Privacy policy

Last updated October 14, 2026

What we do with your data, plainly: what we collect, why, with whom, and for how long. This document is also available in French. In case of discrepancy, the French version prevails.

1. Who we are

The controller is ANOTHER, French limited liability company (SARL) with variable capital, 2 rue Le Bouteiller, 35000 Rennes, France (797 477 478 R.C.S. Rennes), which publishes Mailclutch. For any question about your data: privacy@mailclutch.com.

This policy covers the website, the app and support. For emails our customers capture with Mailclutch, we act on the customer's behalf and the customer is responsible: contact them first (see the DPA).

2. What we process and why

Create and run your account: Name, email, password (hashed), profile picture (including one imported from Google or GitHub if you sign in that way), organization, roles, invitations, preferences.
Legal basis: Performance of the contract.
Bill and collect payment: Company or personal name, address, country, VAT number, invoices, last four digits and type of card. Full card data is handled by Stripe, never by us. We check a VAT or SIREN number against public registers (VIES, the French business directory).
Legal basis: Performance of the contract; accounting and tax obligations.
Keep the Service secure: IP address, browser, device, city and country inferred from the IP by a local database (your IP is sent to no third party), sessions, activity log, sign-in alerts.
Legal basis: Legitimate interest (protecting accounts); legal duty to retain connection data.
Sandbox and account-free tools: IP address (to limit abuse), the test inbox created; your email only if you ask for a reminder.
Legal basis: Legitimate interest; consent for the reminder.
Answer support requests: Your messages and attachments. An AI tool (Anthropic) helps translate and draft our replies; a person reviews and sends them.
Legal basis: Performance of the contract; legitimate interest.
Write to you: Service emails (security, billing, retention); product news only if you asked for it.
Legal basis: Performance of the contract; consent for product news.
Learn where sign-ups come from: Campaign parameters (UTM), referring site, landing page, attached to the account at sign-up.
Legal basis: Consent (measurement cookie).
Measure website audience and app usage: Pages viewed, key actions (copying credentials, signing up, subscribing, first email received), device, approximate country and, once signed in, a pseudonymous account identifier, through Google Analytics. Never the content of emails, your email address or your credentials.
Legal basis: Consent, given on the website's banner and applying to the app too.

We do not sell your data, use it for targeted advertising, or make automated decisions with legal effects on you. We do not train any AI model on your data or on captured emails.

3. Retention

Captured emails, free plan: 7 days
Account-free sandbox: 24 hours, then 7 days to claim it; the IP address is used for 14 days
Account (name, email, preferences): For as long as the account exists, then 30 days after it is deleted
Captured emails and attachments: Per plan, or until the customer deletes them, then 30 days in the trash
Deleted organization: 14 days (it can be restored), then all of its content is erased
Connection and security logs (IP, browser, activity log): 12 months (hosting providers' retention duty, French decree 2021-1362)
Invoices and billing data: 10 years (French Commercial Code, art. L123-22)
Support requests: 3 years after the last exchange
Copies of the emails we send you: 30 days
Webhook delivery logs: 30 days
Acquisition source (campaign parameters): 90 days in the cookie, then with the account
Audience measurement (Google Analytics): 14 months at Google
Encrypted backups: Rolling 180 days

You can ask for your data to be erased at any time at privacy@mailclutch.com, except what the law requires us to keep (invoices, connection data).

4. Recipients and processors

Your data is accessible to the Mailclutch staff who need it and to the providers below, bound by contract and confidentiality. If you sign in with Google or GitHub, that service receives your sign-in request under its own policy. We disclose data to authorities only on a lawful request.

Scaleway SAS: Infrastructure hosting (servers, database) — France
Amazon Web Services EMEA SARL: Attachment storage (S3) and delivery of our own emails (SES) — France (Paris, eu-west-3)
Cloudflare, Inc.: Custom domains for share pages (white label) — Global network, headquartered in the US
Functional Software, Inc. (Sentry): Application error tracking — EU or United States
Laravel Holdings, Inc. (Nightwatch): Performance monitoring — EU or United States
BunnyWay d.o.o. (bunny.net): Delivery of static site files (no captured email) — Slovenia (EU), global network
Stripe Payments Europe, Ltd.: Payments and subscription management — Ireland (EU), with transfers to the US
Google Ireland Ltd. (Google Workspace): Team email (support correspondence) — EU, with transfers to the US
Anthropic, PBC: Drafting and translating support replies (never captured email) — United States
Linear Orbit, Inc.: Internal tracking of support requests — United States
Google Ireland Ltd. (Analytics): Website and app audience measurement, only if you accept it — EU, with transfers to the US

5. Transfers outside the EU

The Service is hosted in France and captured emails stay there. Some providers listed above are established outside the EU or may access data from there; each transfer is covered:

Cloudflare, Inc.: EU-US Data Privacy Framework and Standard Contractual Clauses
Functional Software, Inc. (Sentry): EU-US Data Privacy Framework and Standard Contractual Clauses
Laravel Holdings, Inc. (Nightwatch): European Commission Standard Contractual Clauses
Stripe Payments Europe, Ltd.: EU-US Data Privacy Framework and Standard Contractual Clauses
Google Ireland Ltd. (Google Workspace): EU-US Data Privacy Framework and Standard Contractual Clauses
Anthropic, PBC: European Commission Standard Contractual Clauses
Linear Orbit, Inc.: EU-US Data Privacy Framework and Standard Contractual Clauses

6. Your rights

You can access, correct or erase your data, restrict its processing, object to processing based on our legitimate interest, receive a portable copy, withdraw consent at any time, and leave instructions about your data after your death. Much of this can be done from your account; for the rest, write to privacy@mailclutch.com. We reply within one month and may ask you to prove your identity.

You can lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the authority of your country.

7. Security

Encryption in transit and at rest, encrypted backups, two-factor authentication, restricted access: details are on the Security page. If a data breach puts you at risk, we tell you as the GDPR requires.

8. Cookies

See the cookie policy.

9. Children

Mailclutch is meant for adults. We do not knowingly collect data from children under 15; if that happens, write to us and we will delete it.

10. Changes

We update this policy when our processing changes. A significant change is announced by email or in the app.