Privacy
Last updated:
In short
- We don't read your email, profile it for ads, or sell it
- We keep only what is needed for email to work
- No tracking cookies or third-party analytics on the site
What we keep
- Account: name, email, password as a hash (never the password itself), language
- Email: the original file of each message, its text, attachments and sender/recipient details
- Technical records: sign-in times, security events and an audit log of admin actions (for security and troubleshooting)
- Waitlist: what you enter in the form
- Notifications: for each device that turns them on, that device's push address and keys, until you turn them off or sign out
- Organisation mailboxes: the organisation's owner can download a copy of a colleague's mailbox (for example when someone leaves the team); every download is recorded in the admin audit log
Where
- Cloudflare (USA; data in Cloudflare's global network): hosting, database and file storage
- Resend (USA; email processed in the EU region, Ireland): sending and receiving email on the internet
- Brevo (France): account emails (email confirmation, password reset)
- Cloudflare Turnstile: bot checks
- Your browser's push service (Google, Apple, Mozilla or Microsoft), only if you turn on notifications: it delivers an encrypted notification it cannot read
How long
- Email until you delete it; Trash and Spam empty themselves after 30 days
- Deleted mailbox or domain: fully erased 7 days later
- Mail to an address that doesn't exist: 30 days
- Encrypted backups: 35 days
- Technical events: 30 days
- Audit log of admin actions: one year
Who is responsible
The MyMail operator, in Canada, is responsible for your data. The services listed under “Where” process it on our behalf, only to make email work.
Your rights
You can see, download, correct or delete your data. Write to support@nsut.org for any request.