Data controller: IT Monks Sp. z o.o., ul. Dobrego Pasterza 19A/U4, 31-416 Kraków, Poland (KRS 0000765502)
Contact: privacy@mailstrike.ai
1. Who we are
IT Monks Sp. z o.o. operates MailStrike, an email deliverability and warmup service. This policy explains what personal data we collect, how we use it, and your rights. It applies to our website, free tools, and the Service.
2. Personal data we collect
- Account details: name, email address, company name, and password.
- Mailbox connection data: OAuth tokens for Google and Microsoft; IMAP/SMTP connection details (hostname, port, username, application password).
- Email content: content of Service-generated messages and their engagement signals only. We do not store your existing business email.
- Service activity: opens, replies, link clicks, spam rescues, and reputation scores.
- Free tools input: domain names, DNS records, and template text you enter.
- Technical data: IP address, browser type, and device information.
3. How we use your data
We use personal data to create and manage your account, connect your mailbox, provide and operate the warmup Service, process payments, provide support, secure the Service and prevent abuse, understand product usage, and comply with our legal obligations.
4. Legal bases for processing (Article 6 GDPR)
- Performance of a contract (Art. 6(1)(b)): to create and manage your account, connect your mailbox, run the warmup Service, and process payments.
- Legitimate interests (Art. 6(1)(f)): to secure and improve the Service, prevent abuse and protect sending reputation, and understand product usage. Where we rely on legitimate interests, we balance them against your rights.
- Consent (Art. 6(1)(a)): where we rely on your consent, for example for certain analytics or marketing communications. You can withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): to meet accounting, tax, and other legal requirements.
5. Connected mailboxes and Google user data
For Google mailboxes, the Service uses the gmail.modify permission to send Service-generated messages and to relabel those same messages. We do not permanently delete your mail, and we do not store your existing mailbox contents. Our use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used to develop, improve, or train generalised artificial intelligence models, and is not transferred to third-party AI services. You can revoke our access at any time.
6. Sub-processors we use
We use the following third parties to process personal data on our behalf:
- Hetzner (application hosting and data processing; Germany, EU)
- Wasabi (encrypted backup storage; Germany, EU)
- Stripe (payment processing; Stripe stores card data, and we do not receive or store full card numbers)
- Twilio SendGrid (transactional and service email, for example password resets)
- OpenAI (generating warmup message content; receives sender and recipient names, company names, company description and industry, and no email addresses)
- Vercel (hosting for our marketing website only)
- Google Analytics 4 (analytics on our marketing website only)
- HubSpot (CRM for the contact and Free Deliverability Test forms on our marketing website, and, only if you accept analytics cookies, website visit analytics; EU data center)
Your product data (accounts, mailbox connections, and warmup activity) is processed and backed up in the EU (Germany). Vercel, Google Analytics and HubSpot are used only for our public marketing website, not for the product.
We may update this list as our providers change. Where you have a data processing agreement with us, we will notify the account owner by email before adding or replacing a sub-processor.
7. Data retention
We retain personal data for as long as your account is active and for a reasonable period afterwards. If you delete your account, we delete or anonymise your personal data within 30 days, except where retention is required by law.
8. International transfers
Where personal data is transferred outside the EEA, for example to a provider in the United States, we rely on Standard Contractual Clauses or other lawful transfer mechanisms, together with any supplementary measures required.
9. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (UODO). We respond to requests within 30 days. To exercise your rights, contact privacy@mailstrike.ai.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect.
11. Contact
Questions about this policy or your data can be sent to privacy@mailstrike.ai.