Privacy Policy

1. Scope & pilot status

This policy covers the MailMoolah website and application at mailmoolah.com. In it, “MailMoolah”, “we”, and “us” mean the operator of that platform. The policy explains what we record, why, and what you can ask us to do about it.

2. What we collect

• Account identity. Your name, email address, and profile details. Sign-in is handled by SharedAuth, our shared single sign-on service; MailMoolah receives your identity from it after you sign in.
• Email engagement. For campaign mail sent to you through MailMoolah, we record that a message was delivered, opened, or clicked, with a timestamp and the campaign the event belongs to. These events are reported to us by our email-delivery service.
• Approved-sender decisions. The senders you approve, reject, block, or revoke, so we can apply your choices to future mail.
• Referral activity. Referral codes you create and the referral events linked to them.
• Reward ledger entries. Entries recording reward activity on your account and their state.
• Payout routing reference. If you configure a payout method, we store the name of the provider you selected and an opaque account reference — nothing more. Section 3 lists what this deliberately excludes.
• Device & usage data. Standard server logs record your IP address, your browser and operating system (from its user-agent string), and the pages you request.
• Messages you send us. What you submit through our contact form or send to our support address.

3. What we do not collect

We are naming these explicitly because they are commonly assumed:

• Your password. MailMoolah does not create, store, or reset passwords. Authentication happens entirely in SharedAuth, and your credentials are never sent to MailMoolah.
• Bank account, card, or wallet details. The platform has no field for an account number, routing number, IBAN, card number, or wallet key, and does not receive them.
• How long you spend reading. We record that a message was opened or a link clicked. We do not measure dwell time or reading duration.
• The contents of your personal mailbox. We process only mail sent through MailMoolah.

4. How we use it

• To operate your account and show you your reward ledger.
• To apply your approved-sender decisions to campaign mail addressed to you.
• To record engagement on campaign mail — the activity the reward features being validated during the pilot are based on.
• To record referral activity you generate.
• To detect and prevent fraud, abuse, and breaches of our Terms of Service.
• To respond to your support requests.
• To keep the service working and improve it, using aggregated usage data.

Where applicable law requires a legal basis for processing, we rely on: performing our agreement with you (operating your account and the features you use); our legitimate interests (keeping the platform secure, preventing fraud and abuse, and improving the service); your consent, where we ask for it; and compliance with legal obligations. Section 9 explains how to withdraw consent.

5. Sharing

We do not sell your personal information. We share it only in these cases:

• SharedAuth. Our single sign-on service, which holds your credentials and confirms your identity to MailMoolah.
• Advertisers and campaign owners. Senders see engagement reporting for their own campaigns and their own mailing lists: aggregate delivery, open, and click counts, and — for people already on their list — engagement with their own messages. A sender is not shown your activity with any other sender, and we do not give senders contact details they did not already hold.
• Infrastructure providers. The hosting and email-delivery services that run the platform, limited to what they need to provide it.
• Legal obligations. Where we are required to by law, regulation, or valid legal process.
• Business transfers. If MailMoolah is reorganised, merged, or sold, your data may be transferred as part of that change. This policy will continue to apply to it until a replacement takes effect under section 12.

No payment processor is integrated during the pilot, so no payment data is shared with one. If that changes, we will update this policy and this section before it takes effect.

6. International transfers

Your data is stored and processed where the servers that host MailMoolah are located. If you use the platform from another country, your data will be transferred there. We have not adopted a specific cross-border transfer mechanism during the pilot; if one becomes required, we will put it in place and describe it here.

7. Cookies

We use cookies and similar technologies (such as local browser storage) to keep you signed in and to remember preferences such as light or dark appearance. We do not use cookies for third-party advertising or cross-site tracking. Email engagement is recorded through the campaign mail itself and our email-delivery service — not through cookies on this site.

You can clear or block cookies in your browser. Blocking essential cookies will sign you out.

8. Retention & account closure

We keep your account data for as long as your account is open. Engagement and reward-ledger records are kept while they remain relevant to your account or to fraud prevention, and for as long as we are required to keep them for legal, tax, or accounting purposes.

We have not yet adopted fixed deletion periods for each category of data. When we do, we will publish them here — we will not publish a schedule we do not operate to.

When your account is closed, we stop using your data for the purposes in section 4 and remove or anonymise what we no longer need, keeping only records required for legal, tax, accounting, or fraud-prevention purposes. During the pilot this is a manual process carried out by a person, so it is not instant. To request deletion, see Your choices.

9. Your choices

Depending on where you live, you may have the right to:

• Ask what personal data we hold about you, and get a copy.
• Ask us to correct data that is wrong.
• Ask us to delete your account and associated data.
• Object to or ask us to restrict certain processing.
• Withdraw consent where our processing relies on it.
• Complain to your local data protection authority.

To make any of these requests, email support@mailmoolah.com or use our contact form. Requests are handled by a person, not an automated pipeline, so please allow time for a reply. You can also change your approved senders and appearance preferences yourself at any time from your account.

We do not make decisions about you by automated means that produce legal or similarly significant effects. Account suspensions and reward-ledger corrections are decided by a person, not an algorithm.

10. Children

MailMoolah is not directed at children. You must be at least 18 to hold an account (see our Terms of Service), and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will close it.

11. Security

Traffic between your browser and MailMoolah is encrypted in transit using TLS. Access to the platform is authenticated through SharedAuth, and what each account can see and do is restricted by role.

We do not claim any security certification or independent audit, because we hold none. No system is completely secure; if we become aware of a breach affecting your data, we will act on it and notify you where we are required to.

12. Changes

When we change this policy we will publish the new version here with a new version number and effective date. Material changes will be signalled in the product before they take effect.

13. Contact

Questions about this policy or how your data is handled:

• support@mailmoolah.com
• Contact form

See also our Terms of Service.