GDPR & Data Rights

YeyMail is built to hold as little of your data as possible — we never store the content of your mail, and we never sell or profile you. This page sets out your rights under the EU General Data Protection Regulation (GDPR) and the equivalent UK GDPR, and how to exercise each. It complements our Privacy Policy, which describes what we store and why.

Who is the data controller

YeyMail is the data controller for the personal data described in our Privacy Policy. For any data-protection question or request, contact privacy@yeymail.com. We aim to respond to rights requests within 30 days.

What data we process, and our legal basis

• Your account (email, hashed password) and the aliases, destination inboxes and domains you create — processed to perform our contract with you, i.e. to run the service you signed up for.
• Forwarding metadata (which alias received mail, when, delivered/bounced/blocked — never content) — processed under our legitimate interest in operating a reliable, abuse-resistant service and giving you delivery logs. Kept for up to 30 days (delivery logs) or 90 days (activity history).
• Billing records — processed to perform our contract and to meet our legal obligations (tax and accounting). Card details are handled by our payment processor; we never see full card numbers.

We do not process the content, subject lines or bodies of your email. Mail is relayed over encrypted connections and discarded after delivery.

Cookies: we set two, both strictly necessary — the session cookie that keeps you signed in, and a ten-minute security cookie used only while completing “Continue with Google”. No analytics, advertising or tracking cookies, so no consent banner is required. See Cookies in the Privacy Policy.

Your rights

• Access — get a copy of the personal data we hold about you. Use Export my data in Settings for an immediate machine-readable download, or ask us.
• Rectification — correct anything inaccurate. Most fields are editable directly in your dashboard.
• Erasure (“right to be forgotten”) — delete your account from Settings. This immediately disables all aliases, cancels any active subscription, and purges your personal data and mail history. We retain only a narrow, non-content marker that a shared @yeymail.com address was previously in use, so it can never be reassigned to a stranger who would then receive your mail.
• Data portability — receive your data in a structured, common format (JSON) via Export my data, and move it elsewhere.
• Restriction & objection — ask us to pause processing, or object to processing based on legitimate interest. Contact us and we'll act on it.
• Withdraw consent — where we rely on consent (e.g. optional product emails), you can withdraw it any time in Settings without affecting the service.

How to exercise a right

Most rights are self-service in Settings (export, deletion, editing your data, notification preferences). For anything else — or if you'd prefer we handle it — email privacy@yeymail.com from your account address. We may ask you to confirm your identity before acting on a request. Exercising your rights is free.

International transfers

Our infrastructure and sub-processors may process data outside your country. Where data leaves the EEA/UK, it is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Sub-processors

We use a payment processor (Stripe) for billing and standard infrastructure providers for hosting. They process data only as needed to deliver the service, under their own GDPR commitments. The optional home-page breach checker runs in your browser and sends nothing to us — see the note in our Privacy Policy.

Complaints

If you believe we've mishandled your data, please tell us first at privacy@yeymail.com — we'd like the chance to put it right. You also have the right to lodge a complaint with your local data-protection authority.