Privacy policy.
Last updated July 2026. This describes what Milesender collects, why, and how it's isolated per workspace.
What we collect
Account data (name, email, workspace name), authentication data (hashed passwords, session tokens — never plaintext), and product data your workspace generates: domains, DNS records, API keys, and the messages you send or receive through Milesender (headers, recipients, delivery events, and — where you opt in — full content for a limited retention window).
How we use it
To operate sending and receiving, authenticate your account and API requests, show delivery and inbound activity in your dashboard, detect abuse, and communicate service or security notices. We do not sell your data or your customers' email content to third parties, ever.
Data isolation
Each workspace's domains, keys and messages are kept separate from every other workspace's.
Retention
Delivery and inbound event metadata is retained per your plan's log-retention window (visible in Settings → Usage). Message content, when stored, follows the same window unless you delete it sooner. Deleting a workspace deletes its data; we don't keep silent backups past the standard recovery window.
Subprocessors
We rely on infrastructure providers for compute, storage, and email delivery. Each is bound by a data processing agreement limiting use of your data to providing the service to you. A current subprocessor list is available on request.
Your rights
You can export or delete your workspace's data at any time from Settings. If you're an individual whose data was processed because someone emailed through a Milesender-sending domain, contact us and we'll route the request to the workspace that controls that data.
Changes
If we make a material change to this policy, we'll notify workspace owners by email before it takes effect.
Questions about this policy? privacy@milesender.dev