Privacy policy

01Who this policy covers

Mailbox Warm operates MailboxWarm, an email warm-up service for businesses operating globally. This policy covers our website, account services, mailbox configuration, warm-up activity, billing records, and support communications. Contact us at contact@mailboxwarm.com about this policy or your information.

We determine how account, billing, security, and support information is used to operate the service. When we handle mailbox data on a business customer’s instructions, that customer may act as the controller and Mailbox Warm as a processor. If your mailbox is managed by your employer or an agency, contact that organization about its instructions and permissions.

02Information we process

• Account information: your sign-in email address, account identifier, authentication records, and settings.
• Mailbox configuration: sending address, provider, stored mailbox metadata, timezone, sending window, starting volume, and daily limits.
• Connection information, when connections are enabled: SMTP or IMAP host, port, username and app password, or provider authorization tokens. The required credentials depend on the connection method.
• Warm-up records, when warming is enabled: generated message content, sender and seed-recipient addresses, message identifiers, timestamps, submissions, observed folders, read flags, rescues, replies, and connection errors.
• Billing information: selected plans, subscription and invoice references, amounts, payment status, and renewal history. Payment details are entered through Stripe-hosted pages, not a MailboxWarm card-entry form.
• Support and technical information: what you send us, together with operational records such as request identifiers, IP addresses, browser information, and error logs processed by the application or its hosting providers. Do not send passwords or payment-card details to support.

03How mailbox access is used

Signing in to MailboxWarm does not authorize access to your email account. A separate connection is required. When available and authorized, we use that connection to verify access and send warm-up messages from your mailbox to MailboxWarm-operated seed inboxes. Seed inboxes observe placement, mark warm-up messages read, move them from spam to the inbox, and send replies according to the service configuration.

The service is not a prospect-list uploader or campaign sender. Warm-up activity does not require importing your contacts. Mailbox providers may grant permissions broader than a single message; the integration guide and provider consent screen explain the connection method. Do not connect an account unless you are authorized to grant that access.

04Why we use information

Where applicable law requires a legal basis, the relevant basis may be performance of our agreement, legal obligations, or legitimate interests in secure and reliable service operation. Where processing requires consent, it must be obtained for that purpose and can be withdrawn. A mailbox connection is not blanket consent to unrelated marketing.

• Create and authenticate your account, enforce ownership, and maintain your session.
• Save mailbox settings, verify connections, perform authorized warm-up, and display activity and placement history.
• Administer subscriptions, reconcile payments, and respond to billing questions.
• Diagnose failures, protect accounts, prevent abuse, and respond to support requests.
• Meet applicable legal obligations and establish, exercise, or defend legal claims.

05Service providers and disclosures

Operating MailboxWarm involves infrastructure and service providers. The current architecture uses Vercel for the website and server-side sign-in routes, Hetzner for core service infrastructure, Cloudflare for domain and asset delivery services, and Stripe for hosted billing. Your email provider also processes messages and connection requests under its own terms.

Information may also need to be disclosed in response to a valid legal requirement, to address fraud or a security threat, or as part of a business transfer subject to applicable protections. The final provider inventory must identify each provider’s role and relevant processing locations; the names above are not a completed contractual subprocessor register.

06Cookies and browser storage

MailboxWarm uses cookies to maintain authenticated sessions. Refresh credentials are held in HttpOnly cookies rather than JavaScript-readable local storage. Browser storage also carries non-secret signals that keep sign-in and sign-out state consistent across tabs.

Disabling necessary cookies can prevent sign-in or interrupt account features. The current frontend does not integrate an advertising pixel or third-party marketing analytics SDK. Hosting and payment services can process their own technical information; any future optional tracking must be assessed and disclosed, with consent where required.

07Retention and deletion

Different records have different purposes: active account and mailbox records support the service, billing records support reconciliation and legal obligations, and operational records support troubleshooting and security. Backups may retain copies separately from the active database.

Disconnecting a provider, pausing warm-up, cancelling renewal, and requesting account deletion are different actions. None should be assumed to erase all historical or backup records immediately. Contact us to request deletion or an explanation of what is retained. We may need to verify your authority and retain information required by law or necessary for an unresolved dispute.

Retention periods and the operational deletion and backup-expiry procedure are still being finalized. This draft does not promise a deletion deadline or claim that an automated account-erasure workflow is already available.

08Security and international processing

Mailbox credentials are encrypted before storage, account access is authenticated, and application operations are scoped to the account owner. These controls reduce risk but cannot make a system completely secure. Keep your sign-in account secure, use provider-specific app passwords where supported, and revoke compromised credentials with your provider.

Mailbox Warm serves customers globally. Data may be processed in countries other than your own through infrastructure and email providers. Global availability is not a promise of data residency in any particular country. Processing locations and any required transfer safeguards must be confirmed before the final policy is issued.

09Your requests and choices

Depending on applicable law, you may have rights to access, correct, delete, or receive a portable copy of personal data, restrict or object to processing, withdraw consent, and complain to a relevant data protection authority. These rights can be subject to legal conditions and exceptions.

Send requests to contact@mailboxwarm.com from your account email where possible. Describe the information and action involved without including passwords. We may ask for information reasonably needed to verify identity or authority, and requests must be handled within applicable legal time limits. If we process data for another organization, we may need to refer the request to that organization.

10Audience, updates, and contact

MailboxWarm is intended for business use, not a service directed to children. Contact us if you believe a child has supplied personal information through the service.

The final policy will state an effective date. Material changes to our handling of information should be communicated through the website and, where appropriate, an account notice or email. Questions and privacy requests can be sent to contact@mailboxwarm.com.