Mailbase
Start free

Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how Mailbase ("we") collects, uses, and protects personal data. We are committed to compliance with the EU General Data Protection Regulation (GDPR / RGPD) and similar privacy laws.

1. Data we collect

  • Account data: your name, email address, and workspace details.
  • Onboarding call: when you create your workspace we ask for a phone number to call you back and help you set up your first search (or you book a slot instead). It is used only for that help, never shared or used for advertising, and is deleted with your account.
  • Contact data: the recipient email addresses and fields you upload to your audiences.
  • Usage data: how you interact with the app — pages visited, features used — collected via privacy-respecting analytics.
  • Email events: deliveries, opens, clicks, bounces and replies tied to your campaigns.
  • Technical data: IP address, browser type, and device info, used for security and debugging.
  • Contact form messages: the name, email address, company (optional), topic and message you send us through the contact form, used only to answer you.
  • Prospecting data: when a customer uses Mailbase's prospecting, Mailbase reads public company records and company websites to find professional contact details. That data is about people who are not Mailbase users, and is described on its own page: see GDPR and prospecting data.

2. How we use data

We process personal data to:

  • Provide, secure and improve the Service.
  • Send campaigns and process replies on your behalf.
  • Measure product usage in aggregate so we can prioritize improvements.
  • Communicate with you about your account, billing and service updates.

We do not sell personal data, and we do not use your contacts or campaign content to train third-party models.

3. Legal bases (GDPR / RGPD)

We rely on the following legal bases: contract (to deliver the Service you signed up for), legitimate interest (to secure and improve the product), and consent (for non-essential cookies and analytics, where required). For prospecting data, the legal basis and the roles of Mailbase and its customers are set out on the GDPR page.

4. Cookies and analytics

We use a small number of essential cookies to keep you signed in. With your consent, we also use product analytics (PostHog) and Google Analytics and Google Ads measurement to understand how the Service and this website are used. Google's tag runs in Consent Mode with every category denied until you accept on the cookie banner; PostHog is only enabled after you accept. You can change your choice at any time. We configure analytics to minimize the personal data collected.

5. Data sharing

We share data only with processors that help us run the Service — email delivery providers, cloud hosting, and analytics — each bound by data-processing agreements. We may disclose data if legally required.

The full list, with the data and the location of each service, is on the sub-processors page. The processors involved in sending and screening email and in the AI features are:

  • Amazon Web Services (Amazon SES, region eu-west-1, Ireland): email delivery. It receives the emails you send through Mailbase's managed sending (recipient, sender, subject and content), reports deliveries, bounces and complaints back to us, and receives replies to those emails.
  • TypeSafe (TypeSafe AI): scam and phishing screening. Before an email is sent, its sender name and address, reply-to address, subject, body text, the domains and visible text of its links, and the number and domains of its recipients (not their email addresses) are sent to TypeSafe's API so it can be classified as legitimate, spammy or scam.
  • AI model providers: when you use the AI assistant, AI drafting or reply triage, the content needed for the request is sent to the provider that runs the model. By default the request goes through OpenRouter, which forwards it to the provider of the model selected for that feature (DeepSeek by default); if you connect your own account, it is the provider you choose (for example OpenAI, DeepSeek, OpenRouter, MiniMax, Groq, Mistral or ChatGPT). Emails that screening finds uncertain may also be re-read by an AI model.
  • Stripe: subscriptions, invoices and payments (including domains bought through Mailbase). Card details are entered on Stripe and never reach Mailbase.
  • Google: sign-in with Google, a Gmail mailbox if you connect one, and — after you consent — Analytics and Ads measurement.
  • PostHog: product analytics, after you consent.
  • Porkbun: registration of domain names a customer buys through Mailbase.
  • Prospecting providers: website search (Serper) and page rendering (Browserless), when the operator has switched them on, receive a company's name and city or the address of its public web page.

6. Data retention

We keep personal data only as long as needed to provide the Service or meet legal obligations. When you delete your account, we remove your data within 30 days, except where retention is legally required. Prospecting data and its retention are described on the GDPR page.

7. Your rights

Under the GDPR / RGPD and similar laws, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request deletion of your data ("right to be forgotten").
  • Object to or restrict certain processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time.

To exercise any right, email contact@mailbase.studio or use the contact form. You also have the right to lodge a complaint with your local data protection authority.

8. Data security

We use encryption in transit, access controls, and regular reviews to protect your data. No system is perfectly secure, but we work hard to keep yours safe.

9. International transfers

Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Contact

Questions about privacy? Email contact@mailbase.studio or use the contact form. The company behind Mailbase is identified in the legal notice. Also see Security.