Legal & Data Security

Privacy Policy & Security Standards

Effective August 2026. We believe in strict data minimization: we process only the cryptographic routing headers necessary to connect your custom domain to your Gmail inbox.

Absolute Guarantee

Zero AI Training

Your emails and contact data are never sold, analyzed, or used to train AI models.

CASA Compliant

AES-256 Tokens

All Google OAuth credentials are encrypted at rest with military-grade AES-256-GCM.

Multi-Tenant RLS

Tenant Isolation

Every database query is enforced via cryptographic PostgreSQL Row Level Security (RLS).

Right to Erasure

30-Day Hard Purge

When an organization is deleted, all stored credentials and records are permanently erased.

Section 1

Information We Collect & Process

When you create a workspace, add custom domains, or provision employee inboxes on Mailcoy, we collect:

Workspace Identity:

Admin name, work email address, company name, industry, and billing status.

Domain Verification Data:

Domain name, DNS nonces, TXT/MX records, and SPF/DKIM verification states.

Team & Alias Metadata:

Employee display names, department titles, assigned aliases, and routing rules.

Encrypted OAuth Tokens:

Restricted Google API tokens stored via AES-256 envelope encryption.

Section 2

Google User Data & Restricted Scopes Disclosure

Mailcoy requests restricted Google OAuth scopes exclusively to synchronize Send-As aliases and relay outgoing emails composed inside your official Gmail client on behalf of your verified custom domain.

Google API Services User Data Policy Compliance:

Mailcoy’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

Human employees never view your private email content without explicit consent for support.
We do not serve third-party ads or sell user information to data brokers.
Restricted tokens are rotated and invalidated immediately upon employee removal.

Section 3

Infrastructure & Sub-Processors

We work with enterprise-grade sub-processors to ensure sub-second routing speed and 99.99% uptime:

Processor	Role & Function	Data Residency	Compliance
Amazon Web Services (SES)	High-throughput outbound SMTP delivery & DKIM signing	us-east-1 (N. Virginia)	SOC 2 / ISO 27001
Supabase Enterprise	Encrypted PostgreSQL database & Auth provider	Global Anycast / US	SOC 2 Type II / HIPAA
Paystack & Stripe	PCI-DSS subscription processing & invoice generation	Global / Nigeria	PCI-DSS Level 1

Section 4

Your Data Rights & Inquiries

You possess the full right to export, rectify, or purge your organization's records at any time. For compliance inquiries, data protection agreements (DPA), or security audits, contact our designated privacy officer:

Email Data Protection Officer Open Support Ticket →