1. Controller and Contact
MailGrab is operated by Michele Brandolin, an individual based in Italy. For account, website, security, support, and analytics data, Michele Brandolin is the data controller.
Privacy requests may be sent to [email protected] .
2. MailGrab's Role for Test Email Content
When a customer submits test emails through MailGrab, the customer determines why that content is processed. For personal data contained in those messages, MailGrab generally acts as a processor on the customer's instructions, while the customer remains the controller.
Customers must use synthetic or appropriately protected test data and must have a lawful basis before placing personal data about real people in test emails.
3. Data We Process
3.1 Account and authentication data
- Name, email address, password hash, email verification state, and account preferences
- Authentication sessions, remember tokens, trusted-device OTP cookies, and security timestamps
- For Google sign-in: Google account identifier, provider email, profile image URL, encrypted access and refresh tokens, and token expiry
3.2 SMTP sandbox and workspace data
- Inbox names, generated SMTP usernames, encrypted SMTP passwords, and password verification hashes
- SMTP envelope data, sending IP address, raw MIME source, headers, sender and recipient addresses, subject, HTML and text bodies, message size, and processing timestamps
- Parsed and searchable text derived from messages, plus technical compatibility analysis performed on email HTML when that feature is used
- Attachments and inline files, including filename, type, size, checksum, storage path, content ID, and disposition
- Team memberships, invitations, invitation email addresses, and invitation status
- Guest links, protection settings, expiry dates, and last-access timestamps
3.3 Billing data
If paid subscriptions are enabled, Paddle acts as Merchant of Record and handles payment details, invoicing, and tax. MailGrab may receive customer and transaction identifiers, subscription status, plan, billing events, and invoice metadata. MailGrab does not receive or store complete card details.
3.4 Technical, support, and analytics data
- IP address, browser and device information, requested URLs, timestamps, and rate-limit signals
- Application, queue, security, and error logs, which may include technical identifiers and request context
- Support messages and any information you choose to provide when contacting us
- With consent on public pages only, Google Analytics usage data and Microsoft Clarity interaction and session analytics
4. Purposes and Legal Bases
| Purpose | GDPR legal basis |
|---|---|
| Create accounts, authenticate users, and provide the service | Contract performance |
| Process test emails, attachments, search, previews, and compatibility results | Contract performance and customer instructions |
| Send verification, OTP, reset, invitation, billing, and account notices | Contract performance and legitimate interests |
| Prevent abuse, secure systems, diagnose faults, and enforce limits | Legitimate interests and legal obligations |
| Administer subscriptions and maintain legally required records | Contract performance and legal obligations |
| Run Google Analytics and Microsoft Clarity on public pages | Consent, which may be withdrawn at any time |
MailGrab does not sell personal data or use SMTP message content for advertising. Automated parsing, indexing, rendering, and compatibility checks are used only to provide requested product functionality.
5. Service Providers
MailGrab may use the following providers where the relevant feature is configured:
| Provider | Purpose |
|---|---|
| Cloudflare | Network protection and object storage for attachments |
| Amazon Web Services SES | Delivery of transactional and account emails |
| Optional sign-in and, after consent, public-page analytics | |
| Microsoft Clarity | Public-page interaction analytics after consent |
| Sentry | Application error monitoring and diagnostic context |
| Paddle | Subscriptions, payments, invoicing, and tax when paid plans are enabled |
Providers process data under their applicable terms and data protection commitments. Infrastructure providers may also process limited operational data necessary to host and deliver the service.
6. Cookies and Public-Page Analytics
Necessary cookies support sessions, authentication, CSRF protection, trusted-device OTP, and storage of your consent choice. They do not require optional analytics consent.
Google Analytics and Microsoft Clarity are restricted to public marketing, authentication, and legal pages. They are not loaded in the authenticated product area, billing pages, or guest email links. Their scripts are not requested until you accept the Analytics category.
| Cookie | Purpose | Typical duration |
|---|---|---|
| MailGrab session / XSRF token | Session and request security | Session or configured login duration |
| otp_remember_* | Trusted-device OTP preference | 30 days |
| mailgrab_cookie_consent | Stores consent preferences | 182 days |
| _ga* | Google Analytics, after consent | Up to 2 years |
| _clck / _clsk | Microsoft Clarity, after consent | Up to 1 year |
Use the control to change or withdraw consent. Withdrawal stops future optional storage and triggers removal of known MailGrab-domain analytics cookies where technically possible.
7. Retention
- Test emails and attachments are automatically deleted according to the retention period shown for the applicable plan.
- Account and workspace records are retained while the account is active or as needed to provide the service.
- Expired or revoked invitation and guest-link records may be retained temporarily for security and operational purposes.
- Operational, security, and error records are retained only as long as reasonably needed for diagnosis, abuse prevention, and legal obligations.
- Billing and tax records may be retained for the period required by applicable law and by the Merchant of Record.
Account deletion removes active account, inbox, email, attachment, access, and local billing records through the normal deletion workflow. Limited residual copies may remain temporarily in backups or provider systems until their normal overwrite or deletion cycle completes.
8. International Transfers
Some providers may process data outside the European Economic Area. Where required, MailGrab relies on an adequacy decision, Standard Contractual Clauses, the EU-US Data Privacy Framework where applicable, or another lawful transfer mechanism.
9. Security
MailGrab uses measures appropriate to the service, including encrypted transport, hashed account passwords, encryption of recoverable SMTP and OAuth secrets at rest, access controls, rate limiting, and restricted attachment access through application authorization.
Error-monitoring defaults are configured not to send default personally identifying information, but diagnostic events can still contain technical context. No online service can guarantee absolute security.
10. Your Rights
Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting processing already carried out lawfully.
Send requests to [email protected]. You may also complain to your local supervisory authority. In Italy, this is the Garante per la protezione dei dati personali .
11. Children
MailGrab is a developer tool and is not intended for children. Users must be at least 18 years old or otherwise have the legal capacity and authorization required to enter into these arrangements.
12. Changes and Contact
This policy may be updated when the service, providers, or legal requirements change. Material changes will be communicated by reasonable means before they take effect where required.
Questions and privacy requests: [email protected] .