Privacy policy
DRAFT — not legal advice. Review with qualified counsel (Indian law: IT Act 2000, DPDP Act 2023; plus GDPR/UK GDPR if serving EU/UK customers) before publishing.
Last updated: [Effective date]
This policy explains how [Company legal name] ("vizsu", "we") handles personal data in Mail by vizsu. It covers people who sign up for and administer the service, mailbox users, and visitors to our websites.
1. Two roles we play
- We decide (controller / data fiduciary) for account, billing, support, security and website data about our customers and their admins. This policy covers that data.
- We act for our customer (processor) for the content of mailboxes: messages, attachments, contacts, calendars, and the mailbox directory. The organisation that owns the domain decides how that data is used. If you use a mailbox provided by your employer or another organisation, contact them first about your data. Our Data processing agreement governs that processing.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, organisation, role, vizsu account ID | vizsu SSO when you sign in |
| Service configuration | Domains, DNS check results, mailbox names, aliases, groups, forwarding rules, recovery email addresses, API key metadata | You and your admins |
| Mailbox content (processor) | Messages, attachments, headers, contacts, calendars, imported mail | Mailbox users and their correspondents |
| Usage and sending records | Recipient counts per mailbox, delivery, bounce and complaint events, storage used | Generated by the service and Amazon SES |
| Logs and security data | IP address, user agent, sign-in times, API requests, admin actions (audit log), suspension events | Generated by the service |
| Payment data | Plan, subscription status, invoices, billing contact. Card and bank details are handled by the vizsu payment gateway; we do not store full card numbers. | You, via the gateway |
| Support data | Messages you send us and anything you choose to share | You |
| Import credentials | Passwords or OAuth tokens for accounts you import from | You. Encrypted while the import runs, then deleted. |
We do not sell personal data, and we do not use mailbox content for advertising or to train AI models.
3. Why we use it (and lawful basis)
| Purpose | Data | Basis (DPDP Act / GDPR) |
|---|---|---|
| Provide and run the service | Account, configuration, content (as processor) | Consent / legitimate use under s.7 DPDP; contract (GDPR art. 6(1)(b)) |
| Enforce sending limits, detect spam, phishing and abuse, suspend accounts | Usage, logs, content scanned automatically | Legitimate uses; legitimate interests (GDPR 6(1)(f)) |
| Security, fraud prevention, incident response | Logs, audit data | Legitimate uses; legitimate interests; legal obligation |
| Billing and tax | Payment, account | Contract; legal obligation |
| Service notices (outages, limits, security, changes) | Account email | Contract |
| Product updates and marketing | Account email | Consent, which you can withdraw at any time |
| Comply with law and lawful requests (including CERT-In directions) | Any, as required | Legal obligation |
[Counsel to confirm the exact DPDP basis for each purpose and whether separate consent notices are required.]
4. Automated filtering
Incoming and outgoing mail is scanned automatically for spam, malware and phishing. Sending patterns (volume spikes, bounce and complaint rates) are monitored automatically and can trigger a sending suspension. People review a suspension when you appeal it or when we investigate abuse.
5. Who we share data with
- Sub-processors that host and run the service, listed in Sub-processors.
- Your organisation's admins, who can see mailbox configuration, audit logs and, depending on their role, mailbox content.
- Mail recipients, when you send mail. That is the point of email.
- Authorities, where the law requires it. Where allowed, we tell the affected customer first.
- A buyer or successor, if the business is sold or reorganised, under the same protections.
6. Where data is stored
We host the service in India (Google Cloud and Amazon Web Services, Mumbai region ap-south-1). Some sub-processors may process limited data outside India, for example DNS or support tools. Where we transfer personal data of EU/UK residents, we use Standard Contractual Clauses or another lawful transfer mechanism. [Business to confirm the data residency promise; see README.]
7. How long we keep it
| Data | Retention |
|---|---|
| Mailbox content | Until the customer deletes it. Deleted mailboxes are restorable for 30 days, then purged. |
| Account and configuration data | For the life of the account, then 30 days after closure. |
| Backups | Up to 30 days. |
| Application and security logs | [90] days |
| Audit logs | [1 year] |
| Sending and delivery events | [13 months] |
| Billing records | [8 years] or as required by Indian tax law |
| Logs required by CERT-In directions | 180 days, in India |
See the Data retention and deletion policy.
8. Your rights
Under the DPDP Act 2023 you can:
- get a summary of the personal data we process about you and the processing activities;
- ask us to correct, complete, update or erase it;
- withdraw consent, where processing is based on consent (this does not affect processing before withdrawal);
- nominate another person to exercise your rights if you die or become incapacitated;
- have your grievance handled by our Grievance Officer and, if you are not satisfied, complain to the Data Protection Board of India.
If GDPR or UK GDPR applies to you, you also have rights of access, rectification, erasure, restriction, portability and objection, and you can complain to your supervisory authority.
For mailbox content, send your request to the organisation that provides your mailbox. We will help them respond.
Account owners can export all account data themselves from the dashboard (mailbox exports in mbox format plus account metadata in JSON).
To use your rights, email [Privacy email]. We respond within [30] days and may need to confirm your identity.
9. Grievance Officer
[Grievance Officer name/email] [Company legal name], [Registered address] We acknowledge grievances within [48 hours] and aim to resolve them within [15] days.
[If GDPR applies: EU representative [EU representative details]; UK representative [UK representative details].]
10. Cookies
We use a small number of cookies and similar storage:
| Type | Purpose | Can you turn it off? |
|---|---|---|
| Strictly necessary | Keep you signed in through vizsu SSO, protect against CSRF, remember load-balancing | No, the service won't work without them |
| Preferences | Remember choices such as theme, when stored in your browser | Yes, by clearing browser storage |
| Analytics | [None today / name tool if added] | [Yes, via the cookie banner] |
We do not use advertising cookies. [If analytics are added, add a consent banner before setting them.]
11. Security
See the Security overview. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.
12. Children
The service is for businesses and is not meant for children. We do not knowingly collect data from children under 18. If you believe we have, contact [Privacy email].
13. Changes
We will post changes here and, for material changes, email account owners at least [30] days in advance.
14. Contact
Privacy questions: [Privacy email]. Security issues: security@vizsu.com. Abuse: abuse@vizsu.com.
---
Placeholders to fill
- [Effective date]
- [Company legal name], [Registered address]
- [Privacy email]
- [Grievance Officer name/email]; acknowledgement/resolution times
- Retention periods: application logs [90] days, audit logs [1 year], sending events [13 months], billing [8 years]
- Response time for rights requests [30] days
- [EU representative details], [UK representative details] (only if serving EU/UK)
- Analytics tool and consent banner, if any
- DPDP lawful-basis mapping per purpose (counsel)
- Data residency promise wording