Draft — pending legal review. This document has not yet been reviewed by a lawyer and may change before it takes effect.
Privacy Policy
Carnage Group Pty Ltd (ABN 85 701 211 823) ("we") runs MailWarren. This policy explains what personal information we collect, why, who we share it with and what choices you have. We are an Australian company and handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we apply the same care to customers in other countries.
1. Two roles: your account, and your captured email
- Account information (about you, the person or organisation using MailWarren): we decide how it is used, so we are responsible for it. This policy covers it.
- Captured and sent email (the messages and attachments your applications send through MailWarren): this may contain personal information about your own users. We handle it only to provide the service to you, on your instructions, as your processor or service provider. The Data Processing Addendum covers it, and you are responsible for having the right to send it to us.
2. What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, organisation name and domain, role, password (stored only as a one-way hash), two-factor authentication details | You |
| Billing details | Plan, subscription and invoice status, Stripe customer ID, prepaid credit balance. Card numbers are entered on Stripe's pages and never reach us. | You and Stripe |
| Captured and sent email | Sender and recipient addresses, subject, body, attachments and headers of messages sent to or through the service; sending-domain and DNS details | Your applications |
| Usage and security records | IP address, time of actions, sign-in and account activity, sending and delivery events, error and abuse-prevention data | Automatically |
| Support | Anything you send us when you report an issue or contact support@mailwarren.io | You |
We don't intentionally collect sensitive information (such as health or government ID details). Please don't send it to us in captured email.
3. Why we use it
- to create and run your account, capture and show your email, and deliver the email you send;
- to take payment, keep tax and accounting records and manage your plan;
- to keep the service secure, prevent spam and abuse, enforce our Acceptable Use Policy and protect our sending reputation;
- to send service emails such as email verification, security and billing notices, and to respond to you; and
- to meet legal obligations and to establish or defend legal claims.
We do not sell personal information. We do not use it for advertising and do not use third-party analytics or advertising trackers. We do not currently send marketing email; if we do, it will follow the Spam Act 2003 (Cth), including a working unsubscribe.
4. Who we share it with
We share information only with people who help us run the service, or where the law requires:
- Stripe — payment processing and subscription billing.
- Amazon Web Services (Amazon SES) — sending email, including our own service emails and email you send through the Send API and relay.
- Cloudflare — network delivery and security for our website and services.
- Infrastructure providers that host our servers and databases.
- Professional advisers (lawyers, accountants, insurers), and courts, regulators and law-enforcement bodies where required or permitted by law.
- A buyer or investor, if we are involved in a merger or sale of our business (they must honour this policy).
- Anyone else, with your consent.
The providers above are bound to protect information and may use it only to provide their service to us. Where a service provider acts on captured email on your behalf, it is listed as a sub-processor in the Data Processing Addendum.
5. Sending information overseas
Our customers and providers are worldwide. Information may be stored or processed in Australia, the United States and other countries where our providers operate (Stripe, AWS and Cloudflare each operate globally). Before we disclose information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, including through contracts. By using the service you understand that overseas recipients may not be subject to the Privacy Act.
When you visit our pages your browser also fetches fonts directly from Google Fonts, so Google receives your IP address and browser details. We don't share anything else with Google.
6. Cookies
We use only the cookies needed to run the site, and we set no advertising or analytics cookies. Because they are essential or set at your request, we don't show a cookie banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
MailWarrenAuth | Keeps you signed in. Secure, HttpOnly and same-site. | Your login session |
.AspNetCore.Antiforgery.* | Protects forms from cross-site request forgery. | Browser session |
mw-theme | Remembers your light/dark theme choice. | 1 year |
You can block or delete cookies in your browser, but the site won't work while signed-in cookies are blocked.
7. How long we keep it
- Captured email is deleted automatically after the retention period of your plan, or earlier if you delete it.
- Account information is kept while your account is open, and deleted or de-identified within a reasonable time after you close it.
- Financial and tax records are kept for as long as Australian law requires (generally five to seven years).
- Security and abuse records are kept as long as needed to protect the service and may be retained after closure where there is a fraud or abuse concern.
8. Security
We protect information with encrypted connections, hashed passwords, two-factor authentication (required for some accounts), access controls and monitoring. No system is perfectly secure, so please use a strong unique password and keep your keys secret.
If there is a data breach likely to result in serious harm, we will notify the affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. Where our customers' data is involved we will tell them without undue delay.
9. Your rights
You can ask us for access to the personal information we hold about you, and to correct it if it is inaccurate, out of date or incomplete. You can ask us to delete your account and information, and to export it. Email support@mailwarren.io; we may need to verify your identity first, and we will respond within 30 days. We may refuse or limit a request where the law allows (for example where it would reveal someone else's information), and we'll tell you why.
If you think we've breached the Privacy Act or this policy, contact us at the same address and we will investigate and reply within 30 days. If you're not satisfied you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).
If your email is captured by MailWarren because someone else's application sent it, contact that organisation about your information: they, not we, decide what is sent to us.
10. If you're in the European Economic Area, the UK or California
- EEA/UK: for account information we rely on performing our contract with you, our legitimate interests in running and securing the service, legal obligations and, where needed, your consent. You have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent, and can complain to your local data-protection authority. Where data is transferred outside your region we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
- California: we do not sell or share personal information for cross-context advertising. You may request access, correction or deletion, and we won't discriminate against you for doing so.
11. Children
The service is for developers and businesses and isn't intended for anyone under 18. If you believe a child has given us information, contact us and we'll delete it.
12. Changes and contact
We may update this policy and will show the date above; we'll tell account holders about significant changes. Questions: support@mailwarren.io, attention Privacy, Carnage Group Pty Ltd.