Privacy Policy
DRAFT — legal review required. This is a structural scaffold. Replace every placeholder with reviewed, accurate content before relying on it.
1. Who we are
Heaven Mail is an email service operated by TODO — legal entity ("we", "us"). You can contact us about privacy at privacy@heaven-mail.com.
2. What data we collect
- Account data — email address, chosen mailbox name, domain, password (stored hashed).
- Mail content — the emails in your mailboxes, stored encrypted at rest.
- Technical data — IP address, user agent, and timestamps for security and abuse prevention.
- Billing data — TODO — describe payment processor & what they hold.
3. How we use it
To provide the mail service, authenticate you, prevent abuse and spam, process payments, and meet legal obligations. We do not scan the content of your mail for advertising, and we do not sell your data.
4. Legal basis (GDPR)
Contract performance (providing your mailbox), legitimate interests (security, abuse prevention), legal obligation, and consent where applicable. TODO — confirm per processing activity.
5. Where your data is stored
In data centres within the EU (Germany). Storage and backups are encrypted at rest and geographically separated within the EU. We do not replicate mail outside the EU.
6. Retention
TODO — state retention periods for account data, mail, logs and backups, and deletion on account closure.
7. Sharing & sub-processors
TODO — list sub-processors (hosting, payment, email infrastructure) and link a sub-processor list.
8. Your rights
You may access, correct, export (via mbox), or delete your data, restrict or object to processing, and lodge a complaint with a supervisory authority. To exercise these, contact privacy@heaven-mail.com.
9. Cookies
TODO — describe cookies/local storage used by the site and webmail app.
10. Changes to this policy
We will post changes here and, for material changes, notify account holders by email.