This page describes how the UserMails product handles personal data. It is a description of the running system, not a certification and not a guarantee. Counsel should review it before it is treated as a customer contract.
Who we are
UserMails is the application-email service at usermails.com and api.usermails.com. Contact: hello@usermails.com.
What we store
- Account. Email, password hash, name, email-verification timestamp. We never store the API key in recoverable form — only a hash and a public prefix.
- Mail you send. Recipients, subject, html/text, tags, headers, attachment metadata, and delivery events (queued, sent, delivered, bounced, complained, failed, canceled). Bodies live in Postgres on servers we operate. There is no automatic time-based deletion yet.
- Hosted inboxes. Inbound messages for mailboxes you create, plus optional verified forwarding destinations.
- Secrets at rest. DKIM private keys and connected-account OAuth tokens are encrypted with AES-256-GCM when a DKIM_ENC_KEY is configured.
Why
To provide the sending API, dashboard, hosted inboxes, bounce/complaint handling, and account security you asked for. We do not sell address lists. We do not run advertising or analytics pixels on this site.
Cookies
Dashboard sessions use host-only cookies (um_session, and when relevant um_god / um_activeorg). They are httpOnly, Secure, and SameSite=Lax. They are strictly necessary to keep you signed in. There is no marketing cookie and no consent banner, because there is nothing non-essential to consent to.
Processors
Mail is sent from mail servers we operate. DNS and TLS at the edge go through Cloudflare when a domain uses that path. Agency billing, if enabled on an instance, uses Stripe Connect. Gmail/Outlook connected sending is code-complete and is not offered until those OAuth apps are registered. Uptime monitors may be provided by Better Stack when configured. A current list belongs in a customer DPA; this page will not invent signed-contract dates.
Your rights
Signed-in users can download an account inventory and, when eligible, delete the account from Dashboard → Account → Privacy (GET /app/privacy/export, POST /app/privacy/delete). Export today is an inventory (profile, orgs, project counts) — it does not dump every message body. Delete is refused for platform admins, orgs with other members, and orgs with sub-accounts; sole-owned orgs are cascaded. Email hello@usermails.com for anything the self-serve path cannot do.
Security
See Security. We do not claim to be SOC 2 certified, GDPR certified, or unhackable.