Mailcoy
Get started

Legal & Security

Privacy Policy

Last updated: July 2026. This policy explains how Mailcoy collects, processes, and protects data when you use our business email routing service.

1. Information We Collect

When you register an account or operate a workspace on Mailcoy, we collect:

  • Account & Workspace Identity: Name, work email address, company name, industry, and billing details.
  • Domain & DNS Data: Sending domain names, DNS nonces, TXT/MX/SPF/DKIM/DMARC status records, and nameserver configurations.
  • Team & Alias Metadata: Employee names, job titles, primary/secondary email aliases, and invitation statuses.
  • Google & Gmail OAuth Tokens: Encrypted access and refresh tokens when employees authorize the Mailcoy Google Connector to send or relay emails on behalf of their custom domain.

2. Use of Google User Data & Gmail Scopes

Mailcoy uses Google OAuth restricted scopes strictly to provide the email routing and reply-as functionality within your connected Gmail inbox.

How we handle your Gmail data:

  • We never sell your email contents or contact data to third parties or advertisers.
  • We never use your email data for training artificial intelligence or machine learning models.
  • Gmail API permissions are used solely to register custom send-as aliases, insert incoming routed messages, and relay outbound messages composed in your Gmail interface.
  • All OAuth tokens are encrypted at rest using AES-256-GCM encryption.
Google API Services User Data Policy (Limited Use):

Mailcoy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Data Storage & Security

We implement strict security measures to protect your organization's infrastructure:

  • Tenant data isolation enforced via Supabase Row Level Security (RLS).
  • API keys hashed using Argon2id prior to database storage.
  • Audit logs for all administrative and privileged actions retained for security forensics.
  • HTTPS enforced across all API endpoints and transport routes.

4. Third-Party Service Providers

We partner with trusted infrastructure providers to deliver our service:

  • Supabase: Authentication, encrypted database storage, and edge functions.
  • Amazon Web Services (SES): Secure outbound email delivery and DKIM signing.
  • Paystack: PCI-compliant billing and subscription processing.

5. Your Rights & Data Retention

Workspace owners can update, export, or delete their organization data at any time. When an organization is deleted, all associated tenant data, employee profiles, domain records, and connected Google credentials are permanently purged after 30 days.

Contact Us

If you have questions regarding this Privacy Policy or data security, please contact our support team at support@mailcoy.com or visit our Contact page.