GDPR and data protection

Last updated 18 October 2026 · Also: Terms of service · Privacy policy

In short

For the people on your list, you are the controller and DF Media Limited is your processor. The data processing terms below are part of our terms of service: you accept them when you make an account. You do not need to sign anything else.
Mailfly is built so that the lawful way is the easy way: consent boxes on every form, a lawful basis for every contact, a record of what each person agreed to, confirmed opt-in, and an unsubscribe link in every email.
For your own account data, we are the controller. Our privacy policy explains it.

Every sign-up form in Mailfly can show GDPR consent. Open Forms, then GDPR consent on the form. The settings count for the hosted sign-up page and for the HTML form you paste into your website.

A box to tick (best for the UK and EU). It is never ticked at the start. Nobody can sign up without ticking it. Or a sentence under the button, where pressing Sign up is the clear action.
Your own words. Say who you are and what you will send. Empty = our standard words: "Yes, send me emails from [your business]. I can unsubscribe at any time."
A link to your privacy policy, next to the words.
Marketing permissions: up to 3 extra boxes, never ticked at the start, for example "Send me the daily deals" or "Tell me about events". Each one adds a tag, so you send each person only what they chose.
Proof of consent. Each new contact keeps the words they agreed to, the extra boxes they ticked, the form, the page and the time. It shows on the contact's page.
A post from another tool (for example Typeform or Webflow) with a consent field that says no, false or off adds nobody. A landing page has its own consent box, and keeps its words the same way.

Other tools that help you comply

A lawful basis for every contact: consent, soft opt-in (existing customers, UK and EU) or business address. Mailfly does not send a campaign while anybody in the audience has none.
Confirmed opt-in (double opt-in), if you switch it on: new people confirm by email before they get anything.
Unsubscribe in every email, plus the one-click button in Gmail and Yahoo. It works at once.
Nobody who said no is emailed again. An import, a form or the API never subscribes somebody again. Imports keep the "no" from your old service: unsubscribed, bounced and complained people come in with that status. A connected Shopify shop is the only other way back: there, the newest choice of the person wins in both places, so a newer "yes" in Shopify subscribes them again, and a "no" here is sent to Shopify.
Your company details in every email: company name and number, registered office, and why the person gets it (UK PECR and Companies Act).
List cleanup: stop emailing people who never open, after one "do you still want these?" email.
Website analytics with no cookie, so no cookie banner is needed for it.

When a person asks about their data

To see it: on their contact page, press Download this person's data. The file has their details, tags, lawful basis, the words they agreed to, every email they got and what they did, and their visits to your website.
To correct it: change it on their contact page.
To stop emails: press Unsubscribe on their contact page. It works at once, and keeps them unsubscribed after any import.
To delete it: press Delete this person on their contact page (owners and admins). Their details, consent record, tags, automation steps and website visits are deleted at once; campaign numbers stay with no address, name or company. Keep Never add this address again ticked so an import, the API or Claude cannot add them back: we keep only a one-way code, not the address.
To take all your data: press Download contacts (CSV) on Subscribers (owners and admins). Every owner and admin gets an alert when somebody does.

If a person writes to us about your list, we pass the request to you and help you answer within the time the law gives.

Data processing terms (Article 28 UK GDPR and EU GDPR)

These terms apply when DF Media Limited processes personal data for you as your processor. "You" is the business with the Mailfly account.

Subject and duration. We process your contacts' data to provide Mailfly to you, for as long as your account is open, and then until it is deleted under term 9.
Nature and purpose. Storing your contacts and lists; sending the emails you write or set up; recording deliveries, opens, clicks, bounces, complaints and unsubscribes; reports; sign-up forms; website analytics if you add our script.
Types of data. Email address, name, company, tags, status, lawful basis and consent record, email activity, and website activity as described in our privacy policy. You must not put special category data (for example health) in Mailfly.
Data subjects. Your subscribers, customers, prospects and other people you add to your list.
Your instructions. We process the data only on your documented instructions: these terms and what you do in Mailfly. If the law makes us do something else, we tell you first, unless the law forbids it. We tell you if we think an instruction breaks data protection law.
Confidentiality. Everybody who works on the data is bound to keep it confidential.
Our checks. To stop spam, phishing and abuse, our team can look at the emails you send or schedule, filled in for a made-up person. We do not look at your contact list to do this.
Security. We keep appropriate technical and organisational measures (see Security below) and improve them over time.
Sub-processors. You allow us to use the sub-processors listed below. We give each one data protection terms at least as strict as these. We tell you by email at least 30 days before we add or replace one; you can object, and if we cannot meet your objection, you can close your account. We stay responsible for their work.
End of the service. When you close your account (Settings → Close this business), we delete your contacts and emails 7 days later, and always within 30 days, unless the law requires us to keep them. Before that, you can download your contacts as a file on Subscribers.
Help with requests and duties. We help you answer requests from the people on your list, and with security, breach notices, data protection impact assessments and consultations, as far as our part of the processing allows.
Breaches. We tell you without undue delay after we become aware of a personal data breach that affects your data, with what we know, and we keep you informed.
Information and audits. We give you the information you need to show that we meet these terms, and we allow reasonable audits by you or an auditor you choose, with reasonable notice, under a duty of confidentiality, at your cost.
Transfers. We transfer the data outside the UK or EU only under an adequacy decision or approved contract terms (see our privacy policy).
Your duties. You have a lawful basis for each contact, give people the information the law asks for (your own privacy notice), and get any consent the law needs. Mailfly gives you the tools above to do this.

Sub-processors

Company	What it does for us	Where
Cloudflare	Hosting of the website and the app, the database, file storage (pictures in emails, mailbox attachments), the emails that sign you in, the hello@ mailbox, and the check on the contact form that the sender is a person (Turnstile)	Global network; the company is in the US
Amazon Web Services (Amazon SES)	Sending the emails our customers write, and telling us about deliveries, bounces and complaints	Stockholm, Sweden (EU)
Stripe	Payments, subscriptions and invoices	UK, EU and US
PostShiba (Backpack Internet Pty Ltd, trading as Bento)	From 17 November 2026: sending the emails our customers write, beside Amazon SES, and telling us about deliveries, bounces, complaints and unsubscribes	The company is in Australia

Security

HTTPS on every page and connection.
Secrets stored only as one-way codes (SHA-256): sign-in links, sessions, API keys and app tokens. A connected Shopify shop's tokens are stored encrypted (AES-GCM), because we use them to call Shopify.
Sign-in by a one-time email link, so there are no passwords. Owners and admins choose who is in the team; editors cannot add people or make keys.
Each business sees only its own data: every database query names the business.
Our team sees counts only on its customer pages, never a business's contact list. It can look at the emails a business sends, filled in for a made-up person, to stop abuse; each look is logged.
Limits on requests per network address and per key, and alerts to owners and admins for unusual events (a new API key, a connected app, a flood of sign-ups).

Contact

Mailfly is run by DF Media Limited, a company registered in England and Wales with company number 14556277, at 20-22 Wenlock Road, London, N1 7GU, United Kingdom ("we", "us"). Contact us at hello@mailfly.ai, through the contact page, or by post at that address.