This is the part most privacy notices get wrong, so we are stating it plainly before anything else.
KapoMail handles personal data in two distinct capacities, and different rules apply to each:
We are the CONTROLLER of your account data. When you sign up, we decide why and how we process your name, your organisation's details, your billing information and your support correspondence. This notice, in the ordinary sense, is about that data — and section 2 below covers it.
We are the PROCESSOR of your customers' message data. When your application sends an email through KapoMail — say, a password reset to one of your customers — the recipient's address and the message content belong to your relationship with your customer, not ours. We only process it because you instruct us to, by sending it through the platform. We do not decide what to send, to whom, or why; you do. Our processing of that data is governed by our Data Processing Agreement ("DPA"), not by this notice, and you — not KapoMail — are the controller your customers should look to for a privacy notice covering that message.
If you are one of our customers' end users — for example, you received a password-reset email sent through KapoMail — this notice is not the right place to look for how your data is used; that is a question for the business that sent you the email. Section 8 explains the very limited role we play in that case.
| Purpose | Lawful basis |
|---|---|
| Providing the account and the service you signed up for | Performance of a contract |
| Billing and VAT compliance | Contract, and legal obligation |
| Reviewing applications for abuse risk before granting sending access | Legitimate interests — protecting the platform's deliverability for every customer |
| Responding to support requests | Contract |
| Security monitoring, fraud and abuse detection on your account | Legitimate interests |
| Sending you service and security notices (for example, a DNS record about to expire) | Contract, and legitimate interests |
| Sending you marketing about KapoMail itself, only if you opted in | Consent |
We do not sell your data, and we do not use your account data to train any model beyond ordinary spam and abuse-detection heuristics run over metadata (not message content) that you or your customers send through the platform.
We do not share your account data with other customers, and we do not share it for third-party advertising.
The email addresses, message content, attachments and delivery metadata that pass through KapoMail because your application sent them are processed only on your documented instructions, as set out in the DPA. We do not read message content except:
We never use message content to train models, to build advertising profiles, or for any purpose beyond delivering the service to you.
We keep different categories of data for different periods, because a longer retention is not automatically safer — old data you no longer need is a liability, not an asset.
| Data | Retention | Why |
|---|---|---|
| Message bodies and attachments | 30 days from send, then deleted | Long enough to investigate a delivery problem; no longer than that by default. Customers on plans with configurable retention can shorten this. |
| Delivery events (accepted, delivered, bounced, complained, opened) | 90 days, then deleted | Enough history to see a trend without holding recipient-level data indefinitely. |
| Audit and security logs (account access, credential creation/revocation, admin actions) | 7 years | UK accounting and fraud-investigation practice, and to support an investigation long after the fact if one is ever needed. |
| Suppression list entries (bounced or complained addresses) | Indefinite, but minimised to the address and the reason | Deliberately kept — this is what stops you, and every other customer, from re-mailing an address that has already told a mailbox provider it does not want your mail. We keep only the address and the suppression reason, not the original message. |
| Account and billing data | Duration of the account, then 7 years for financial records, then deleted | UK tax record-keeping requirements (Companies Act 2006 / HMRC). |
Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased where there is no lawful reason for us to keep it; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on it.
To exercise any of these rights, write to privacy@kapomail.com. We will respond within one month. Where the data in question is message data we hold as your processor rather than as controller, we will direct the request to the account holder who sent it, as required by the DPA — we cannot act on it ourselves without your instruction, because it is not our data to decide about.
You have the right to complain to the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully. The ICO can be contacted at ico.org.uk, or by phone on 0303 123 1113. We would appreciate the chance to address your concern directly first, at the address above, but the choice is yours.
Message data and account data are hosted in the UK (AWS eu-west-2, London). Where a sub-processor operates outside the UK, we rely on the UK's approved transfer mechanisms — an adequacy decision, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses — and we list any such sub-processor on the Security & Trust page.
We describe our technical and organisational measures — encryption, access control, infrastructure location, incident response and our vulnerability disclosure policy — on the Security & Trust page, so that this notice does not have to duplicate it and risk drifting out of date.
If you received an email sent through KapoMail — a password reset, a receipt, an order confirmation — the business that sent it is the controller of that message and the right place to ask about how your data is used, how long they keep it, and how to exercise your rights over it. We process that message only as their processor, under their instructions.
If you believe a message sent through KapoMail misuses your data, or you want mail from a specific sender stopped, you may also write to abuse@kapomail.com and we will investigate under our Acceptable Use Policy.
We will update this notice as the service changes. Material changes are announced by email to account holders at least 14 days before they take effect, in the same way as changes to our Terms of Service.
Contact: HRMFIRM LTD, Flat 3 Carradale House, 88 St. Leonards Road, London, England, E14 0SN · privacy@kapomail.com