Legal
Last updated: [Date]
Wildye Limited ("Wildye", "we", "us"), registered in [jurisdiction] under company number [company number] with its registered office at [registered address], is the data controller for personal data processed through Vellumail. This Privacy Policy explains what we collect, why, and the choices and rights you have.
This policy covers (a) Account holders and their staff who use the Vellumail account portal and mailboxes ("Customers"), and (b) visitors to our marketing website. If you use a Vellumail mailbox provided by your employer or organization, that organization is typically the data controller for the content of your mail, and we act as its data processor - see Section 8.
We do not sell personal data. We share data only with:
We do not have access to Content in Zero-Knowledge Mailboxes and therefore cannot disclose it to anyone, including in response to a legal request, without the Mailbox's own Keys - see our Terms and Conditions, Section 6.
[Describe where your servers/sub-processors are located and, if transferring data outside the UK/EEA, the safeguard used - e.g. adequacy decision or Standard Contractual Clauses.]
Every Mailbox is encrypted at rest (AES-256-GCM) by default. Mailboxes may additionally opt into Zero-Knowledge Mode, under which the encryption key is derived solely from the Mailbox's own password and recovery key and is never held by us - meaning we have no technical ability to access that Mailbox's Content, including to assist with password recovery. See our encryption help page and Terms for what this means for account recovery and liability if those Keys are lost. We also apply access controls, security headers, rate limiting, and account lockouts to protect the Service; no system can be guaranteed 100% secure, and you're responsible for keeping your own account credentials confidential.
We retain Account and mail data for as long as your Account is active, and for a limited period after cancellation (typically [retention period, e.g. 30 days]) to allow export or reactivation, after which it is deleted or irreversibly anonymized, except where longer retention is required for billing records or legal compliance. Server logs are retained for a shorter period (typically [log retention period, e.g. 90 days]) for security and abuse investigation.
Subject to applicable law (including UK/EU GDPR), you may have the right to: access the personal data we hold about you; request correction or deletion; object to or restrict certain processing; request a portable copy of your data; and withdraw consent where processing is based on it. Where a Vellumail mailbox is provided by your employer, some of these requests may need to go through them as the data controller. To exercise these rights, contact us at privacy@vellumail.example. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).
Vellumail is a business email service and is not directed at children. We do not knowingly collect personal data from children.
We may update this policy from time to time; material changes will be notified by email or in-portal notice before they take effect.
Questions about this policy, or to exercise your rights, can be sent to privacy@vellumail.example [replace with your real privacy contact address, and a Data Protection Officer contact if one is required for your organization].