Privacy Policy & Security Standards
MailsDaddy Software Solutions (“MailsDaddy”, “we”, “us”, or “our”) is committed to protecting your personal data, mailbox archives, and confidentiality. We operate under strict principles of data minimization, purpose limitation, zero retention of mailbox content, and complete transparency.
1. Dual Deployment Architecture
Desktop Offline Applications
100% offline. Files never leave your local computer or enterprise network. All decoding, recovery, and PST generation occurs on your CPU.
Cloud Online Converters (SaaS)
Web-based conversion platform. Files are transferred over TLS 1.3 to Cloudflare R2, processed in ephemeral single-tenant Google Cloud Run containers, and permanently destroyed within 24 to 48 hours.
2. Information We Collect
Account & Authentication Data
Email address, display name, account creation date, and credit balances stored securely in our Supabase PostgreSQL database.
Conversion Job Metadata
Source format (OST, MBOX, OLM), original file name, file size, status, timestamp, random UUIDv4 download token, and expiration timestamp.
Billing Information (PCI-DSS Scoped)
Handled exclusively by PayPro Global Inc. as Merchant of Record. MailsDaddy never receives, stores, or processes complete credit card numbers or security CVVs.
Mailbox Contents
Processed autonomously by deterministic container pipelines. MailsDaddy employees do NOT read, index, sample, or sell customer email contents.
3. Ephemeral Cloud Processing & Security Architecture
Direct-to-Storage Ingress
Files stream directly from your browser to private Cloudflare R2 object storage via 30-minute AWS SigV4 presigned upload URLs over TLS 1.3.
Isolated Containers
Conversions execute in Google Cloud Run container instances with concurrency pinned to 1. No multi-tenant memory sharing.
Immediate Scratch Wipe
Ephemeral disk scratch paths (/tmp) on container SSD are deleted in a guaranteed atomic finally block immediately upon job completion or termination.
Tokenized Retrieval
Downloads are accessible only via cryptographically unguessable UUIDv4 tokens validated against expiration timestamps, returning 15-minute presigned GET URLs.
4. Automated 24h & 48h Purge Lifecycle
Free Plan Retention (24 Hours)
Source files and converted PST files are permanently purged by Cloudflare R2 bucket lifecycle rules after 24 hours.
Premium Plan Retention (48 Hours)
Source files and converted files are permanently purged after 48 hours.
Deletion is permanent and total. Once purged, files cannot be restored by MailsDaddy, cloud providers, or any third party.
5. Zero Data Mining & No AI Training Guarantee
Explicit Guarantee on Customer Mailboxes
MailsDaddy expressly warrants that it does NOT use, read, analyze, summarize, or train any Artificial Intelligence (AI), Large Language Model (LLM), or machine learning system on user-uploaded mailbox archives or converted PST files.
6. Authorized Sub-processors
We collaborate exclusively with industry-leading cloud infrastructure providers adhering to stringent SOC 2, ISO 27001, and GDPR compliance standards:
| Sub-processor | Role | Location | Data Handled |
|---|---|---|---|
| Cloudflare, Inc. | Edge routing, DDoS defense, R2 storage | USA / Global | Encrypted upload/converted files |
| Google Cloud Platform | Ephemeral container compute (Cloud Run) | USA | In-memory/scratch file conversion |
| Supabase, Inc. | Database, Auth & Token tracking | USA / EU | Email, user ID, job status |
| Resend, Inc. | Transactional notification email | USA | Email address, download token link |
| PayPro Global, Inc. | Merchant of Record & PCI-DSS billing | Canada / USA / EU | Billing address, order transactions |
7. GDPR & Legal Bases for Processing
We process personal data under Article 6 of the EU/UK GDPR under the following legal bases:
Contractual Performance
GDPR Art. 6(1)(b)To perform requested mailbox conversions and manage customer accounts and software licenses.
Legitimate Interests
GDPR Art. 6(1)(f)System security, abuse prevention, rate-limiting, and infrastructure stability.
Legal Obligation
GDPR Art. 6(1)(c)Tax auditing, financial accounting, anti-fraud compliance, and statutory regulatory obligations.
8. Your Privacy Rights (GDPR, CCPA/CPRA & Indian DPDP Act)
Users worldwide may exercise their statutory privacy rights:
- Right to Access & Portability: Request confirmation of processing and obtain a digital copy of your account profile.
- Right to Rectification: Request correction of inaccurate personal contact details.
- Right to Erasure (“Right to be Forgotten”): Request deletion of account credentials and metadata.
- California Consumer Notice (CCPA/CPRA): We DO NOT sell or share personal data for cross-context behavioral advertising.
- Indian DPDP Act 2023: Full right to grievance redressal and nomination rights.
To exercise any of these rights, email [email protected]. Requests are fulfilled within 30 days without cost.
9. Cookies & Local Storage
mailsdaddy_theme
Stores dark and light mode visual preference in browser local storage.
Supabase Auth Cookies
Maintains secure authenticated session state for cloud conversion access.
Google Analytics
Aggregated performance analytics with strict IP anonymization enabled.
10. Data Protection & Privacy Contacts
MailsDaddy Software Solutions — Data Protection & Legal
Address: Khanpur Extn, New Delhi - 110062, India
Phone: +91-7836996337
Email: [email protected]