup clicks. The tracking script sends the public page URL and title, referring page, screen size, browser language, and campaign labels. Requests also include your IP address and browser headers. A random identifier is kept in this browser tab’s session storage to connect the visit with a console signup; the marketing site sets no analytics cookies. Session recordings and heatmaps are disabled.

The site also loads Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which sees your IP address and browser headers. We intend to self-host those fonts; until we do, that request still happens.

5. Data we collect

Account

When you sign up or claim an inbox we store the email address you prove, a password hash if you set one, organization and inbox identifiers, and the @boldmail.io username. We never store the password itself.

If you sign in with Google we receive a stable Google subject identifier, email, and basic profile (name). The scope is openid email profile only. We do not request Gmail, Drive, Calendar, or any other Google API. Google tokens are used to complete sign-in and are not given to MCP clients, API keys, or mail apps.

Agent sign-up does not take an owner email. A human later opens a claim link and proves their email. Claim tokens and confirmation codes are stored as hashes, expire in minutes, and are single-use.

Mailbox and delivery

We store message content, headers, attachments (v1 maximum 10 MB), folders, flags, threads, labels, drafts, and search indexes in the EU mail store. Outbound sends create a delivery record. Amazon SES may return bounce and complaint events, which we attach to that record.

If you configure a webhook, we store the URL and a signing secret, and we POST event payloads to that URL. Whatever host you point us at becomes a recipient of those events. We do not control that host.

Credentials and sessions

API keys, MCP tokens, and mail-app passwords are shown once where required and stored as verifiers or encrypted material — not as recoverable secrets in logs or URLs. Browser sessions use cookies on the console (see Cookies). Idle session expiry is 12 hours; absolute expiry is seven days.

Operations

We keep IP addresses, user agents, timestamps, and request identifiers as needed to rate-limit, debug, and stop abuse. Platform operators can inspect account and inbox metadata and health. That role is not a mailbox-content bypass.

6. Why we process it

We do not sell personal data. We do not run advertising profiles. We do not make automated decisions with legal or similarly significant effects beyond ordinary abuse and send-limit enforcement.

7. Who we share with

We have not published a separate subprocessors list or a DPA. The processors we actually use today:

We also disclose data when you tell us to (a recipient of mail, a webhook URL, an IMAP client, an MCP host you connected) or when the law requires it.

If you need a data-processing agreement, write to hello@boldmail.io. We will not pretend one exists until it does.

8. Where data lives

Mailbox content is stored and processed in the EU. The public edge is Frankfurt.

That is not the same as “nothing ever leaves the EU.” Outbound messages go to their recipients, wherever those inboxes are. SES in Stockholm handles that transport. Google Fonts and Google sign-in involve Google. A webhook you point at a US URL leaves with the event. We will not claim otherwise.

Where a transfer to the United States occurs, we rely on the provider’s GDPR transfer mechanism (typically the Data Privacy Framework and/or standard contractual clauses). Ask us if you need the current details for a named processor.

9. Cookies

This marketing site: none of ours.

Console: an HttpOnly session cookie, a CSRF cookie, and short-lived cookies bind authentication to the same browser. When you arrive through a marketing link, a separate HttpOnly acquisition cookie keeps the anonymous visit identifier and campaign labels for 30 minutes. Backend analytics records successful registration and login, first mailbox readiness, and first successful mail use with an anonymous identifier. Email addresses, passwords, tokens, message subjects, message content, and attachments are not sent to analytics. There are no advertising cookies.

Hosted MCP does not authenticate with browser cookies. It uses OAuth tokens or an API key.

10. How long we keep it

Account and mailbox data last for as long as the account is open. Delete messages, inboxes or the account through the console or API when you want them gone; we then remove them from the live store through the supported deletion paths. We do not advertise crypto-erasure.

Backups, logs and delivery records are kept only as long as needed to operate, secure and debug the service, or to meet a legal duty, then deleted or aggregated. Session cookies expire as above. Claim and email-confirmation codes expire in ten minutes.

We have not published numeric backup retention, RTO or RPO. Do not treat this policy as a recovery SLA.

11. Your rights

If GDPR applies to you, you can ask us to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent where we relied on it. You can also complain to a supervisory authority. For processing in Frankfurt that is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), or the authority where you live or work.

Write to hello@boldmail.io. We may need to verify that the request comes from the account holder. Mailbox content is primarily yours to export: IMAP is the product, and you can take messages in a standard format without asking us.

12. Children

The service is for organizations and developers. It is not directed at children under 16. If we learn we have an account for a child, we will close it.

13. Changes

We will update this page when the processing changes in a material way — a new processor, a named legal entity, self-hosted fonts, a published DPA. The date at the top is the effective date. Continued use after a change means the new text applies. If a change is significant we will also note it in the console or by email when we have an address for you.