Version 1.0 · Effective date: October 15, 2026 · Mailbari LLC
Last Updated: October 15, 2026
This Addendum is the data protection contract between Mailbari and each customer. It applies automatically when you accept the Terms of Service. It says that Mailbari processes the personal data in your email, files and other content only on your instructions, keeps it confidential and secure, uses only the sub-processors listed in Annex 3, helps you respond to people's requests and to breaches, and deletes the data when you leave. It meets GDPR Article 28, the UK GDPR, US state privacy laws and Bangladesh's Personal Data Protection Act 2026.
1.1 "Customer" is the organisation that accepted the Terms. "Mailbari" is Mailbari LLC. 1.2 "Customer Personal Data" is personal data inside Customer Data (as defined in the Terms) that Mailbari processes for the Customer. 1.3 "Data Protection Law" means every law on personal data that applies to the processing, including the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US federal and state privacy laws such as the California Consumer Privacy Act, and the Bangladesh Personal Data Protection Act 2026 and its rules. 1.4 "Sub-processor" is any third party Mailbari engages that may process Customer Personal Data. Words such as "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR, or the nearest meaning in other Data Protection Law. In US state laws, Mailbari is a "service provider" or "processor".
2.1 The Customer is the controller (or processes on behalf of its own clients as a processor) and Mailbari is its processor (or sub-processor) for Customer Personal Data. 2.2 Mailbari is an independent controller for account, billing, security log and support data, which its Privacy Policy covers. 2.3 The subject matter, nature, purpose and duration of processing, and the types of data and data subjects, are in Annex 1.
3.1 Mailbari processes Customer Personal Data only on the Customer's documented instructions. The Terms, this Addendum, the Customer's settings in the admin panel, and actions by its Admins and Users are those instructions. 3.2 Mailbari tells the Customer if it believes an instruction breaks Data Protection Law, and may suspend that processing until it is clarified. 3.3 If the law requires Mailbari to process Customer Personal Data otherwise, Mailbari tells the Customer first unless the law forbids it. 3.4 Mailbari does not sell or share Customer Personal Data, use it for advertising, combine it with data from other sources to build profiles, use it to train AI models, or keep, use or disclose it for any purpose other than providing the Services, except as Data Protection Law allows a service provider to do.
Mailbari gives access to Customer Personal Data only to staff and contractors who need it to provide, secure or support the Services, who are bound by written confidentiality duties, and who are trained in data protection. Access is limited to the minimum needed and logged.
5.1 Mailbari applies the technical and organisational measures in Annex 2, appropriate to the risk, and keeps them under review. 5.2 Mailbari may update the measures, provided the overall level of protection does not go down. 5.3 The Customer is responsible for its own security settings, such as two-step login, sharing rules, its Users' passwords and its domain DNS.
6.1 The Customer gives general authorisation for Mailbari to use the sub-processors in Annex 3. 6.2 Mailbari will announce any new or replacement sub-processor at least 30 days before it starts, on mailbari.com/dpa and by email to Customers who subscribe to notices in Admin › Legal. 6.3 The Customer may object on reasonable data protection grounds within those 30 days. The parties will discuss it in good faith; if Mailbari cannot offer a reasonable alternative, the Customer may end the affected Services and receive a refund of prepaid fees for the unused period. 6.4 Mailbari imposes on each sub-processor data protection terms that protect the data at least as well as this Addendum, and remains responsible to the Customer for its sub-processors. 6.5 Software Mailbari runs on its own servers, such as the Stalwart mail server, ONLYOFFICE and LiveKit, is not a sub-processor because its vendor receives no Customer Personal Data. 6.6 Services the Customer chooses to connect, such as Google Drive, Microsoft OneDrive, Dropbox, its DNS provider or its own AI assistant, are not Mailbari sub-processors. The Customer's own agreement with them applies.
7.1 Mailbari may process Customer Personal Data in the United States, Bangladesh and the countries where its sub-processors operate, as listed in Annex 3. 7.2 For transfers of personal data from the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2, controller to processor, or Module 3, processor to processor, as applicable), with the UK International Data Transfer Addendum and Swiss adjustments. Those Clauses are incorporated by reference, with: Clause 7 included; Clause 9 option 2 with the 30-day notice in section 6.2; Clause 11 optional wording omitted; Clauses 17 and 18 governed by and subject to the law and courts of Ireland. Annexes 1 to 3 below complete the Clauses' Annexes. 7.3 For personal data of people in Bangladesh, Mailbari follows the transfer conditions of the Bangladesh Personal Data Protection Act 2026 and its rules, and will cooperate with the Customer on any notice or approval they require.
8.1 Requests from people. Mailbari gives the Customer tools to find, export, correct and delete personal data (search, export and delete functions in the admin panel). If Mailbari receives a request directly about Customer Personal Data, it passes it to the Customer and does not answer it itself unless the Customer asks. 8.2 Impact assessments and regulators. Mailbari gives reasonable help with data protection impact assessments and consultations with authorities, using the information it has. 8.3 Personal data breaches. Mailbari notifies the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes what happened, the data and people affected (as far as known), likely consequences, and what Mailbari is doing about it, and Mailbari updates it as it learns more. Mailbari notifies Admins by email and in the admin panel. Notifying a breach is not an admission of fault.
9.1 Mailbari makes available the information needed to show it meets this Addendum: this Addendum, the Security Policy, a written answer to a reasonable security questionnaire once a year, and summaries of independent security tests or certifications when Mailbari has them. 9.2 If that is not enough to meet a legal duty, or a regulator requires it, the Customer may audit Mailbari once a year, with 30 days' notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, without access to other customers' data.
10.1 During the subscription, the Customer can export and delete Customer Personal Data at any time with the admin tools. 10.2 When the subscription ends, the organisation is read-only for 30 days for export. Mailbari then deletes Customer Personal Data from live systems within 30 days and from backups within a further 35 days, unless the law requires it to keep some of it, in which case it stays protected under this Addendum. 10.3 Mailbari confirms deletion in writing on request.
Each party's liability under this Addendum is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow them.
Mailbari certifies that it understands and will comply with the restrictions in section 3.4, will notify the Customer if it can no longer meet its obligations under applicable US state privacy laws, and allows the Customer to take reasonable steps to stop and fix unauthorised use of Customer Personal Data.
For Customer Personal Data of people in Bangladesh, Mailbari will: process it only for the purposes in Annex 1; keep the records the Personal Data Protection Act 2026 requires; help the Customer meet the rights of access, correction, erasure and portability; tell the Customer of breaches as set out in section 8.3 so it can meet any notice duty to the authority; and follow any lawful direction of the authority on transfers abroad.
This Addendum lasts as long as Mailbari processes Customer Personal Data. If it conflicts with the Terms, this Addendum wins on data protection matters, and the Standard Contractual Clauses win over both.
• Subject matter: Hosting and operating business email, files, documents, notes, calendars, contacts, meetings, chat, booking, tasks and projects for the Customer • Nature of processing: Storing, transmitting, indexing, searching, backing up, scanning for spam, malware and child sexual abuse material, transcribing meetings when recording is on, generating AI suggestions when AI is turned on, exporting and deleting • Purpose: Providing, securing and supporting the Services under the Terms • Duration: The subscription, plus the export and deletion periods in section 10 • Data subjects: The Customer's Users; people who correspond with, meet, book or share files with Users; people whose details appear in Customer Data • Types of personal data: Names, email addresses, phone numbers, message content and attachments, files, calendar entries, contacts, chat messages, meeting audio, video and transcripts, booking details, IP addresses and device data in logs, and any personal data Users choose to store • Special categories: Not intended, but Customer Data may contain them if Users store them. Mailbari protects all Customer Data to the same standard • Frequency: Continuous
• Encryption: TLS 1.2 or higher for all connections to Mailbari; mail between servers over TLS with MTA-STS where the other side supports it; data at rest encrypted with AES-256 on storage and backups • Separation: Each Customer is a separate tenant with its own users, domains, quotas and keys; access checks on every request • Access control: Two-step login (authenticator app or passkey) for all staff and available for all Users; role-based staff access by least privilege; production access only through audited, time-limited sessions; Customer-approved support access • Logging and monitoring: Security, admin and staff access logs kept 13 months; alerts for unusual sign-ins, sending spikes and system errors • Availability: Redundant mail servers, daily encrypted backups kept 35 days in a separate location, tested restores, disaster recovery plan • Mail and file safety: Spam, phishing and malware filtering; attachment and file scanning; link checking; hash matching for known child sexual abuse material • Development: Code review, dependency and vulnerability scanning, separate test environments without real Customer Data • People: Background checks where lawful, confidentiality agreements, security and privacy training at hiring and yearly • Incidents: Written incident response plan, 72-hour Customer notice for personal data breaches, post-incident reviews • Vendors: Security review and written data protection terms with every sub-processor
• [Hosting provider, to confirm]: - Purpose: Servers for the Services - Data: All Customer Data - Location: [Region, to confirm] • [Object storage provider, to confirm]: - Purpose: Encrypted storage of mail, files and backups - Data: All Customer Data (encrypted) - Location: [Region, to confirm] • Anthropic PBC: - Purpose: AI features, only when turned on by an Admin - Data: Content a User sends to an AI feature - Location: United States • Voyage AI (only if enabled): - Purpose: Search index for "Ask your Drive" - Data: Passages of files a User can access - Location: United States • Google LLC (Google Cloud): - Purpose: Meeting transcription (Speech-to-Text); link safety checks (Web Risk); push notifications on Android and web (Firebase Cloud Messaging) - Data: Meeting audio when recording is on; web addresses in messages and files; device tokens and notification metadata - Location: United States • Apple Inc.: - Purpose: Push notifications on iPhone and iPad - Data: Device tokens and notification metadata - Location: United States • Microsoft Corporation (PhotoDNA) or Thorn (Safer): - Purpose: Matching images against known child sexual abuse material - Data: Image hashes - Location: United States • Twilio Inc.: - Purpose: Login codes by SMS outside Bangladesh - Data: Phone numbers - Location: United States • [Bangladesh SMS gateway, to confirm]: - Purpose: Login codes by SMS in Bangladesh - Data: Phone numbers - Location: Bangladesh • Functional Software, Inc. (Sentry): - Purpose: Error reports, with personal data removed where possible - Data: Limited technical data - Location: United States Payment providers (Stripe, SSLCommerz, bKash) process billing data as independent controllers and do not receive Customer Data.
• Mailbari LLC · 104 Quigley Blvd, Ste 1013, New Castle, DE 19720, USA · +1 302 580 8514 • Bangladesh office · Rafiq Place, Level 1A, BM College Mosque Gate, Barisal-8200, Bangladesh · +880 1805 459129 • Data protection: [email protected] · Security incidents: [email protected]