Legal

Privacy policy

Draft: this page is still being reviewed and some details are not filled in yet.

Last updated: 2026-10-31

This policy explains what information Delicious Mail collects, why we collect it, who we share it with, and the choices you have. It covers our website (deliciousmail.com), our free tools, checkout, and the Delicious Mail app.

1. Who we are

Delicious Mail is run by [[ENTITY NAME]], [[ADDRESS]] ("Delicious Mail", "we", "us").

For your account, billing and our website, we decide how your information is used. Under the GDPR and UK GDPR, that makes us the "controller."

For the contacts, campaigns and mail you handle in the app, you decide how that information is used. You are the controller, and we process it on your behalf as your "processor." Section 9 explains what that means for the people you email.

Questions about this policy go to privacy [at] deliciousmail.com.

Our data protection officer is [[DPO CONTACT]].

Our representative in the EU and UK is [[EU UK REPRESENTATIVE]].

2. What we collect and why

Account and checkout details

When you buy a plan or a spam test pack, checkout asks for your first name, last name, work email, company, country and postcode. After you pay, you set a password and we create your account. If you invite teammates, we collect their names and email addresses too.

We use this to create and run your account, take payment, send receipts, and contact you about your service.

We save your details from step 1 of checkout before you pay. If you don't finish, we may email you once or more to help you complete your order. Every one of these emails has a way to opt out.

Billing details

You pay through Stripe (card), PayPal, Paddle or Lemon Squeezy. Each one runs its own payment form on our page. Your full card number and bank details go to that provider, not to us. We receive a record of the payment, such as the amount, the date, the plan, the last digits of your card, and whether the payment worked. We also keep any coupon code you used. Tax is calculated at payment, so your country and postcode are used for that.

Domains you connect or buy

To set up and check your domains, we read and store their DNS records, such as SPF, DKIM, DMARC and MX. If you buy a domain through Delicious Mail, we share the registrant details the domain registrar and registry require. Some of those details may appear in public domain records (WHOIS) where their rules require it.

Mailboxes you connect

To send and receive mail for you, we store the login details for each mailbox you connect. Depending on the mailbox, that is a username and password, or an access token you grant through your email provider's sign-in (OAuth). We also store the mailboxes we create for you on your domains.

If you connect a Google account, our use of information we receive from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Email content we process

Warm-up emails. We write warm-up emails ourselves. Your connected mailboxes send and receive them with other mailboxes in our warm-up pool. They do not contain your campaign content or your contacts' details. We filter them out of your inbox automatically.
Campaigns and replies. We process the sequences you write, the contact lists you upload, and the replies you receive. We do this only to check your lists, send your campaigns and follow-ups, show replies in your shared inbox, and track deals. We do not read your mail for any other reason.
Ask Basil. When you ask our in-app assistant a question, we process the question, its answer, and the account data needed to answer it, such as your domains, mailboxes and campaign stats.

Free tools

SPF, DKIM and DMARC checker. The check runs in your browser. Your browser sends the domain name and DKIM selector you enter to public DNS services run by Google and, if that fails, Cloudflare. Those companies receive your IP address and the domain you looked up. We do not receive or store the result.
Email spam test. Each test gets its own one-time address. When you send a message to it, we receive that message, including its headers, content, links and images, and the IP address it was sent from. We use it to build your report. The report has a share link. Anyone who has the link can see a read-only copy of the report until the link expires after 30 days.
Free test limit. If you are not logged in, you get 5 free spam tests a day. To count them, we record your IP address and a small identifier stored in your browser.
Warm-up schedule calculator. The calculator runs in your browser. We do not store what you enter.

Contact and support

When you write to us or use the contact form, we collect your name, email address and message, and we keep our replies.

Usage, device and analytics data

When you use the website or app, we collect basic technical data. This includes your IP address, browser and device type, pages you visit, the site that sent you, and actions you take in the app. We use it to run the service, keep it secure, fix problems, and learn which pages and features people use.

Our website uses Google Analytics 4 to measure visits. Google Analytics uses cookies and collects data such as pages viewed, approximate location, and device type.

Our website loads its fonts from Google Fonts. When a page loads, your browser connects to Google's servers, which receive your IP address.

Cookies and similar technology

We use:

Necessary cookies and storage to keep you logged in, keep checkout working, protect the site, and count free spam tests.
Analytics cookies from Google Analytics 4 to understand how the website is used. Where the law requires your consent, we only set these after you agree. You can change your choice at any time, and you can also block cookies in your browser.
Payment provider cookies. Stripe, PayPal, Paddle and Lemon Squeezy may set their own cookies when their payment forms load, to process payments and prevent fraud.

3. Legal bases (GDPR and UK GDPR)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

What we do	Legal basis
Create and run your account, take payment, deliver the service, give support	Performing our contract with you
Keep billing and tax records	Legal obligation
Follow up on an unfinished checkout	Legitimate interests (helping you finish an order you started)
Keep the service secure, prevent fraud and abuse, enforce free-tool limits	Legitimate interests
Improve the website and app using usage data	Legitimate interests
Analytics cookies, where consent is required	Consent
Send you marketing emails, where consent is required	Consent
Handle your contacts and campaign mail	We act as your processor; you choose the legal basis

Where we rely on legitimate interests, we weigh them against your rights. You can object at any time (see section 8). Where we rely on consent, you can withdraw it at any time. That does not affect what we did before.

4. Who we share information with

We do not sell your personal information.

We share it only with service providers that help us run Delicious Mail, and only for that purpose:

Payment providers: Stripe, PayPal, Paddle and Lemon Squeezy. Paddle and Lemon Squeezy may act as the reseller ("merchant of record") for orders they process. In that case, they also use your details under their own privacy notices.
Hosting and infrastructure: the companies that host our app, store our data, and run our email sending.
Domain registrars: when you buy a domain through us.
Analytics and fonts: Google, for Google Analytics 4 and Google Fonts.
Public DNS services: Google and Cloudflare receive lookups made by the checker from your browser.

We ask each provider to protect your information and to use it only to provide its service to us. We can give you a current list of providers on request.

We may also share information:

when the law requires it, such as a valid court order;
to protect our users, the public, or our service from fraud, abuse or harm;
with a buyer or successor if our business is sold or merged. We will tell you before your information becomes subject to a different privacy policy.

The warm-up pool is shared. Your connected mailbox addresses exchange warm-up emails with other mailboxes in the pool, which may belong to other customers. Those warm-up emails never include your campaign content or contacts.

5. International transfers

Our service is hosted in [[HOSTING REGION]]. Some of our providers work in other countries, including the United States. When we move personal data out of the EEA, UK or Switzerland, we use a lawful transfer method. Examples are the European Commission's Standard Contractual Clauses, the UK Addendum to them, or an adequacy decision. Contact us for more detail.

6. How long we keep information

Information	How long we keep it
Spam test reports and the test message	30 days. The share link stops working when it expires.
Details from an unfinished checkout	[[ABANDONED CHECKOUT RETENTION]]
Everything else, including account, mailbox, domain, campaign and support data	As long as your account is active, plus a limited period needed for legal and billing reasons

When you disconnect a mailbox or close your account, we delete the stored mailbox login details. Billing and tax records are kept for as long as the law requires.

7. Security

We protect your information with technical and organizational safeguards. Mailbox login details are encrypted when stored. Only staff who need access to support you can reach customer data, and that access is logged. Spam test messages are shown in a sandbox that blocks scripts and forms, and remote images stay blocked until you choose to load them.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.

8. Your rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you;
Correct information that is wrong;
Delete your information;
Port your information, which means getting a copy in a common format;
Object to processing based on legitimate interests, and to direct marketing at any time;
Restrict how we use your information in some cases;
Withdraw consent where we rely on it.

You can view, correct and export much of your information from Settings in the app. For anything else, email privacy [at] deliciousmail.com. We may need to confirm your identity before we act. We will reply within the time the law sets.

If you are in the EEA or UK, you can also complain to your local data protection authority.

California and other US states

If you live in California or another US state with a privacy law, you may have the right to:

know what personal information we collect, use and disclose;
access, correct and delete it;
opt out of the sale or sharing of personal information, and of targeted advertising;
not be treated differently for using these rights.

We do not sell personal information. We do not share it for cross-context behavioral advertising. If that ever changes, we will update this policy and give you a way to opt out. We treat a Global Privacy Control signal from your browser as a request to opt out.

In the last 12 months we collected these categories, from the sources and for the reasons in section 2:

identifiers, such as name, email address and IP address;
customer records, such as company, country, postcode and billing records;
commercial information, such as the plans and products you bought;
internet activity, such as pages viewed and actions in the app;
approximate location, from your IP address or postcode;
professional information, such as your company;
account login details for the mailboxes you connect. We use these only to provide the service you asked for.

We disclose these categories to the service providers listed in section 4, for business purposes only.

You, or an agent you authorize, can make a request by emailing privacy [at] deliciousmail.com.

9. People who receive email through Delicious Mail

If you received an email sent through Delicious Mail, the sender is our customer. They decide who to email and why, and they are responsible for following the law. To unsubscribe, use the opt-out link in the email or reply to the sender. To use your privacy rights, contact the sender first. You can also write to privacy [at] deliciousmail.com, and we will pass your request on and help where we can.

10. Children

Delicious Mail is a business service for people aged 18 and over. We do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will change the "Last updated" date at the top. If a change matters, we will tell account holders by email or in the app before it takes effect.

12. Contact us

Privacy questions and requests: privacy [at] deliciousmail.com
Help with your account: support [at] deliciousmail.com
Post: [[ENTITY NAME]], [[ADDRESS]]