Privacy policy
Last updated: 2026-09-11
Ayamail is built on data minimisation: we only process what is required to deliver your email.
1. Data controller
Ayamail is a product developed and owned by 3XAYA LTD. The service is operated by 3XAYA LTD, a company registered in England and Wales under company number 17437429, registered office 128 City Road, London, EC1V 2NX, United Kingdom. 3XAYA LTD is the data controller for the personal data you provide when using the service.
Data protection contact: privacy@ayamail.net. Legal correspondence: legal@ayamail.net.
2. What data do we process?
We process the following categories of data:
- Account data: name, email address and phone number (for SMS verification).
- Content data: your emails, contacts, calendar events and attachments.
- Technical data: IP address, device type, app version and logs for operations and security.
- Domain data: registrant details that we pass to the domain registry when you buy or transfer a domain.
3. Purpose and legal basis
We process data to deliver the service you ordered (UK GDPR art. 6.1.b), to comply with legal obligations such as accounting and tax duties (art. 6.1.c) and based on our legitimate interest in operating and securing the platform (art. 6.1.f).
4. We do not sell data
We never sell, rent or share your data with advertisers. There is no ad tracking in Ayamail, no IDFA and no third-party advertising SDKs.
5. Sub-processors and transfers
Mail servers run on our own infrastructure in the EU (Hetzner, Germany and Finland). Database and sign-in are provided by Supabase, payments by Stripe and domain registration by Openprovider. Transfers outside the United Kingdom rely on the UK International Data Transfer Agreement or the EU standard contractual clauses with the UK Addendum.
6. Retention and deletion
Account data is retained while your account is active. If you request deletion the account is flagged immediately and permanently removed after 30 days: during that window you can undo it by signing in again. Accounting and invoice records are kept for at least 6 years as required by UK company and tax law.
7. Your rights
You have the right to access, rectification, erasure, restriction and data portability. You can download all of your data inside the app under Settings, My data, and delete your account under Settings, Delete account. If you are unhappy with how we handle your data you may complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.
8. Security
All traffic is encrypted (TLS) and passwords are stored hashed. You can enable two-factor authentication and review or revoke active devices under Settings, Security. Abuse and phishing can be reported to abuse@ayamail.net.
Partners and third parties
We never sell your data and never share it with advertisers. We only use partners that are needed to run the service: mail server operations, database and login, payments and domain registration.
Each partner processes only the data the task requires, works on our instructions and is bound by a data processing agreement. If we add a new partner, this policy is updated before that partner is used.
When you sign up, you confirm that you have read the terms and the privacy policy, including this description of partners.
Minimum age
The minimum age for an Ayamail account is 13. If you are under 13, a parent or guardian must create and own the account.
If we find that an account was created by someone under 13, we contact the account address before the account is closed.
No profiling or automated decisions
We do not build profiles of you, and we never use the content of your mail for adverts, recommendations or model training.
No automated decisions with legal effect are made about you. Spam filtering only sorts mail and can always be overridden by you.
Changes to this policy
We update this policy when the service, our partners or the law changes, and the date at the top shows the latest version.
For significant changes we notify you at your Ayamail address before the change takes effect.