Privacy policy
Last updated 18 October 2026 · Also: Terms of service · GDPR and data protection
1. Who we are
Mailfly is run by DF Media Limited, a company registered in England and Wales with company number 14556277, at 20-22 Wenlock Road, London, N1 7GU, United Kingdom ("we", "us"). Contact us at hello@mailfly.ai, through the contact page, or by post at that address.
2. Our two roles
- Controller, for our customers' data. The businesses that sign up to Mailfly and the people in their teams. We decide how this data is used.
- Processor, for our customers' contacts. The people a business keeps on its list and emails through Mailfly. The business is the controller: it decides who is on its list and what it sends. We use this data only to run the service for that business, on its instructions, under the data processing terms on our GDPR page.
If you are on a business's list, contact that business first. It can see, change, export or delete your details. We help it answer you. Every email has a link to unsubscribe at once.
3. Data about our customers
- Account: your name and email address, and the names and email addresses of your team members.
- Business details: business name, company name and number, registered office or postal address, website, logo, reply-to address and sending domains.
- Billing: your plan, its status and billing history. Stripe takes the card details; they never reach us.
- Sign-in: when you sign in, and the network address that asked for a sign-in or sign-up link. We store only a one-way code (SHA-256) of each link, each session, each API key and each connected app's tokens, never the secret itself.
- Messages to us: chat messages, contact-form messages, emails to hello@mailfly.ai with their attachments, and our replies.
- Safety records: how many requests came from one network address in the last 24 hours, alerts, and a log of sign-ins and sends.
4. Data about our customers' contacts
- Email address, name, company and the tags the business adds.
- Subscription status (subscribed, waiting to confirm, unsubscribed, bounced, complained, stopped by list cleanup).
- The lawful basis, and the record of consent: the form or source, the page, the time, and the words the person agreed to (for example the consent box they ticked).
- For each email: when it was sent and delivered, opens and clicks, bounces, spam complaints and unsubscribes. From these, the date of the last open or click and an engagement score of 1 to 5 stars.
- Page views and link clicks on the business's own website, only when the business adds our script: the page, the site that sent the visitor, the country, and a one-way visitor code that changes every day. No cookie is set and nothing is stored on the device. A visit is joined to a contact only when the contact came from a link in one of the business's emails.
The business gives us this data: through imports, sign-up forms, the API, connected tools or by hand.
5. Why we use it, and the lawful basis
| Use | Lawful basis (UK GDPR) |
|---|---|
| Your account, sign-in, sending your emails, reports, support for the service you pay for, billing | Contract |
| Keeping the service safe: request limits, checking the emails businesses send for spam, phishing and abuse, pausing a campaign when bounces or complaints are too high | Legitimate interests (a safe service, and inboxes that trust our customers' email) |
| Answering chat, contact-form and email messages | Legitimate interests, or steps before a contract |
| Emails about your account: sign-in links, alerts, billing, important changes to these terms, and notices about the service (for example new features or planned work) to owners and admins | Contract and legitimate interests |
| Tax and accounting records | Legal obligation |
| Our customers' contacts | The business's own basis (it records one for each contact); we act on its instructions |
We do not sell personal data. We do not use a business's contacts for our own marketing, or to train any AI model. We do not send our customers marketing emails without their consent.
6. Who helps us
These companies process personal data for us, under contracts that protect it:
| Company | What it does for us | Where |
|---|---|---|
| Cloudflare | Hosting of the website and the app, the database, file storage (pictures in emails, mailbox attachments), the emails that sign you in, the hello@ mailbox, and the check on the contact form that the sender is a person (Turnstile) | Global network; the company is in the US |
| Amazon Web Services (Amazon SES) | Sending the emails our customers write, and telling us about deliveries, bounces and complaints | Stockholm, Sweden (EU) |
| Stripe | Payments, subscriptions and invoices | UK, EU and US |
| PostShiba (Backpack Internet Pty Ltd, trading as Bento) | From 17 November 2026: sending the emails our customers write, beside Amazon SES, and telling us about deliveries, bounces, complaints and unsubscribes | The company is in Australia |
Landing pages that a business publishes load their fonts from Google Fonts (Google sees the visitor's network address), and a video the business adds comes from YouTube (privacy-enhanced mode) or Vimeo.
7. Tools you choose to connect
A business can connect other tools: Claude (Anthropic) through our connector, its Shopify shop, Zapier, Make, its own website forms, a Google Sheet or a feed for daily emails, or an import from its old email service. From a Shopify shop we receive each customer's name, email address, company and email marketing choice, the email address on each new order, and each checkout's email address, items, total and link back to the cart (kept 30 days, for abandoned cart emails); we send back only changes to a customer's email marketing choice. Data goes to or comes from those tools only when the business sets this up. They are the business's choice, under its own agreement with them; they are not our processors.
8. Data outside the UK
Some of our helpers process data outside the UK. When they do, the transfer is covered by UK adequacy regulations (for the EU) or by approved contract terms: the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the company is certified.
9. How long we keep it
| Data | How long |
|---|---|
| Your account, business details, contacts, emails and reports | While your account is open. When an owner closes the business (Settings → Close this business), sending stops at once and we delete the business and all its data 7 days later. Team members who belong to no other business are deleted with it. |
| A contact the business deletes | At once. If the business keeps "never add again", only a one-way code of the address stays. |
| A contact who unsubscribed, bounced or complained | As long as the business keeps its list, so that the person is never emailed again by mistake |
| Sign-in links | They work once, for 15 minutes |
| Sessions (staying signed in) | 30 days |
| Links to confirm a subscription | 30 days |
| The list of addresses that got one of our service notices | 30 days after the email |
| Request-limit records and sign-up form counters | 24 hours |
| Billing records | 6 years, because UK tax law needs them |
| Chat and email conversations with us | Until you ask us to delete them, or we close your account |
10. How we protect it
- Every page and every connection uses HTTPS.
- Secrets are stored only as one-way codes: sign-in links, sessions, API keys, chat keys and connected-app tokens. The tokens of a connected Shopify shop are stored encrypted (AES-GCM), because we use them to call Shopify.
- Each business sees only its own data. Every database query names the business.
- Our team's customer pages show counts, never a business's contact list.
- To keep the service safe, our team can look at the emails a business sends or has scheduled (campaigns, automation emails, daily and cart emails): the words, pictures and links. We see each email filled in for a made-up person, never one person's own copy, and each look is logged.
- The contact form uses Cloudflare Turnstile to check that the sender is a person, not a program that sends spam. Cloudflare reads signals from your browser for this check only.
- Files people attach to emails to us are kept apart and are only downloaded, never opened in the browser.
- Sign-in is by a one-time link to your email address: there are no passwords to steal.
11. Automated decisions
Mailfly makes some decisions by itself: it pauses a campaign when bounces or complaints are too high, gives each contact an engagement score, and (only when a business switches on list cleanup) stops campaigns to people who never open. None of these has a legal or similarly serious effect on a person. A business can change each result by hand.
12. Cookies
The website sets no cookies. The app sets one cookie that keeps you signed in; it is needed for the service and is not used for tracking. The chat keeps a random key in your browser so that you can see your own conversation again; we store only a one-way code of it. In the app, your browser keeps a list of the notices you hid, so that they stay hidden. It holds only the notice numbers. The website analytics script that businesses add sets no cookie.
13. Children
Mailfly is for businesses. It is not for people under 18, and we do not knowingly collect data about children for our own purposes.
14. Your rights
You can ask us for a copy of your data, and ask us to correct it, delete it, restrict its use, or give it to you in a format a computer can read. You can object to how we use it, and withdraw consent where we rely on consent. Write to hello@mailfly.ai. We answer within one month. We may ask you to show who you are first.
If you are on a business's list, the business is the controller: contact it first. If you write to us, we pass your request to the business and help it answer.
15. Complaints
Tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority where you live.
16. Changes
When we change this policy, we change the date at the top. If a change is important, we tell our customers by email at least 30 days first.