Privacy Policy

Effective date: July 27, 2026

MailInApp ("MailInApp," "we," "us," or "our") is operated by Digitload, with a registered office at 330 Bay Street, Toronto, ON M5H 2S8, Canada. This Policy explains what personal information we collect through mailinapp.com and the MailInApp application (together, the "Services"), why we collect it, and the choices available to you.

1. Two roles: Customers and Recipients

MailInApp is a platform that lets a business or individual (a "Customer") build and send interactive emails to the Customer's own audience (each person who receives, opens, or interacts with those emails, a "Recipient"). This distinction matters for privacy law:

For Account Data (how a Customer signs up, configures, and pays for the Services), Digitload is the data controller.
For Content and Recipient Data (the contact lists, form responses, poll votes, purchase records, and similar personal data a Customer uploads or a Recipient generates by interacting with a Customer's campaign), Digitload acts as a data processor / service provider on the Customer's instructions. If you are a Recipient and want to know why you received an email, correct your details, or be removed from a list, the Customer who sent it — not Digitload — controls that list and is the right first point of contact. Section 7 below explains the tools we give Customers (and you) to do this directly.

2. Information we collect

2.1 Account and team information

Name, email address, and password (via Firebase Authentication) or Google sign-in profile data when you create an account; role (owner, editor, or viewer) and invited email address when a Customer adds a team member; support and ticket messages you send us directly.

2.2 Plan and billing information

Your subscription tier (Free, Starter, Lite, Pro, or Business). MailInApp does not currently operate self-serve billing and does not collect or store payment card data for your own subscription.

2.3 Content you create

Your studio project designs (layouts, copy, images, theme choices), variables, and templates; rows in any data source you connect, including any contact list you upload or sync (which may itself contain personal data about your Recipients, such as names, email addresses, and custom fields you choose to store); connection details for any external API data source you link (credentials for such connections are stored encrypted/hashed and never displayed again after creation).

2.4 Recipient interaction data

When a Recipient opens or interacts with a campaign you send, we process, on your behalf: poll votes, quiz answers and scores, ratings, form and survey submissions, scratch-off reveals, RSVP responses, spin-to-win outcomes, product orders (including shipping address for physical goods), support-ticket replies, and clicks on links or buttons. We also record best-effort, approximate open events (a tracking pixel) and scroll-depth milestones on hosted pages — these under- or over-count due to how mailbox providers pre-fetch images, and should never be treated as precise. Where a Recipient interacts anonymously (for example, from an exported HTML file with no personalized link), we log the originating IP address only to apply a rate limit against abuse, not to identify the person.

2.5 Credentials you configure

If you choose to send natively rather than exporting HTML, we store the credentials needed to do so: your outbound SMTP relay password, or your own domain's verification records for our email-sending infrastructure. If you connect an external email account to the Mailbox feature (Section 2.6), we store the credentials needed to sync and, where enabled, send from it: an encrypted OAuth refresh token for Gmail, or your encrypted IMAP/SMTP username and password (or app password) for Outlook, Yahoo, and other providers. If you connect product checkout, we store your Stripe Connect account link (Stripe holds the actual payment and card data — see Section 6). API keys and webhook signing secrets you generate are shown to you once and stored thereafter only in hashed or masked form.

2.6 Connected email accounts / native inbox (opt-in feature)

If a Recipient (or Customer) chooses to connect an email account — Gmail via Google OAuth, or Outlook, Yahoo, or another provider via IMAP — to read, search, organize, and send mail natively in the Mailbox experience at /dashboard/mailbox, we store: the credentials described in Section 2.5; message metadata (subject, sender/recipient, timestamps, folder, read/starred state) across every synced folder (Inbox and any Sent, Drafts, Trash, Junk, or Archive folder your provider exposes); and any signature text or "from/subject contains" filter rule you configure for that account. We do not store message bodies or attachments — content and attachment files are fetched live from your provider only at the moment you open a message or download an attachment, and are never retained afterward. If you compose, reply, or forward mail from a connected account, it is sent directly through that account's own provider using your own credentials; we retain only the same metadata recorded for any other synced message, never a stored copy of the body. An optional desktop notification for new mail, if you turn it on, is a browser-level permission tracked in your browser's own local storage, not on our servers. This feature is entirely optional, connects only at the user's own initiative, and can be disconnected at any time — disconnecting immediately removes all synced metadata and stored credentials for that account. MailInApp's use of information received through Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.7 Inbound mail you receive (Mailbox feature)

If you enable inbound mail receiving on your own verified sending domain, mail sent to your claimed addresses (and to any unclaimed address at that domain, so nothing is silently dropped) is received through our infrastructure and stored as full message threads — subject, participants, message body, and any attachments — so you can read, search, reply to, and organize it at /dashboard/mailbox. Unlike the connected-account feature in Section 2.6, this is Content you control as described in Section 2.3: it's mail addressed to a domain you verified, retained until you delete it, not a third party's personal inbox. Any signature text or filter rule you configure for your domain mailbox is stored the same way.

2.8 AI writing assistance (opt-in feature)

If you use the AI subject-line or copy-suggestion tool, we send a short excerpt of your own project's existing name, purpose, and content (never your Recipients' personal data) to Google's Gemini API to generate suggestions. Suggestions are shown to you for review and are never applied automatically.

2.9 Technical and log data

Standard web server logs (IP address, browser/device type, timestamps, pages requested) for security, abuse prevention, and diagnostics; session cookies needed to keep you signed in to the dashboard and studio.

3. How we use information

We use the information above to: provide, operate, and secure the Services; render and deliver your campaigns, including determining the right fallback experience for a Recipient's email client; process interactions and route results back to you (dashboard, aggregate rollups, and any webhook you configure); enforce plan limits, rate limits, and anti-abuse controls; detect and respond to fraud (for example, automatically pausing checkout on an account after a payment dispute pending review); provide customer support; generate optional AI content suggestions; and comply with legal obligations. We do not use Recipient personal data to build advertising profiles, and we do not sell or share personal information for cross-context behavioral advertising.

4. Legal bases (EEA, UK, and other jurisdictions requiring one)

Where applicable law requires a legal basis, we rely on: performance of a contract (operating the Services you or your organization signed up for); legitimate interests (securing the Services, preventing fraud and abuse, and improving reliability), balanced against your rights; consent, where a Recipient opts in to a feature such as Gmail sync; and legal obligation, where we must retain or disclose information to comply with law.

We do not sell personal information. We share it only as follows (see mailinapp.com/subprocessors for the authoritative, dated record of every sub-processor Digitload itself engages, kept current as changes happen):

| Recipient | Purpose | Data involved | |---|---|---| | Google Cloud / Firebase | Hosting, database (Firestore), authentication, file storage | All Account and Content data | | Amazon Web Services (AWS SES / S3) | Sending emails on behalf of Customers who verify their own domain, and receiving inbound mail for Customers who enable it | Sender/recipient email addresses, message content and attachments | | Stripe, Inc. | Processing payments for products a Customer sells through their own connected Stripe account | Buyer payment details (held by Stripe, not us), order metadata | | Google Gemini API | Generating optional AI subject-line/copy suggestions | The Customer's own project copy excerpt (opt-in feature only) | | Google OAuth / Gmail API | Powering the optional Mailbox/native-inbox reading experience | Gmail account tokens and message metadata (opt-in, user-initiated only) | | Your connected email provider (Outlook, Yahoo, or another IMAP/SMTP server) | Syncing your inbox and, if you enable it, sending mail through your own account | Your account credentials (encrypted) and message metadata; message content and attachments are fetched live and not stored by us | | Your own configured services | Your own SMTP relay, your own webhook endpoint, your own connected Stripe account | Whatever data you configure these integrations to receive — you control and are responsible for these third parties |

We may also disclose information where required by law, to protect the rights, property, or safety of Digitload, our Customers, or the public, or in connection with a merger, acquisition, or sale of assets (with notice to affected Customers where required).

6. Payments

MailInApp itself does not currently charge Customers through an automated billing system, so we do not hold your subscription payment details. Separately, if you use the product-checkout feature to sell something to your own Recipients, those buyers' payments are processed directly by Stripe on your own Stripe Connect account — Digitload is never in the flow of funds and never sees or stores cardholder data.

7. Your rights and choices, and Recipient tools

If you are a Customer: you can access and edit most Account and Content data directly from the dashboard and studio. From Settings → Privacy & data you can also export a complete copy of your account data as a single JSON file, and permanently delete your account — including your projects, contact lists, response history, and stored credentials — through an emailed confirmation link, with no need to contact us first. Contact us at [email protected] for anything the dashboard doesn't cover.

If you are a Recipient of a Customer's email: every campaign includes a working unsubscribe link, which immediately and permanently suppresses your address from that Customer's account across all of their projects. The same hosted page includes a second form, "Correct or delete your data" — submitting it opens a private support ticket routed directly to the Customer who sent the campaign, since they control the underlying list and are the only one able to lawfully decide what correcting or erasing your row means. If you're unable to reach them that way, contact us at [email protected] and we will assist as your data processor.

Depending on where you live, you may also have the rights described below. To exercise any of them, email [email protected]; we may need to verify your identity before acting on a request.

Canada (PIPEDA): the right to access personal information we hold about you, to request correction of inaccurate information, and to withdraw consent where consent is the basis for processing.
European Economic Area, UK, and Switzerland (GDPR/UK GDPR): the rights to access, rectify, erase, restrict, or port your personal data, to object to certain processing, and to lodge a complaint with your local supervisory authority.
California (CCPA/CPRA) and similar U.S. state laws: the rights to know what personal information we collect, to delete it, to correct it, to opt out of sale or sharing (we do not sell or share personal information, so there is nothing to opt out of), to limit use of sensitive personal information, and to not be discriminated against for exercising these rights.

8. Cookies and similar technologies

The dashboard and studio use a session cookie to keep you signed in — this is strictly necessary and cannot be disabled while remaining signed in. Mailed emails themselves never contain scripts or cookies (email clients strip them, and we don't rely on JavaScript to work). Hosted pages that a Recipient reaches by clicking a link in an email (for a poll, form, live view, etc.) may include a lightweight, best-effort open-tracking pixel and scroll-depth beacon operating on behalf of the Customer who sent the campaign — these are analytics for that Customer, not third-party advertising trackers, and carry no cross-site identifier.

Our marketing site (mailinapp.com) runs Google Tag Manager, gated by FitConsent, a third-party consent management platform (CMP) that detects the cookies and similar storage our site and any tag loaded through Tag Manager use, presents a consent banner to you, and blocks non-essential storage until you've made a choice. The automatically generated, always-current list of cookies/storage in use is below:

9. Data retention

We retain Account data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or fraud-prevention obligations. Content and Recipient data (contact lists, campaign designs, interaction records, and inbound Mailbox threads and attachments on your own verified domain) are retained until you delete them or close your account, since you control that data as its owner. By contrast, message bodies and attachments from a connected external email account (Section 2.6) are never retained regardless of your account status — only synced metadata persists until you disconnect that account, at which point it too is deleted. Suppression records (unsubscribes and bounces) are retained indefinitely so that we can continue to honor them even after other data is deleted. Order and payment-adjacent metadata are retained as required for accounting and dispute-resolution purposes.

10. Security

We use industry-standard safeguards appropriate to the sensitivity of the data involved, including: encryption in transit (TLS) and at rest via our cloud infrastructure providers; short-lived, cryptographically signed tokens (domain-separated per feature, so a link minted for one purpose can't be replayed for another) instead of exposing Recipients' identities in plain URLs; hashed storage for API keys and masking of credentials such as SMTP passwords, connected-mailbox IMAP/SMTP credentials, and webhook secrets after initial creation; sandboxed rendering with a strict content-security policy for any inbox content we cannot cryptographically verify as coming from a MailInApp Customer; and rate limiting on every publicly reachable endpoint. We also keep an internal, write-only audit log of administrative actions taken on Customer accounts by Digitload staff (for example, a plan or account-status change), so those actions remain traceable after the fact. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. International data transfers

Our infrastructure providers operate data centers that may be located outside your country of residence, including in Canada and the United States. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on recognized safeguards such as Standard Contractual Clauses.

12. Children's privacy

The Services are not directed to children, and we do not knowingly collect personal information from children under 16. Where MailInApp is used to organize activities involving minors (for example, a youth sports team), our design intentionally routes communications through a parent's or guardian's own contact address rather than collecting a minor's personal data directly. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

13. Do Not Track and Global Privacy Control

Because we do not sell or share personal information for cross-context advertising, we do not currently respond differently to browser Do Not Track signals, though we honor Global Privacy Control (GPC) signals as an opt-out-of-sale/share signal in jurisdictions that require it (noting again that we do not sell or share data).

14. Third-party links

Our marketing site and documentation may link to third-party websites. We are not responsible for the privacy practices of sites we don't operate — review their own policies.

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify Customers by email or an in-app notice.

16. Contact us

Questions about this Policy, or requests regarding your personal data:

Digitload 330 Bay Street, Toronto, ON M5H 2S8, Canada Email: [email protected]