Privacy Policy

At Mailofly, your privacy is our top priority. This Privacy Policy explains how we collect, use, and protect your information when you use our website, dashboard, APIs, SMTP relay, campaign tools, and related services (collectively, the "Service").

Mailofly is operated by REDEVS (teamredevs.com). By using the Service, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use Mailofly.

We collect only the information necessary to provide and improve our services, such as your name, email address, and usage data. If you connect a Google account, we receive your primary Google Account email address (via Google Sign-In / OAuth) to identify your connection and show which account is linked. We do not collect unnecessary personal information beyond what you provide or authorize.

Depending on how you use Mailofly, we may also collect:

• Account data: email address, display name, authentication identifiers, workspace and organization membership, role, and profile preferences.
• Billing data: subscription plan, payment status, and transaction references processed by our payment partners (we do not store full payment card numbers on our servers).
• Email operations data: sending domains, DNS verification records, API keys (stored in hashed or encrypted form where applicable), mail logs, delivery events, templates, campaigns, contact lists, and message content you compose or send through the Service.
• Technical data: IP address, browser type, device information, pages viewed, and diagnostic logs used for security, abuse prevention, and product improvement.
• Support communications: messages you send to our support team and related metadata.

When you choose to connect Google, Mailofly requests access only to the OAuth scopes required for our product: to read your primary email address for account identification, and to send email on your behalf through the Gmail API when you explicitly initiate or schedule sends from Mailofly.

• We use Gmail access solely to provide user-facing Mailofly features you explicitly request (for example, sending messages you compose or campaigns you configure to opted-in recipients). We do not use Gmail data for advertising, and we do not sell Google user data.
• We request the minimum Gmail scope needed to send mail (specifically https://www.googleapis.com/auth/gmail.send); we do not ask for broader access to read, search, or modify your inbox.
• No Email Warming for Google Accounts: In strict compliance with Google's Gmail API User Data Policy, Mailofly does not provide email warming services or automated warmup routines for Google accounts, @gmail.com addresses, or Google Workspace accounts. Any domain reputation or warming guidance provided for other email protocols (such as dedicated SMTP or custom domain servers) is strictly excluded from Google user accounts.
• Limited Use & AI Non-Training Commitment: In accordance with the Google Workspace API User Data and Developer Policy, Google Workspace user data—including raw, aggregated, anonymized, or derived data—is never used, transferred, or sold to create, train, or improve foundational, generalized, or personalized machine learning (ML) or artificial intelligence (AI) models.
• You can revoke Mailofly's access anytime in your Google Account third-party app permissions, and you can disconnect Google from your Mailofly account in app settings at any time.

Mailofly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Mailofly provides optional generative productivity tools, such as AI-assisted email template drafting and documentation support chat, powered through third-party AI gateways and providers (including OpenRouter).

• Zero Training on User Data: Mailofly interfaces with AI service providers exclusively via commercial API tiers that adhere to zero data retention and strictly prohibit using API inputs or outputs to train, retrain, or improve foundational or generalized machine learning models.
• Complete Isolation of Google Workspace Data: Google user authentication tokens, connected mailbox credentials, and email transmission data are entirely segregated from our AI features and are never transferred to or processed by third-party AI models.
• User-Initiated Processing Only: Third-party AI requests are triggered strictly on-demand when a user explicitly initiates an AI action (such as requesting a template suggestion). The payload contains only the immediate prompt text provided by the user for that specific task.

• To provide and operate our services
• To send email via your connected Google account when you use Mailofly to compose or send messages
• To deliver transactional and campaign email through our API, SMTP, and connected providers
• To authenticate users, prevent fraud, and enforce acceptable use
• To process subscriptions, invoices, and billing events
• To communicate with you about updates, security alerts, or support
• To improve our features, reliability, and user experience
• To comply with legal obligations and respond to lawful requests

We implement industry-standard security measures to protect your data from unauthorized access, alteration, or disclosure. Your information is stored securely and is accessible only to authorized personnel and subprocessors bound by confidentiality obligations. No method of transmission or storage is 100% secure; we continuously work to maintain appropriate safeguards for an email infrastructure platform.

We do not sell your personal data. We share information only as described below and solely to operate the Service:

• Service providers: hosting, database, email delivery, analytics, error monitoring, payment processing, and customer support tools that process data on our behalf under contractual safeguards.
• Email delivery partners: when you send mail, message metadata and content pass through delivery infrastructure (for example AWS SES or connected mailbox providers) necessary to complete delivery.
• Legal requirements: when required by law, court order, or to protect rights, safety, and integrity of Mailofly and our users.
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to continued protection of your data.

Your information remains used exclusively for the purposes described in this policy.

You have the right to permanently delete your account and associated personal data from Mailofly at any time. Account deletion will remove your user profile, linked workspace data where applicable, and personal account information from our active systems, subject to retention described below.

To request deletion, you can:

• Log in to your account at mailofly.com and navigate to Settings → Delete Account.
• Or email us directly at support@mailofly.com from your registered email address with the subject line "Account Deletion Request".

Once we verify your request, your account and related data will be permanently deleted within 7–14 business days. Some data may be retained for a limited time if required by law, billing reconciliation, or fraud prevention.

We use cookies and similar technologies to keep you signed in, remember preferences, measure product usage, and protect the Service. These may include essential cookies (required for authentication and security) and analytics cookies (to understand how features are used).

You can control cookies through your browser settings. Disabling essential cookies may limit your ability to use certain parts of the dashboard. Where required by law, we will obtain consent before placing non-essential cookies.

Paid plans and add-ons are processed through our third-party payment provider Dodo Payments. Dodo Payments collects payment method details directly; Mailofly receives confirmation of payment status, subscription identifiers, and billing metadata needed to provision your plan.

For billing questions or refund requests, see our Refund Policy or contact support@mailofly.com.

When you upload contacts, create templates, or send email through Mailofly, you act as the data controller for recipient personal data. Mailofly strictly enforces permission-based sending: users may only contact recipients who have explicitly consented and opted in to receive commercial communications.

• Mandatory Opt-In Consent: Sending unsolicited commercial mail, cold outreach, or unverified purchased/scraped lists is strictly prohibited under our terms and policies.
• Mandatory Unsubscribe & Suppression: Mailofly enforces clear, automated unsubscribe mechanisms on outbound mailings and automatically syncs bounces, spam complaints, and opt-outs into organization and global suppression lists to prevent unwanted sends.
• Google Sender Guidelines Compliance: Senders utilizing Mailofly must comply with the Google Email sender guidelines, maintaining low spam complaint rates (below 0.10%) and authenticating sending domains (SPF, DKIM, and DMARC).

We process recipient email addresses, message content, and delivery events solely to provide the Service on your instructions. We immediately suspend or terminate accounts that violate our acceptable use standards or generate excessive spam reports.

We rely on trusted infrastructure partners to run Mailofly, including providers for:

• Cloud hosting and database (for example Supabase)
• Email delivery (for example Amazon SES and connected mailbox APIs)
• Authentication (for example Google and GitHub OAuth via Supabase Auth)
• Payments (Dodo Payments)
• Analytics, monitoring, and error reporting

These partners may process personal data only to perform services for Mailofly and are contractually required to protect it. A current list of subprocessors may be provided on request by contacting support@mailofly.com.

Mailofly may process and store information in countries other than where you live, including countries that may have different data protection laws. Where required, we implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms to protect personal data transferred internationally.

If you are in the European Economic Area, United Kingdom, or a region with similar laws, we process personal data on these bases:

• Contract: to provide the Service you signed up for
• Legitimate interests: security, fraud prevention, product improvement, and support
• Consent: where you opt in (for example marketing emails from Mailofly or non-essential cookies)
• Legal obligation: tax, accounting, and regulatory compliance

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (see Account Deletion above)
• Restrict or object to certain processing
• Export your data in a portable format where technically feasible
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local data protection authority

To exercise these rights, contact support@mailofly.com. We may need to verify your identity before fulfilling a request.

California residents may have additional rights under the CCPA/CPRA, including the right to know, delete, and opt out of certain sharing. Mailofly does not sell personal information as defined by California law.

We retain personal data for as long as your account is active or as needed to provide the Service. Mail logs, billing records, and security logs may be kept for a limited period after deletion where required for legal, accounting, or abuse-prevention purposes.

When data is no longer required, we delete or anonymize it in accordance with our retention schedules and applicable law.

Mailofly is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us and we will take steps to delete it.

You agree to use Mailofly in strict compliance with applicable anti-spam laws (including CAN-SPAM, CASL, GDPR) and the Appropriate access to and use of Google Gmail APIs policy.

Mailofly is intended solely for permission-based customer relationship management, opt-in newsletter delivery, and transactional notifications. Sending unsolicited commercial email (spam or unconsented cold prospecting) is strictly forbidden. We monitor delivery rates, bounce rates, and spam complaints, and we proactively terminate any accounts that distribute unsolicited bulk email.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If we make significant changes, we will notify you via email or through our platform. We encourage you to review this page periodically for the latest information. Continued use of the Service after an update constitutes acceptance of the revised policy where permitted by law.

If you have any questions or concerns about this Privacy Policy or your data, please contact us at support@mailofly.com.