Privacy Policy

1. Who we are

FounderMail is operated by Webco S.r.l.s., Montorio al Vomano (TE), Italy ("we", "us"). We are the data controller for the personal data described in sections 2 and 3, and we process the content of the mail we host on your instructions, as described in section 4. Contact: the contact form, or Need help? in the dashboard.

This policy covers the website at foundermail.mx, the dashboard at app.foundermail.mx, the mail servers, the REST API and the MCP server.

2. Data you give us

• Account data: your name, email address and a password hash, or the identifier of the Google account you sign in with.
• Workspace data: the domains you add, the mailboxes you create and their passwords (stored so that mail clients can authenticate), team members you invite, labels, notes, forwarders, webhooks, templates and API keys.
• Billing data: your plan and the identifiers Stripe gives us for your customer record, subscription and invoices. Card details are entered on Stripe's pages and never reach us.
• Support communications: what you write to us and our replies.
• Outbound access requests: the description you give of what you intend to send, and the result of our review.

3. Data collected automatically

• Server logs: IP address, time, the request made and the response, for the website, dashboard, API and mail servers. Kept for security and troubleshooting.
• Usage counters: messages received and sent, storage used, API requests, per workspace and per month, because plans are metered on them.
• Sending signals: for each domain, how many recipients its mail goes to, how many of them are new to the workspace, how many write back, and the bounce and complaint reports our delivery provider returns, with the addresses they concern. Derived from delivery metadata, not from what messages say, and used to protect the deliverability of the service.
• Error reports: when something fails, a report with the error, the request's technical details and the signed-in user's id is sent to our error-tracking service.
• Website analytics: the marketing site uses Cloudflare Web Analytics, which is cookieless and does not identify visitors. The dashboard has no analytics.

4. The mail we host for you

FounderMail's purpose is to receive, store, present and send email for your domains. In doing so we necessarily store the content of every message: headers, bodies, attachments, drafts, and the original bytes as they arrived. We also derive data from it: a text preview, a search index, and the contact and organisation records that group mail by sender.

Automated processing of mail content is limited to what the service needs:

• Spam scoring of incoming mail, on infrastructure we run ourselves.
• Sanitising HTML for safe display, and blocking remote images until you ask for them.
• Threading, search indexing and contact resolution.
• Forwarders, webhooks and templates you configure.
• Delivery of mail you send, through our delivery provider.
• AI drafting, only if an owner or admin of your account turns it on: when you ask for a draft, the conversation you are replying to, the contact's details and the notes you have given the assistant are sent to Anthropic to produce it. Nothing is sent until you ask, and Anthropic does not use it to train models.

We do not read your mail. Our staff access message content only when you ask us to for support, or when it is necessary to investigate abuse, a security incident or a legal demand. We do not sell mail content or data derived from it, do not use it for advertising, and do not use it to train machine-learning models. If you connect an AI assistant through the MCP server, that assistant reads what your API key allows, under the terms of the assistant's provider, not ours.

You are responsible for having the right to receive and store the mail your mailboxes receive, and for the people whose data appears in it. Where the law regards us as a processor of that data on your behalf, we process it only on your instructions, as expressed through the service.

5. Why we process data, and on what basis

We do not send marketing email and do not ask for consent for tracking, because we do not track.

6. Where data is stored, and who else processes it

Everything FounderMail stores is in the United States, in Microsoft Azure's West US 2 region (Washington State): mail content and attachments, the database, its backups, and our own logs. Mail you send passes through Amazon SES in its EU (Ireland) region on its way to the recipient; we do not store mail there. We do not offer a choice of region.

We rely on these providers. Each processes only what its role needs.

Our hosting is in the United States. Where a provider processes personal data outside the European Economic Area we rely on the safeguards that provider offers, such as standard contractual clauses or an adequacy decision covering it. Details are available on request.

Beyond these providers, we disclose data only when the law requires it, to protect the service or others from abuse, or, with your consent, to someone you ask us to share it with. If FounderMail changes ownership, data passes to the new owner under this policy.

7. How long we keep data

• Mail: until you delete it, subject to your plan's retention. The Free plan includes twelve months of mail and Plus, Pro and Scale keep it until you delete it; we do not delete mail for age today, and would tell account owners well in advance before starting. Deleted mail is removed from our storage promptly and from backups within a limited period after that.
• Account and workspace data: while the account exists.
• After account deletion: the workspace and its data are removed within 30 days, except records we must keep for accounting (invoices) for the period the law requires.
• Logs and error reports: for a limited period, typically no longer than 90 days.
• Usage counters: as long as needed for billing and to show you your history.

8. Security

Connections to the website, dashboard, API and mail servers are encrypted (TLS). Data at rest is encrypted by our hosting provider. Mailbox passwords are stored so that mail clients can authenticate; account passwords are stored as hashes only. Access to production systems is limited to the people who operate them. No method of storage or transmission is completely secure; if we learn of a breach affecting your data we will tell you without undue delay.

9. Cookies

The dashboard sets the cookies needed to keep you signed in and to protect forms; they are essential and are not used for tracking. It also remembers, in this browser only, which way you last signed in (Google or email, never the address), and leaves a marker saying you are signed in that this site reads to show "Open dashboard" instead of "Sign in". Your theme and a few interface preferences are stored in your browser's local storage. The marketing site sets no cookies of its own.

10. Your rights

Under the GDPR and similar laws you may ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on it. Most of this you can do yourself: your mail is exportable at any time over IMAP, your profile is editable in Settings, and your workspace's data is deleted with the account. For anything else, write to us from the dashboard (Need help? in the sidebar), signed in as the account's owner, or through the contact form. We answer within a month. You may also complain to your data protection authority; in Italy that is the Garante per la protezione dei dati personali.

11. Children

The service is for people aged 18 and over. We do not knowingly collect data from anyone younger; tell us if you believe we have.

12. Changes

We will post changes to this policy here and update the date at the top. If a change materially reduces your rights we will notify account owners by email before it takes effect.

13. Contact

Webco S.r.l.s., Montorio al Vomano (TE), Italy · contact form