Privacy notice

Who is responsible

The operator of Tapetide Mail runs this mail service and decides how the data in it is used. Contact: the address the operator publishes for this service.

Grievance Officer: Not yet published. Contact the address the operator publishes for this service.

What is processed

• Account data: email address, name, password hash, passkeys and two-factor secrets.
• Mail content and metadata for the mailboxes you use: messages, attachments, folders and labels.
• Security records: IP addresses and browser details for sign-in sessions, plus an audit log of sends, deletions and settings changes.
• Assistant conversations from the AI side panel.
• Engagement events about people you email, when open and click tracking is on for a mailbox: whether a message was opened or a link clicked, with the time, browser and an approximate privacy-proxy flag.

Why

• To provide the mailbox: receiving, storing, sending and searching mail.
• Security and abuse prevention: sign-in protection, rate limits and audit logs.
• AI assistance, when you use it: drafting replies and summarising threads.
• Optional measurement: open and click tracking, which each mailbox can turn off.

AI processing

AI features run on Cloudflare Workers AI, inside Cloudflare's network. Mail is sent to the model only to answer the request in front of it. It is not used to train models.

Where data is stored and who processes it

Data is stored on Cloudflare's global network (Workers, Durable Objects and R2).

Processor: Cloudflare, Inc. (Workers, Durable Objects, R2, Email Service and Workers AI).

How long it is kept

• Open, click and download events: 13 months.
• Delivery events (sent, delivered, bounced): 13 months.
• AI assistant conversations: 90 days.
• Audit log: 1 year.
• Trash: 30 days, then the message is deleted.
• Mail and account data: until you delete it or your account. A deleted account is purged after a 7-day grace period.

Your rights

You can ask to access, correct or erase your data, raise a grievance, and nominate someone to act for you (DPDP Act 2023). Under the GDPR you can also object, restrict processing and take your data elsewhere.

In the app: Settings > Account & security has Export my data (a download of your mailboxes and account) and Delete my account.

If you are not satisfied with the answer, you can complain to the Data Protection Board of India or your local data protection authority.

Withdrawing consent and tracking

If you received mail from this service, the unsubscribe page lets you stop open and click tracking of your mail from that sender. Account holders can turn tracking off per mailbox, or for a single message.

Cookies

One strictly necessary cookie keeps you signed in (__Host-tt_session). There are no advertising or analytics cookies, so there is no cookie banner.

Breaches

If a personal data breach happens, affected users and the Data Protection Board of India will be told without delay, with a detailed report within 72 hours.