Privacy policy

The data controller is MP Informatica S.r.l., with registered office at Strada di Santa Bona Nuova 33/B, 31100 Treviso (TV), Italia, tax code and VAT number 05355370262. For any privacy question, you can write to us at hello@mailfolk.email or to our certified email address (PEC) mpinformatica-srl@pec.it.

Emails, attachments, contacts and the search index are stored only on your computer. Mailbox passwords are kept in the operating system's keychain. We do not receive or read your mail.

Email summaries use a model that runs on your computer: message text is not sent to external services. External assistants connected via MCP see your mail only if you give them access, for as long as you choose; every request is kept in the app's log.

To verify the license, the app sends our server the license code, an identifier of the computer and its name. For updates, it periodically checks whether a new version is available. This data is used only to make the license and updates work.

• Email address and billing details when you buy a license.
• Email address, name and, if you choose one, your password, stored only in a non-reversible form, when you create your personal area. If you sign in with Google, we receive your email address and name from Google.
• The messages you send to our support address.
• The server's technical logs: IP address, date and time, page requested and result, for security and to fix problems.
• Visit statistics with Google Analytics, only if you accept them: pages viewed, downloads and completed purchases. The details are in the cookie policy.

Payments are handled by Stripe, on its own payment page. We do not receive or store your card number or security code.

We process data to perform the purchase contract and the license, to meet legal obligations (for example tax obligations) and, if you ask us to, to reply to you. Server logs and protections against abuse are based on our legitimate interest in keeping the service secure. Visit statistics are based on your consent, which you can withdraw at any time from the cookie policy or from the website footer.

The following periods form our approved retention policy. Deletion procedures are being updated: approval of these periods does not mean that all new deletion measures are already operational.

• Support requests: 12 months after the request is closed.
• Diagnostic attachments, screenshots and sample emails sent to support: 30 days after the case is closed.
• Active computers: necessary data for as long as the computer remains linked to the license.
• Unlinked computer history: 90 days after unlinking, limited to data needed for support and transfer controls.
• Ordinary website logs: up to 30 days after the event is recorded.
• Security logs: up to 6 months after the event, limited to information relevant to administrative access, sensitive changes and incidents.
• Encrypted backups: daily copies expiring within 30 days of creation, including copies stored outside the VPS.
• Accounts with purchases: until the user requests deletion. Inactivity alone does not cause deletion of an account with a lifetime license.
• Accounts without purchases: deletion after 24 months of inactivity, with advance notice.
• Orders and accounting documents: data needed for accounting is retained separately, ordinarily for 10 years from the legally applicable starting date, unless longer retention is required. This period does not apply to all customer data.
• Licenses: the minimum data needed to recognize and manage the right of use for its full duration. Deleting the account does not delete the purchase or license, which remain linked to the purchase email.
• Sign-in: email sign-in links are valid for 24 hours, sessions for up to 30 days, and failed sign-in attempts are deleted after one day.
• Google Analytics statistics, if you accept them: up to 14 months.

For a specific dispute or incident, only relevant evidence may be retained longer, with the reason documented and the need for retention reviewed.

Data deleted from the main system may remain in backup copies until they expire. The restoration procedure must reapply previously requested deletions before returning the data to ordinary use.

The website, licenses and updates run on an Aruba VPS in the IT3 data center in Ponte San Pietro (Bergamo), Italy. The domain, DNS and email for mailfolk.email are managed by Hostinger. We do not sell your data: we share it only with the providers needed for what you use, namely Stripe for payments and Google if you sign in with Google or accept the statistics. These providers may also process data outside the European Union, with the safeguards required by the GDPR.

You can ask to access your data, correct it, delete it, restrict its processing, receive a copy of it or object to its processing. Write to us at hello@mailfolk.email. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).