Version 1.0 · Effective date: October 15, 2026 · Mailbari LLC
Last Updated: October 15, 2026
Mailbari hosts business email, files and team tools on our customers' own domains. For account, billing, website and support data we decide how it is used, and this policy explains it. For the email, files and messages our customers store with us, the customer is in charge and we only process it on their instructions. We do not sell personal data, we do not show ads, and we do not use anyone's content to train AI. You can ask us, or the organisation that gave you your Mailbari account, to see, correct or delete your data.
1.1 Mailbari LLC is a Delaware limited liability company (file no. 10749561), 104 Quigley Blvd, Ste 1013, New Castle, DE 19720, USA, with an office in Bangladesh at Rafiq Place, Level 1A, BM College Mosque Gate, Barisal-8200, Bangladesh. For privacy questions email [email protected]. 1.2 This policy covers mailbari.com, the Mailbari web apps (Email, Docs, Notes, Calendar, Meeting, Drive, Team Chat, Booking, Shared Drive, Taskboard, Projects and the admin panel), the Mailbari mobile apps, the Mailbari APIs and MCP server, public booking pages, and how we talk to you by email and phone.
2.1 Controller. We decide how to use the personal data we collect to run our business: the details of people who sign up, Admins, billing contacts, website visitors, people who contact sales or support, and the technical data needed to secure and operate the Services. This policy governs that data. 2.2 Processor. For "Customer Data" — the email, attachments, files, documents, notes, calendars, contacts, chats, recordings, bookings, tasks and projects that our customers and their Users store in Mailbari — we act for the customer organisation, which is the controller. We process it only to provide the Services, under our Data Processing Addendum. If you have a Mailbari address through your employer or another organisation, that organisation's own privacy notice applies to your Customer Data, and requests about it should go to them first. We will help them answer. 2.3 If you just send email to a Mailbari user, your message and address become Customer Data of the organisation you wrote to. We scan it for spam and malware and deliver it; we do not use it for anything else.
• Account and contact - Examples: Name, work email, phone, job title, organisation name, country, password hash, two-step login settings - Where it comes from: You, when you sign up or an Admin adds you • Billing - Examples: Billing name and address, tax ID, plan, invoices, last 4 digits and expiry of a card, mobile wallet number used to pay - Where it comes from: You and our payment providers (Stripe, SSLCommerz, bKash). We never receive full card numbers • Domain and setup - Examples: Domains you connect, DNS check results, verification records - Where it comes from: You and public DNS • Support and sales - Examples: Messages, call notes, screenshots you send - Where it comes from: You • Security and usage logs - Examples: IP address, device and browser type, sign-in times, actions in the admin panel, API calls, sending volumes, error reports - Where it comes from: Our systems, automatically • Website - Examples: Pages visited, referring site, cookie choices - Where it comes from: Your browser, see the Cookie Policy • Connected services - Examples: Basic profile and the items you choose from Google, Microsoft or Dropbox - Where it comes from: Those services, only when you connect them • Phone numbers for codes - Examples: Mobile number used for login codes or account alerts - Where it comes from: You We do not ask for special categories of data (such as health or religion) and we ask you not to send them to us outside your Customer Data.
• Create and run your account, deliver the Services, provide support - Data used: Account, domain, usage, support - Legal basis (EU/UK GDPR): Contract • Bill you, prevent payment fraud, keep tax records - Data used: Billing, account - Legal basis (EU/UK GDPR): Contract; legal obligation • Keep the Services secure, stop spam, malware, phishing and abuse, enforce our policies - Data used: Security logs, sending volumes, abuse reports - Legal basis (EU/UK GDPR): Legitimate interests (a safe service and a clean mail reputation for every customer); legal obligation • Send service messages (receipts, security alerts, outage and policy notices) - Data used: Account - Legal basis (EU/UK GDPR): Contract; legitimate interests • Send product news and offers - Data used: Name, email - Legal basis (EU/UK GDPR): Consent where the law requires it; otherwise legitimate interests, with an unsubscribe link in every message • Improve the Services, using aggregated or de-identified usage statistics - Data used: Usage logs - Legal basis (EU/UK GDPR): Legitimate interests • Comply with law and respond to valid legal requests - Data used: As needed - Legal basis (EU/UK GDPR): Legal obligation; legitimate interests Where we rely on consent you can withdraw it at any time; this does not affect earlier processing.
5.1 We store, transmit, index, back up and display Customer Data so the Services work, and we scan it automatically for spam, viruses, phishing links and known child sexual abuse material. 5.2 We do not read Customer Data except when the customer or User asks us to for support, to investigate abuse or a security incident, or when the law requires it. Each access is logged. 5.3 We do not sell Customer Data, use it for advertising, build profiles of people from it, or use it to train AI models. 5.4 Images in incoming email are not loaded until you choose to load them, so senders cannot track when you open a message.
6.1 AI features are off until an Admin turns them on. When a User uses one, we send only the content needed for that request (for example, the thread being summarised) to our AI provider, Anthropic, and show the result to the User. Meeting transcripts use Google Cloud Speech-to-Text. 6.2 Our AI providers process this content on our behalf. They may not use it to train their models. Anthropic deletes API inputs and outputs within 30 days by default. Details are in the AI Use Policy. Account data is Mailbari's to manage under this policy; Customer Data belongs to your organisation and goes only to the service providers listed in the DPA.
7.1 Service providers. Companies that host and run parts of the Services for us, under written contracts that limit them to our instructions: our hosting and storage providers, our AI providers (Anthropic; Google Cloud for speech-to-text and link safety checks), push notification services (Google Firebase and Apple), SMS providers for login codes, error tracking (Sentry, with personal data removed where possible), and child-safety hash matching. The current list is in Annex 3 of the Data Processing Addendum at mailbari.com/dpa. 7.2 Payment providers. Stripe, SSLCommerz and bKash receive the details needed to take your payment and prevent fraud. They also act under their own privacy policies. 7.3 Services you connect. When you connect Google, Microsoft, Dropbox, your DNS provider or an AI assistant, data flows between Mailbari and that service as you direct. 7.4 Your organisation. If your account belongs to an organisation, its Admins can see your account details, sign-in history and Customer Data. 7.5 Legal reasons. We disclose data when the law requires it, following our Law Enforcement & Government Request Guidelines. We report apparent child sexual abuse material to the US National Center for Missing & Exploited Children (NCMEC), as US law requires. 7.6 Business transfers. If Mailbari is merged, sold or reorganised, personal data may pass to the new owner under this policy, and we will tell you. 7.7 With your permission. In any other case, only if you ask us to or agree. 7.8 No selling. We do not sell personal data or share it for cross-context behavioural advertising, as those terms are used in California and other US state laws.
8.1 Mailbari is a US company with staff in Bangladesh, and our service providers operate in several countries. Customer Data is stored in the data-centre region listed in the DPA [region to confirm]. Personal data may be accessed from the United States and Bangladesh for support and operations. 8.2 For transfers from the European Economic Area, the United Kingdom or Switzerland to countries without an adequacy decision, we use the European Commission's Standard Contractual Clauses and the UK Addendum, with extra safeguards such as encryption. 8.3 For personal data of people in Bangladesh, we follow the transfer rules of the Personal Data Protection Act 2026 and the rules the data protection authority issues under it, and we do not move national ID, passport, biometric or similar sensitive identifiers abroad in bulk.
• Account and Admin details: While the account is open, then deleted with the organisation (see section 14 of the Terms) • Customer Data: Until the customer or User deletes it; deleted items stay in trash for 30 days; after cancellation, 30 days read-only, then deleted within 30 days and from backups within a further 35 days • Billing records and invoices: As long as tax and accounting laws require, usually up to 10 years • Security and sign-in logs: 13 months • Mail delivery logs (sender, recipient, time, result, not content): 90 days • Support conversations: 3 years after the ticket closes • Marketing contacts: Until you unsubscribe, then kept only on a do-not-contact list • Content reported to NCMEC: 1 year, as US law requires We may keep data longer when the law requires it or to deal with a legal claim.
We protect personal data with encryption in transit and at rest, separation between customer organisations, two-step login, limited and logged staff access, regular backups and security testing. The Security Policy at mailbari.com/security explains this in detail. If a breach affects your personal data, we will tell you and the authorities as the law requires.
11.1 Everyone. You can ask to see the personal data we hold about you, correct it, delete it, or get a copy in a portable format, and you can unsubscribe from marketing at any time. Users can export their own mail and files from their settings. 11.2 EU, UK and Switzerland. You also have the right to object to processing based on legitimate interests, to restrict processing, and to complain to your data protection authority. We are appointing representatives in the EU and UK; until then, contact [email protected]. 11.3 US residents. Depending on your state (including California, Colorado, Connecticut, Virginia, Texas and others), you have the right to know, access, correct and delete your personal data, to opt out of sale, sharing and targeted advertising (we do none of these), and not to be treated differently for using your rights. You may use an authorised agent; we may need to verify your identity. If we refuse a request, you can appeal by replying to our answer, and we will respond within the time your state's law sets. 11.4 Bangladesh. Under the Personal Data Protection Act 2026 you have the right to know how your data is used, to access and correct it, to withdraw consent, to have it erased, and to receive a copy. You can complain to the national data protection authority. 11.5 How to use your rights. Email [email protected] from the address on your account, or use Settings › Privacy. We answer within 30 days (or sooner if your law says so). If your request is about Customer Data held for an organisation, we will pass it to that organisation and help it respond.
We use automated systems to filter spam and malware, to spot compromised accounts and to pause accounts that send spam. These decisions protect every customer's mail. If your sending is paused or a message is blocked and you think it was a mistake, reply to the notice or email [email protected] and a person will review it. We do not make decisions with legal or similarly significant effects about you based only on automated processing.
Mailbari is a service for businesses and is not meant for anyone under 18. Customers must not create accounts for children. If we learn that we hold an account of a child, we will delete it.
We use cookies that are needed to sign you in and keep the Services secure, and, only with your consent, cookies for analytics. Details and choices are in the Cookie Policy at mailbari.com/cookies.
When you add files from Google Drive, OneDrive or Dropbox, or connect a Google or Microsoft calendar to Booking, we use that data only for the feature you chose. Mailbari's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Details are in the Google, Microsoft & Dropbox Data Use Policy.
We use mobile numbers only for login codes, account recovery and urgent account alerts. Mobile information and SMS consent are not shared with third parties or affiliates for marketing or promotional purposes. You can remove your number in Settings.
We will post any update on this page with a new effective date and keep earlier versions available. If a change is significant, we will email Admins at least 30 days before it takes effect.
Mailbari LLC · 104 Quigley Blvd, Ste 1013, New Castle, DE 19720, USA · +1 302 580 8514 Bangladesh office · Rafiq Place, Level 1A, BM College Mosque Gate, Barisal-8200, Bangladesh · +880 1805 459129 Privacy and data rights: [email protected] · Support: [email protected]