Your privacy, explained in calm words

1. Data controller

Ayamail is a product developed and owned by 3XAYA LTD. The service is operated by 3XAYA LTD, a company registered in England and Wales under company number 17437429, registered office 128 City Road, London, EC1V 2NX, United Kingdom. 3XAYA LTD is the data controller for the personal data you provide when using the service.

Data protection contact: privacy@ayamail.net. Legal correspondence: legal@ayamail.net.

2. What data do we process?

We process the following categories of data:

• Account data: name, email address and phone number (for SMS verification).
• Content data: your emails, contacts, calendar events and attachments.
• Technical data: IP address, device type, app version and logs for operations and security.
• Domain data: registrant details that we pass to the domain registry when you buy or transfer a domain.

3. Purpose and legal basis

We process data to deliver the service you ordered (UK GDPR art. 6.1.b), to comply with legal obligations such as accounting and tax duties (art. 6.1.c) and based on our legitimate interest in operating and securing the platform (art. 6.1.f).

4. We do not sell data

We never sell, rent or share your data with advertisers. There is no ad tracking in Ayamail, no IDFA and no third-party advertising SDKs.

5. Sub-processors and transfers

Mail servers and app servers run on our own infrastructure in the EU (Hetzner, Germany and Finland). We also use these sub-processors, each of which only receives the data its task requires. They are listed below.

Several of these providers are based in, or may process data in, the United States or other countries outside the United Kingdom and the EU. Transfers outside the United Kingdom rely on the UK International Data Transfer Agreement, the EU standard contractual clauses with the UK Addendum, or another lawful transfer mechanism.

• Supabase: database, sign-in and account records.
• Cloudflare: DNS and abuse protection.
• Stripe: payments and receipts.
• Resend: system mail such as welcome, receipt and one-time code.
• Openprovider and Porkbun: domain name registration and administration. Registrant data is sent to the registrar used for your domain.
• GatewayAPI: SMS one-time codes at sign-up and sign-in.
• Google (Gemini): AI features such as summaries and writing help. The content of the message or text you choose to use the feature on is sent to Google, and only when you use the feature.
• Sentry: error reports with technical data so we can fix crashes.
• Apple: push notifications through the Apple Push Notification service and distribution of the iOS app.

6. Retention and deletion

Account data is retained while your account is active. If you request deletion the account is flagged immediately and permanently removed after 30 days: during that window you can undo it by signing in again. Accounting and invoice records are kept for at least 6 years as required by UK company and tax law.

7. Your rights

You have the right to access, rectification, erasure, restriction and data portability. You can download all of your data inside the app under Settings, My data, and delete your account under Settings, Delete account. If you are unhappy with how we handle your data you may complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

8. Security

All traffic is encrypted (TLS) and passwords are stored hashed. You can enable two-factor authentication and review or revoke active devices under Settings, Security. Abuse and phishing can be reported to abuse@ayamail.net.

Partners and third parties

We never sell your data and never share it with advertisers. We only use partners that are needed to run the service: mail server operations, database and login, payments, domain registration, SMS codes, system mail, error reports, push notifications and AI features when you use them. The full list is in section 5.

Each partner processes only the data the task requires, works on our instructions and is bound by a data processing agreement. If we add a new partner, this policy is updated before that partner is used.

When you sign up, you confirm that you have read the terms and the privacy policy, including this description of partners.

Minimum age

The minimum age for an Ayamail account is 15. If you are under 15, a parent or guardian must create and own the account.

If we find that an account was created by someone under 15 without a parent, we contact the account address before the account is closed.

Consent for cookies and local storage

Necessary storage is used for login, language choice and security, and it cannot be turned off because the service does not work without it.

Everything else requires your active consent. You can change or withdraw consent at any time from the Cookie settings button in the footer.

No profiling or automated decisions

We do not build profiles of you, and we never use the content of your mail for adverts, recommendations or model training.

No automated decisions with legal effect are made about you. Spam filtering only sorts mail and can always be overridden by you.

Complaints to a supervisory authority

If you disagree with how we handle your data, please contact privacy@ayamail.net first so we can put it right.

You can always complain to a data protection authority, for example the Information Commissioner's Office in the UK or the authority in your own country.

Changes to this policy

We update this policy when the service, our partners or the law changes, and the date at the top shows the latest version.

For significant changes we notify you at your Ayamail address before the change takes effect.