Privacy Policy

This policy applies to personal data we process when you, or people you interact with, use any part of the Service:

• The website. exitomail.com and its public pages, including this legal center.
• Mail. Mailboxes on @exitomail.com or on your own domain, used in our web app or in mail apps over IMAP, SMTP and JMAP.
• Exito Vault. Your files, folders and share links.
• Exito Transfer. Sending files, download pages and “request files” links, including the people who download or upload without an account.
• Custom domains. Connecting, verifying and maintaining your own domain.
• Business organizations. Team mailboxes on the organization's domains, invitations and pooled storage, subject to the next section.
• Talking to us. Support, abuse reports, legal notices and appeals.

Some features described here, such as Business organizations and parts of Exito Vault, are still being rolled out. The processing described for them starts when you use them.

What it does not cover

• Mail apps from other companies (for example on your phone or computer). Their makers process data under their own policies, and some apps sync your mailbox through their own cloud servers.
• Websites you open from links in messages or files.
• What Stripe and Link do as merchant of record when you buy a paid plan: the checkout, payment, tax, receipts, your Link account and Link's support. That is covered by the Link Privacy Policy (נפתח בכרטיסייה חדשה) (see Payment data).
• Your organization's own policies, if your account is provided by an employer or another organization.
• Other email providers, once a message you send has left our servers.

Words we use

Service

ExitoMail, Exito Vault, Exito Transfer, custom domains, the website and our support, as described in the Terms of Service.

Content

What you and others put into the Service: messages, attachments, contacts, files, transfers.

Metadata

Information about content and its delivery, such as sender and recipient addresses, times, sizes and the servers involved.

Organization

A Business customer: a company or other organization that provides accounts to its members.

GDPR

The EU General Data Protection Regulation. Where the UK GDPR or the Swiss Federal Act on Data Protection applies to you, references to the GDPR include the equivalent provisions of those laws.

Data protection law distinguishes between a controller, who decides why and how personal data is processed, and a processor, who processes it on the controller's behalf and instructions. Our role depends on how you use the Service.

Personal accounts

For Free, Plus, Pro and Max accounts, we are the controller for your account, billing data and logs, and for the processing needed to run the Service on your content.

Business organizations

When an organization provides your account, the organization is the controller of its members' data and content, and we process it as its processor under our Data Processing Agreement (Article 28 GDPR). The organization decides, for example, who gets a mailbox, which domains and addresses exist, and what happens to a mailbox when someone leaves. Its owner can invite, suspend and delete mailboxes in the organization (our tools do not let the owner read members' mail or files), and the organization sets its own rules about access to members' data. Its privacy notice applies to that processing; please direct questions and requests to it.

Even for Business accounts, we remain an independent controller for a limited set of purposes:

• our customer relationship and billing with the organization and its billing contacts;
• security, abuse and fraud prevention across the whole platform, including sending limits;
• meeting our own legal obligations, such as tax law, orders from authorities and duties under the DSA.

The people you communicate with

Mail, shared files and transfers contain personal data about other people: your correspondents, recipients and anyone mentioned in your content. We process that data only to provide the Service to you (to deliver, store, filter, index and display it) and to keep the Service secure. We never contact your correspondents for our own purposes, build profiles of them, or use their data for anything else.

If you use a personal plan for professional purposes and are yourself the controller of that data, we process it on your behalf and following the instructions you give through the Service's settings, and our Data Processing Agreement applies to that processing.

Account data

Payment data

Paid plans are sold through Link, Stripe's checkout and payment service. Stripe's affiliate Sold through Link, LLC is the merchant of record: it sells the plan on our behalf and takes the payment. You enter your card or other payment details directly on Link's checkout page, which Stripe operates. We never see or store your full card number or security code.

Stripe and Link: independent controllers

Stripe and Link collect and use your payment, billing and order data for their own purposes as merchant of record, and decide how, under the Link Privacy Policy (נפתח בכרטיסייה חדשה) and its Privacy Center (נפתח בכרטיסייה חדשה): to take the payment, calculate and pay tax, send receipts and invoices, run your Link account and order history, answer payment questions, handle refunds and chargebacks, prevent fraud and meet their legal obligations. They do not process this data for us or on our instructions, so please ask them about it directly. To manage a subscription at Link, you need a Link account.

Stripe: our processor for our billing records

Stripe also keeps the billing records of our Stripe account for us (customer and subscription records, the customer portal, and the plan changes and refunds we make), as our processor under a data processing agreement (see Subprocessors).

To start a checkout, we send Stripe your name, the email address of your account, an internal account ID and the plan you chose. Link shares your order with us so that we can provide your plan. From Stripe we receive:

• your Stripe customer and subscription IDs, your plan, billing interval, renewal dates and payment status;
• your billing name, email address, country and address, your phone number if you gave one to Link, and a tax ID if you gave one;
• limited details of your payment method, such as its type and expiry date;
• amounts paid and tax included, invoices, receipts, refunds, chargebacks and payment history.

We use this data only for the purposes in this policy: to provide your plan, keep billing and tax records, send service emails about your plan, and handle refunds, withdrawals and disputes.

When a new subscription starts, we add one to a monthly total for its billing country and plan, so we can see where our plans are useful. After paying, we may ask how you found us: answering is optional, and your answer only adds one to a total. These totals are plain numbers, with no name, account or identifier.

Asking Link to delete your data

You can ask Link to delete the information it holds about your “Sold through Link” purchases by deleting your Link account (נפתח בכרטיסייה חדשה). Stripe then cancels the paid plan subscriptions sold to you through Link, deletes your data from the records it holds for those purchases, including the ones in our Stripe account, and tells us about your request. Your ExitoMail account moves to the Free plan when the subscription ends, and nothing in it is deleted. This does not delete the data we hold ourselves: to delete that too, ask us as described in Your rights. We keep the billing records that tax law requires us to keep.

Referral data

If you join through someone's referral link, or someone joins through yours, we record which account referred which, when, and the bonus storage granted (currently 1 GB for each person, up to 10 GB per account). The person who referred you may see that the referral was completed. We never ask for access to your address book; you decide how to share your link.

If you don't give us this data

We need a name, an address and a password to create your account, and billing details for a paid plan: this is a contractual requirement, and without them we cannot provide the Service. A recovery email is optional, but without a verified one you cannot reset a forgotten password. When something else is required, we say so where we ask for it. Everything else is up to you.

To give you a mailbox we have to store and process your messages. That means handling the content of your communications, so we hold it to the highest standard of confidentiality.

Content

Metadata

Messages you send carry the technical headers email needs in order to work, such as your address, the time, our server's name and a DKIM signature. Your recipients and their mail providers can see them, as with any email service.

Where it is stored

Message content and attachments are stored in object storage at Wasabi, region EU-Central-2 (Frankfurt, Germany). Metadata, contacts, the search index and your settings are stored in databases on our server (netcup GmbH, Nuremberg, Germany).

Your browser uploads and downloads Exito Vault files directly to and from our storage provider over encrypted connections, using links that are only valid for a short time. Files never pass through our web server, which means our storage provider also processes your IP address for these requests. Files are stored at Wasabi, region EU-Central-2 (Frankfurt, Germany).

Anyone who has a share link can open what it points to, so share links only with people you trust and use a password or an expiry date where your plan allows. We don't list or publish share links anywhere.

Some file types are often used to spread malware: programs, scripts, web pages and password-protected archives, for example. When a shared file is one of them, its page warns visitors and shows the address of the account that shared it, so they can judge whether they expected it. New accounts, and accounts under a restriction, can't share these file types publicly.

Exito Transfer involves people who may not have an account: recipients, people who open a download link, and people who upload files through a request link. This section is written for them too.

Senders

Recipients and people who download

Like every visit to our website, opening a download page also appears in our web server logs (including your IP address) for up to 30 days, and passes through Cloudflare's network (see Who we share data with).

If a transfer contains a file type often used to spread malware, its download page shows a warning with the sender's address, as described for share links in Exito Vault.

People who upload through a request link

On plans that include it, a signed-in user can create a “request files” link. If you upload through one, we process the files and file names you upload, any details the upload form asks for, and the technical data of the upload (time, browser and IP address in our logs). Your upload becomes a transfer owned by the person who created the request: they receive your files and decide what happens to them.

Reports

Anyone can report a transfer from its download page. We record the reason, any details and email address you choose to give, and a hashed IP address to prevent report flooding. See Abuse reports, notices and appeals.

Transfer files are stored at Cloudflare R2, in the EU jurisdiction. They are deleted when the link expires; see How long we keep data.

If you connect with API credentials, create a token limited to the DNS zone of that domain wherever your provider allows it. You can revoke it at your provider at any time. We delete stored credentials when you disconnect the provider, remove the domain or delete your account.

Ownership is verified with a TXT record before any mail flows. A domain name can identify a person (for example a family name), so we treat it as personal data. DNS records themselves are public by design.

Technical and security logs

If you only visit our website, this is all we process about you: we run no analytics tools, and there are no tracking pixels or third-party trackers on our pages. Each page you open also adds one to a monthly count for your country (as Cloudflare reports it), kept as a plain total with no IP address, cookie or identifier: it tells us roughly how many people in Europe we serve, which our legal representatives there need to know. If you arrive through a link in one of our own social media posts or ads, the link names the network: that visit, and signing up during it, each add one to a weekly total for that network, so we can tell which posts and ads help. The network's name isn't stored on your device or with your account. See the Cookie Policy.

Support

When you contact us, we process your message and attachments, your address, the account details needed to help you, and our replies. Please never send us your password: we will never ask for it.

Abuse reports, notices and appeals

When someone reports content or behavior (by writing to abuse@exitomail.com, with the report button on a transfer, through a notice under the Digital Services Act, or with a copyright notice), we process:

• the notifier's name and email address, where given. You can report most issues anonymously, but some procedures, such as copyright notices, require you to identify yourself;
• the explanation and evidence provided, and the reported content;
• data about the account or transfer concerned;
• our decision, whether it was taken by automated means, the statement of reasons we send, and any appeal and its outcome;
• complaint reports that other mail providers send us about messages from our servers;
• where we report suspected child sexual abuse material to NCMEC, the report and the material and account data it contains, which US law requires us to preserve for one year.

If you phone our copyright agent, the call is handled by Twilio (see Who we share data with). We receive your phone number, the time of the call and any voicemail you leave, by email; Twilio deletes the recording once it has been delivered. We keep them like other notices.

The full procedures are in Notice & Action and the Copyright Policy.

We use personal data only for the purposes below. Each has a legal basis under Article 6(1) GDPR. We don't use data for a new purpose that is incompatible with these without telling you first and, where needed, asking for your consent.

Our legitimate interests

Where we rely on Article 6(1)(f), our legitimate interests are:

• keeping the Service, its users and their data secure and available;
• protecting people from spam, phishing and malware;
• preventing fraud and abuse of the free plan;
• keeping our servers' sending reputation good, so that every user's mail is delivered;
• helping senders deliver files to the people they choose;
• keeping the Service reliable, using aggregated operational metrics;
• complying with the US laws that bind us as a US company, including tax law and the duty to report child sexual abuse material, and protecting children;
• establishing, exercising and defending legal claims.

We have weighed these interests against your rights. We use the least data that works, keep it for short periods, and never use it for advertising or profiling. You can object at any time, and we will tell you more about our assessment on request.

Sensitive information in your content

Messages and files can contain special categories of personal data, such as health information, religious beliefs or political opinions (Article 9 GDPR). We don't analyze content to find or infer such information. It is stored, filtered and delivered like any other content, only because you or your correspondents chose to put it there, and it stays under your control.

Confidentiality of communications

Mail is a communications service. We treat the content of your communications, and the circumstances of them (who wrote to whom, and when), as confidential, in line with Article 5 of the ePrivacy Directive 2002/58/EC and the national laws that implement it. We process them only as needed to transmit, store, secure and filter them, or where the law allows or requires it.

When a person may look at content

Machines process your content to deliver, filter, index, search and scan it, and our automated enforcement system can act on the results (for example, a malware verdict) without a person seeing the content. A person at ExitoMail looks at content only in these cases, and only at what is necessary:

1. You ask us to. For example, you ask support to look at a message that won't display. We only look at what you point us to, for as long as needed.
2. A specific abuse case, appeal or security incident. For example, a reported transfer, or a message that another provider sent us a complaint about. We access the minimum needed to decide, and record the access in the case.
3. The law requires it. For example, a binding order from a competent authority. See Requests from authorities.

For Business accounts, your organization may have its own rules about access to members' mailboxes. Those rules are the organization's, not ours.

Some protections only work if they run automatically and immediately. These systems run on our own infrastructure, except bot checks, which Cloudflare runs if we switch them on.

Filtering and limits

• Spam and phishing filtering. Rules, sender reputation and authentication checks (SPF, DKIM, DMARC), and a statistical classifier look at the content and metadata of messages. When you mark a message as spam or not spam, the filter can learn from it. This is a narrow filtering function, not a general-purpose or generative AI model, and nothing is shared with anyone else.
• Malware scanning. Mail attachments and Exito Transfer uploads may be scanned for known malware with an open-source scanner that runs on our own infrastructure. Infected messages may be rejected and infected files quarantined.
• DNS blocklist lookups. We may check the IP address and domain name of a server that sends us mail, and domain names found in a message (such as those of links), against public DNS blocklists. The blocklist operator receives only that IP address or domain name, as a DNS query, never your address or the message.
• Sending limits. Every account has a daily sending limit that depends on the plan (for example, up to 100 messages a day on Free). New accounts start lower and earn more as they build trust.
• Sign-up and sign-in protection. Rate limits per IP address and network, checks on recovery addresses and a Cloudflare Turnstile bot check keep automated sign-ups and password guessing out. The bot check runs on sign-up, on password resets, and on sign-in after several failed attempts.
• Breached passwords. When you choose a password, we check whether it appears in Have I Been Pwned's public list of passwords exposed in data breaches, and refuse it if so. Only the first five characters of a one-way hash of the password leave our server, with random padding, so the service never learns your password or its hash. If a password you sign in with later turns up in that list, we suggest that you change it.

Messages that are very likely spam or that contain malware may be rejected during delivery, in which case the sending server is told, or placed in your Spam folder, where you can review them for 30 days.

Automated enforcement

Our automated enforcement system combines signals to detect abuse of the Service and to stop it quickly. This is the meaningful information about its logic, significance and consequences that Article 13(2)(f) GDPR requires:

Signals it uses

Spam complaints and bounce rates of an account's outgoing mail; listings on DNS blocklists; malware scan results; sign-in and sending patterns typical of account takeover (for example, a sign-in from an unusual network followed by a burst of mail); reports from users, other providers and notifiers, including reports of child sexual abuse material; and sign-up signals. It does not use special categories of personal data, and it does not profile you for any other purpose.

How it decides

Rules with thresholds: when a signal, or a combination of signals, crosses a threshold that indicates abuse or a compromised account, the matching measure is applied. Thresholds are set by our staff and reviewed against the results of appeals.

What it can do

Limit or suspend sending; suspend an account; block a transfer or share link and quarantine its files; suspend a custom domain; block an IP address that attacks the Service.

Consequences for you

While a measure applies, you may be unable to send mail, sign in, share files or use a domain. Receiving mail usually continues. Measures are designed to be temporary and reversible, and are lifted when a review finds they are no longer needed. Termination of an account is always decided by a person.

Article 22 GDPR

Some of these measures, such as suspending an account or a domain, are decisions based solely on automated processing that can significantly affect you (Article 22(1) GDPR). We take them because they are necessary for performing our contract with you (Article 22(2)(a)): the Service you signed up for only works if we can stop spam, malware and compromised accounts within minutes, before they harm you, other users and the deliverability of everyone's mail. As Article 22(3) requires, we protect your rights with these safeguards:

• we tell you about the measure and the main reasons for it, unless an exception applies (see below);
• you can obtain human intervention, express your point of view and contest the decision by appealing at exitomail.com/appeal, by replying to our notice or by writing to abuse@exitomail.com;
• a person decides every appeal, and complex cases are escalated to our staff before any final decision;
• we lift a measure as soon as a review shows it was wrong or is no longer needed.

Cases involving suspected child sexual abuse material are handled by a person. In those cases, and where an authority requires confidentiality, we may limit or delay the information we give you so that a criminal investigation is not compromised, as far as the law allows. Spam filtering and sending limits that apply to everyone are not decisions about you in the sense of Article 22.

Your other options

• Check your Spam folder and mark messages as not spam; the filter takes this into account.
• You can object to processing based on our legitimate interests.

We share personal data only as described here. We don't sell or rent it, and we don't share it for advertising.

Subprocessors

These companies process personal data on our behalf, under written contracts that meet Article 28 GDPR. They may only use it to provide their service to us.

About Cloudflare: “website” means everything served at exitomail.com, including the web app you use for mail, Exito Vault and Exito Transfer in a browser. That browser traffic passes through Cloudflare's network, which terminates the encrypted connection at its edge to route and protect it, and processes it only on our behalf. Mail delivery between mail servers, and connections from mail apps over IMAP, SMTP and JMAP, go straight to our own server and never pass through Cloudflare.

Other recipients

• The people you communicate with. When you send mail or transfers, your recipients and their mail providers receive what you send. Once a message leaves our servers, the recipient's provider handles it under its own policy.
• People you share with. Anyone you give a Exito Vault share link or a transfer link to, the owner of a request link you upload to, and, for Business accounts, the owner of your organization (your name, address and storage use, not your content).
• Your organization. For Business accounts, as described in When we act for someone else.
• Your browser's push service. If you turn on notifications, we send them through the push service of your browser or device maker (Google, Apple, Mozilla or Microsoft). Each notification is encrypted end to end for your device, so the push service can't read it; it sees only the push address, when it is sent and its size. By default a notification only says that you have new mail.
• Your DNS provider. When you connect a domain with Domain Connect or API credentials, it receives your domain name and the records we need.
• DNS blocklist operators. They receive only the IP address or domain name being checked, as a DNS query (see Automated filtering).
• Certificate authority. If the Service obtains a TLS certificate for a hostname on your custom domain, the hostname is sent to our certificate authority, Let's Encrypt, and, as with every publicly trusted certificate, published in public Certificate Transparency logs.
• Professional advisers. Lawyers, accountants and auditors, under a duty of confidentiality, where needed.
• NCMEC. The US National Center for Missing & Exploited Children receives our reports of apparent child sexual abuse material, as US law requires, and may share them with law enforcement in the US and other countries.
• Authorities. Only where the law requires it, as described below.
• A successor. If ExitoMail is merged or acquired, or its assets are transferred, the successor must keep protecting your data under this policy, and we will tell you before your data becomes subject to a different privacy policy.

Stripe and Link as independent controllers

When you buy a paid plan, Stripe and its affiliate Sold through Link, LLC act as merchant of record and process your payment, billing and order data as independent controllers under the Link Privacy Policy (נפתח בכרטיסייה חדשה) (see Payment data). Stripe also processes data as an independent controller for its own purposes, such as fraud prevention, risk management and meeting its financial regulatory obligations, under the Stripe Privacy Policy (נפתח בכרטיסייה חדשה). For the billing records it keeps for us, Stripe is our processor and is listed above.

Requests from authorities

Because we are a US company, US authorities can require us to disclose data in our possession, custody or control, wherever it is stored, through valid legal process (for example under 18 U.S.C. § 2713, the “CLOUD Act”). Authorities in the EU and elsewhere can also send us orders. Our policy for every request:

• We disclose personal data to public authorities only when the law requires it, in response to a request that is valid and binding on us under the law that applies to us. We review every request and challenge those that are unlawful or too broad.
• We disclose only the data the request legally requires.
• We tell you about a request for your data before we disclose it, unless the law forbids it or doing so would put someone at risk. Where we receive an order under Article 9 or 10 of the Digital Services Act, we inform you as that Regulation requires.
• If we become aware of information giving rise to a suspicion that a criminal offense involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we inform the competent authorities, as Article 18 of the Digital Services Act requires.
• We never build back doors into the Service, and we give no authority direct or bulk access to our systems.

Your data is stored in the European Union. We, the company that runs the Service, are in the United States.

Server (web app, mail server, databases)

netcup GmbH, Nuremberg, Germany

Mail and Vault files

Wasabi, region EU-Central-2 (Frankfurt, Germany)

Backups

Wasabi, region EU-Central-1 (Amsterdam, Netherlands)

Exito Transfer files

Cloudflare R2, in the EU jurisdiction

What it means that we are a US company

When you give us your data, for example by signing up or by sending and receiving mail, you give it directly to us, a controller in the United States that is subject to the GDPR. According to the European Data Protection Board (Guidelines 05/2021), that direct collection is not a “transfer” under Chapter V of the GDPR, but the GDPR applies to everything we do with the data. Our staff may access data stored in the EU from the United States to run and support the Service, and US law applies to us, including the possibility of US government access described in Requests from authorities. We take these risks into account in our security measures, and we keep data in the EU, encrypt it in transit and in object storage, restrict who can access it and disclose it only as described in this policy.

When data is passed on

• Providers established outside the EEA. Wasabi, Cloudflare and Stripe are established in the United States. Wasabi and Cloudflare R2 store our data in the EU, but these providers may access it from outside the EEA where needed to operate their service, and Stripe processes our billing records in the United States.
• Buying a paid plan. You give your payment details directly to Stripe and Link on Link's checkout page. They collect them as independent controllers, and their own transfers, including to the United States, are covered by the safeguards described in the Link Privacy Policy (נפתח בכרטיסייה חדשה). When we send data to Stripe to start a checkout, or receive order data back, the safeguards below apply.
• EU providers returning data to us. Where a provider in the EU, such as our hosting provider, makes data available to us in the United States, that disclosure is covered by Standard Contractual Clauses.
• Website traffic. Requests to exitomail.com, including the web app, are handled by the Cloudflare data center that serves you, normally the one nearest to you, which can be outside the European Economic Area.
• Your own messages. When you send mail or transfers to someone outside the EEA, the data necessarily goes to their provider, wherever it is. That is what you asked the Service to do, and it is necessary to provide it.

Safeguards

• Where the recipient is certified under the EU–US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795). Cloudflare, Inc. and Stripe, LLC are certified.
• Otherwise, or as a fallback, we use the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914. Wasabi is not certified under the Data Privacy Framework, so we rely on these clauses for it.
• We add supplementary measures: storage in the EU, encryption in transit and at rest, strict access control, data minimization, and the request policy in Requests from authorities.
• For data from the United Kingdom and Switzerland, we rely on the UK Extension and the Swiss–US Data Privacy Framework, or on the Standard Contractual Clauses with the UK Addendum and the Swiss adaptations, as applicable.

To get a copy of the safeguards we use, write to privacy@exitomail.com. We may remove commercially sensitive terms from the copy.

We keep personal data only as long as we need it for the purposes in this policy, then delete or anonymize it. Content you keep stays until you delete it; everything else follows this schedule.

Other data

We keep data longer only where the law requires it, or for as long as needed for a specific legal claim or an order from an authority (a “legal hold”), and only the data concerned.

When you delete your account

You can ask us to delete your account in your settings. For 30 days you can still change your mind; after that we delete your mailbox, files, transfers and account data. Copies in database backups are deleted 30 days later. We keep only what the law requires (such as invoices) and records listed above, such as abuse cases, for their stated periods. For Business accounts, the organization decides what happens to a member's data, under the DPA.

Our security program is modelled on ISO/IEC 27001:2022 and ISO/IEC 27701; we are not certified under either standard. Details, and how to report a vulnerability, are on our Security page.

• Encryption in transit. TLS for the website and web app (certificates from Let's Encrypt), and for IMAP, SMTP submission and JMAP. Between mail servers we use TLS whenever the other side supports it, and we support MTA-STS and TLS reporting so that delivery can require encrypted connections.
• Encryption at rest. Mail content, Exito Vault files, Exito Transfer files and backups are kept by storage providers that encrypt data at rest. Backups are also encrypted on our server before upload.
• Account protection. Passwords stored only as hashes, two-factor authentication with authenticator apps, and separate app passwords for mail apps.
• Email authentication. We sign outgoing mail with DKIM (Ed25519 and RSA keys) and support SPF and DMARC for every domain, to make spoofing harder.
• Access control. Least-privilege access for staff. Administrative access to servers uses SSH keys only, never passwords. Secrets are kept outside the codebase with root-only access.
• Hardened infrastructure. Host firewall, automatic blocking of repeated failed logins, and automatic security updates.
• Logging and audit. Security events and administrative actions are recorded in an audit log.
• Backups. Regular backups, stored at Wasabi, region EU-Central-1 (Amsterdam, Netherlands), so the Service can be restored after a failure.
• Incident response. A documented process to contain, investigate and report incidents. See Personal data breaches.

Under the GDPR you have the following rights over your personal data. They are free of charge.

• Access. Confirmation of whether we process your data, a copy of it, and information about how we use it (Art. 15).
• Rectification. Correction of inaccurate data and completion of incomplete data (Art. 16).
• Erasure. Deletion of your data where there is no longer a reason to keep it (Art. 17).
• Restriction. Limiting how we use your data, for example while we check a complaint you made (Art. 18).
• Portability. Your data in a structured, commonly used, machine-readable format, or sent to another provider where technically feasible (Art. 20). Mail can be exported in standard formats over IMAP, and files are downloaded in their original format.
• Objection. To processing based on our legitimate interests, on grounds relating to your situation (Art. 21). We then stop unless we have compelling legitimate grounds that override your interests, such as security of the Service, or need the data for legal claims. You can always object to direct marketing, which we don't do.
• Withdrawing consent. At any time, where we rely on consent, without affecting processing that took place before (Art. 7(3)).
• Automated decisions. Where a decision based solely on automated processing significantly affects you, to obtain human intervention, to express your point of view and to contest the decision (Art. 22(3)). See Automated filtering, enforcement and decisions.
• Complaint. To lodge a complaint with a supervisory authority, as described below (Art. 77).

How to exercise them

1. 1
   Use the app where you can
   Many rights work directly in the Service: edit your profile, download your files, export your mail with any IMAP app, delete messages and files, or delete your account in your settings.
2. 2
   Or write to us
   Email privacy@exitomail.com, ideally from your account address or your recovery email, and tell us which right you want to exercise. If you have no account (for example as a transfer recipient), tell us the details that help us find your data.
3. 3
   We confirm it is you
   We ask only for what we need to verify your identity, in proportion to the request, so that we never give your data to someone else.
4. 4
   We respond within one month
   If a request is complex or we receive many, we may extend this by up to two further months. If so, we tell you within the first month and explain why.

Exercising your rights is free. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or decline it, and we explain why (Art. 12(5)).

Business accounts

If your account is provided by an organization, the organization is the controller of your data in it. We forward requests we receive about that data to the organization, tell you that we did, and help the organization respond, as our DPA requires.

Complaints

You can lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live, where you work, or where you believe the infringement took place (Art. 77). Because we have no establishment in the EU, no single authority leads on our processing. The European Data Protection Board (נפתח בכרטיסייה חדשה) lists the authorities. In the United Kingdom, you can complain to the Information Commissioner's Office (נפתח בכרטיסייה חדשה). We would appreciate the chance to resolve your concern first at privacy@exitomail.com, but you don't have to contact us before you complain.

Our representatives

If you are in the EU or EEA, the UK or Switzerland, you can also send privacy requests to our representative there:

EU and EEA: Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה). It also has an address in every other EU and EEA country: see all addresses.

UK: Data Protection Representative Limited (trading as DataRep), 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה).

Switzerland: Data Protection Representative Limited (trading as DataRep), Leutschenbachstrasse 95, Zurich, 8050, Switzerland. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה).

Address letters to “DataRep”, not to ExitoMail, or they may not reach it, and name ExitoMail in your letter. DataRep passes your request on to us, and we may ask you to confirm your identity before we answer. For questions about your account, billing or our services, write to support@exitomail.com instead: DataRep only handles requests under the laws named above.

You must be at least 16 to use the Service. It is not directed to children, and we don't knowingly collect personal data from anyone under 16, including children under 13 within the meaning of the US Children's Online Privacy Protection Act. The eligibility rules are in our Terms of Service.

If we learn that we hold an account or data belonging to such a child, we delete it promptly. If your child has given us personal data, please write to privacy@exitomail.com. For accounts provided by a Business organization, we inform the organization.

We only use cookies and browser storage that are strictly necessary to run the Service, such as keeping you signed in, protecting forms and remembering your theme. We use no analytics, advertising or tracking cookies, which is why there is no cookie banner. The full list is in our Cookie Policy.

A personal data breach is a security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without authorization. If one happens, we follow this process:

1. 1
   Contain and assess
   We act immediately to stop the breach, find out what happened and assess the risk to the people affected.
2. 2
   Notify the supervisory authorities
   Unless the breach is unlikely to result in a risk to people’s rights and freedoms, we notify the competent supervisory authorities without undue delay and, where feasible, within 72 hours of becoming aware of it, with reasons for any delay (Art. 33 GDPR). Because we have no establishment in the EU, that means the authority of each EU country where affected people live, and the UK Information Commissioner for people in the UK.
3. 3
   Tell you
   If the breach is likely to result in a high risk to you, we tell you without undue delay, in plain language: what happened, the likely consequences, what we have done and what you can do to protect yourself (Art. 34 GDPR). We use your account and recovery addresses and the app, or a public notice where individual messages would be impossible or disproportionate.
4. 4
   Business customers
   We notify the affected organization without undue delay, with the information it needs to meet its own obligations, as set out in the DPA.
5. 5
   Learn from it
   We document every breach, its effects and the remedial action taken, and improve our safeguards. Where other laws, such as US state breach-notification laws, require notice, we give it as they require.

Changes to this policy

We update this policy when our processing changes or the law requires it, and show the version and date at the top. If a change is material, for example a new purpose, a new category of data, or a provider that changes where your data is stored, we tell you in advance by email and in the app, before it takes effect. Where a change needs your consent, we ask for it. Previous versions are available on request.

Contact

Privacy questions and requests

privacy@exitomail.com

Data Protection Officer

Not appointed. Write to privacy@exitomail.com.

Representative in the EU

Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה). It also has an address in every other EU and EEA country: see all addresses.

Representative in the UK

Data Protection Representative Limited (trading as DataRep), 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה).

Representative in Switzerland

Data Protection Representative Limited (trading as DataRep), Leutschenbachstrasse 95, Zurich, 8050, Switzerland. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה).

Security vulnerabilities

security@exitomail.com

Abuse and illegal content

abuse@exitomail.com, or see Notice & Action

By post

EXITO Media LLC, a Wyoming limited liability company (Wyoming Secretary of State, filing ID 2022-001141268), with its business address at 111 NE 1st St, 8th Floor, #88287, Miami, FL 33132, United States

Several US states, including California, have comprehensive consumer privacy laws. They apply to businesses above certain size thresholds (in California, for example, annual gross revenue above $26,625,000, or buying, selling or sharing the personal information of 100,000 or more consumers or households). Based on our current size, we believe we do not meet those thresholds, so those laws do not currently apply to us. If that changes, we will update this section.

What we do for everyone in the US anyway

• We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising. We don't use it for profiling that produces legal or similarly significant effects, other than the automated enforcement described in Automated filtering, enforcement and decisions.
• Wherever you live, you can ask us to confirm whether we process your personal information, to give you a copy, to correct it or to delete it, as described in Your rights. We answer within one month, and we explain our reasons if we decline.
• We will not treat you differently because you made a request.
• We use the contents of your mail and files only to provide and secure the Service, never to infer anything about you.

The categories of personal information we collect, their sources, our purposes, the recipients and how long we keep them are set out in the sections above. To make a request, write to privacy@exitomail.com.