Privacy Policy

Mailera (mailera.app) operates the website, app, API and shared viewing pages. This policy applies to all of them.

Mailera determines how your account information is processed. For messages in mailboxes connected by a workspace, that workspace determines the purposes of use; Mailera processes messages at the workspace's request to provide the service. If you are a workspace member, contact its Admin or Leader first for requests about messages in that workspace.

We only collect what is needed to run the service:

• Account: email address, full name, role, group, language and light/dark mode. The authentication system stores your Mailera sign-in password as a hash; we cannot read it.
• Connected mailboxes: email address, display name, connection status and Microsoft access tokens (encrypted). During bulk import, if an imported row includes a mailbox password, it is also stored encrypted; you can leave this field blank.
• Messages: sender, recipients, subject, preview, folder, read and flag status, and time received. Full content is cached only when someone opens a message. Attachments are not stored; Mailera fetches them directly from Microsoft when you download them.
• Logs: workspace activity (who did what and when), API calls (path, result, IP address, API key) and shared link views (IP address, browser).
• Contact: name, email address, company and message submitted through the Contact page, along with your IP address and browser to prevent spam.
• In your browser: cookies and storage needed to keep you signed in and retain your language, display mode and shared link viewing session.

Mailera does not use message content for advertising, sell data or use your messages to train AI models.

• Provide the service: sync and display messages, send messages at your request, and run the API, webhooks and shared links.
• Protect the system: check permissions, enforce rate limits, and detect unusual access and abuse.
• Respond to support requests and notify you of important service changes.
• Monitor errors and performance to keep the service reliable.
• Comply with legal obligations in response to valid requests.

Legal bases for processing: providing the service you request, our legitimate interest in keeping the service secure, and legal obligations.

When you connect a mailbox, Mailera requests permission to read and organize messages (Mail.ReadWrite), send messages (Mail.Send), stay connected while you are offline (offline_access), and read basic account information (openid, profile, email, User.Read) to identify the mailbox address.

Mailera only uses these permissions to perform actions requested by you or your workspace.

You can revoke access at any time: delete the mailbox in Mailera; for personal accounts, remove the app at account.live.com/consent/Manage; for Microsoft 365, an administrator removes it in Microsoft Entra (Enterprise applications).

• Message information: the last 30 days (workspaces can set a different period). Older messages are deleted automatically each day and can still be opened directly through Microsoft.
• Full message bodies: deleted 7 days after being downloaded.
• When a mailbox is deleted: its tokens, folders, and messages are deleted immediately.
• API logs: 90 days. Activity logs: 365 days. Contact messages: 365 days.
• Shared link viewing sessions: deleted within 1 day of expiry; revoked links can no longer be opened.
• Account: until you request deletion or an Admin removes you from the system.

Infrastructure provider backups may retain deleted data for a short additional period, depending on their backup cycles.

We do not sell data. Data is only shared with:

• Microsoft, to read, organize, and send messages through Microsoft Graph with the permissions you have granted.
• Infrastructure providers: database and authentication (Lovable Cloud, powered by Supabase), application servers and delivery network (Cloudflare). They process data only to operate the infrastructure.
• Google Fonts: your browser loads fonts from Google, so Google receives your IP address and browser information for that request.
• Systems configured by your workspace: data is sent through the API and webhooks to addresses your workspace chooses.
• People with shared links: anyone with the link and password can view the shared mailbox content or messages while the link is valid.
• Competent authorities, when required by law and in response to a valid request.

Microsoft tokens are encrypted with AES-GCM and never sent to the browser; API keys are stored only as hashes; shared link passwords are encrypted separately; all permissions are checked on the server and through database access policies. See the Security page for details.

No system is completely secure. If we discover an incident affecting your data, we will notify the Admin of the affected workspace as soon as possible.

Mailera uses only what is necessary for the service to work:

• Sign-in session: keeps you signed in on this device.
• Language (mailera_locale cookie): remembers your chosen language.
• Light/dark mode: saved in browser storage and your profile.
• Shared link viewing session: a secure cookie (HttpOnly) that expires with the viewing session.

We do not use advertising cookies.

Depending on where you live, the law may grant you the following rights; we extend them to all users:

• View the data Mailera holds about you.
• Update your profile information in Settings → Account.
• Delete mailboxes directly in the app (Admin or Leader); request account deletion through the Contact page.
• Revoke Microsoft permissions at any time.
• Retrieve your data through the API.
• Object to or request restrictions on a specific type of processing.

Submit requests through the Contact page with the subject “Account and personal data”. We may need to verify that you own the account before proceeding.

Mailera is intended for organizations and people aged 18 or older. We do not knowingly collect children's data.

Mailera's and Microsoft's infrastructure may be located in countries other than where you live. Data is always encrypted in transit, and we rely on our infrastructure providers' safeguards.

When this policy changes, we update this page and the revision date at the top. For significant changes, we will provide reasonable advance notice on the website or in the app.

For questions about personal data, use the Contact page with the subject “Account and personal data”.