Privacy notice

Last updated 22 October 2026

This notice explains how mxmoo.com, the mxmoo webmail and the mxmoo Mail Android app (package com.interactiveenterprises.mxmoo) handle personal data. Jump to: What we collect · Android app · Legal bases · Sharing · Retention · Your rights · Delete your account

1. Who we are

mxmoo.com (“we”, “us”) is operated by Interactive Enterprises Limited, a company registered in the Isle of Man (company number 137228C). We are the controller for account, billing, mailbox and app data, and a processor for the email our sending customers send through us on their own behalf. Questions or requests: privacy@mxsin.com.

2. What we collect, by service

• Accounts: name, company, email address, password hash (never the password itself), two-step verification settings, sign-in history (time, IP address, browser or device), security and audit records, and the messages you send to support.
• Mailboxes (@mxsin.com and your own domains): the mail you send and receive, folders, contacts, calendars, filters and blocked-sender lists, stored on our servers so you can reach them from any device.
• Email content: we process message content only to deliver, store, filter (spam, malware, phishing) and display it for you. We do not read it for any other purpose, use it for advertising, or use it to train AI models. Staff access only happens when you ask for support or when the law or the security of the service requires it, and is logged.
• Sending service and API: for customers sending through our API or SMTP, message metadata (sender, recipient, subject, status, timestamps, receiving-server responses, and opens and clicks only if the customer switched tracking on) and API request logs (time, IP address, endpoint, result). Message bodies are held only until they are handed to the receiving server.
• Billing: plan, invoices, billing name and address, and payment status. Card and wallet details are handled by our payment processors; we never see or store full card numbers.
• Webmail: your preferences (theme, layout, signatures, undo-send and refresh settings) and a session cookie that keeps you signed in.
• Abuse and security data: bounce and complaint reports, blocklist checks, malware scan results and rate-limit counters.

3. The mxmoo Mail Android app

• Stored on your device: cached messages, folders and attachments for offline reading, your settings, and sign-in data. Passwords for external IMAP accounts are encrypted with a key held in the Android Keystore. Microsoft sign-in tokens are stored on the device in the same protected way. Uninstalling the app or removing an account deletes this data from the phone.
• External accounts (any IMAP account, or a Microsoft account added with Microsoft sign-in): the app connects directly from your phone to that provider. Their mail, passwords and tokens are never sent to or stored on our servers.
• Notifications: new-mail alerts are produced by the app itself while it syncs with your mail servers. The app does not use a third-party push service, so no push notification token is created or shared.
• Permissions used: Internet (to reach mail servers); Notifications (new-mail and reminder alerts; you can refuse it); Exact alarms (reminders, scheduled send and snooze at the time you pick); Run at start-up (to restore those alarms and background sync after a restart); Foreground service (keeps mail sync running reliably, with a visible notification); Biometrics (optional fingerprint or face unlock, checked by Android, and we never receive biometric data). The app does not request access to your contacts, camera, location or microphone. Attachments are chosen with the Android file picker, which only gives the app the files you select.
• No ads, no tracking: the app contains no advertising, no analytics or tracking SDKs, and no tracking pixels. We do not sell or rent personal data, and we do not share it for advertising.
• Microsoft and Google accounts: data obtained through Microsoft sign-in (Outlook, Hotmail, Microsoft 365) or from a Google account is used only to show, send and manage that mailbox for you inside the app. It is not transferred to us or anyone else, not used for advertising, not used to train AI, and not read by people, except with your explicit consent, for security reasons, or to comply with the law. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and we follow the Microsoft identity platform terms in the same way. You can revoke access at any time in your Microsoft or Google account settings, or by removing the account from the app.

4. Why we use data and our legal bases

We rely on the UK GDPR and the Isle of Man Data Protection Act 2018 (with the Data Protection (Application of GDPR) Order 2018):

• Contract: to provide accounts, mailboxes, the sending service, webmail and the app, and to bill for them.
• Legitimate interests: to keep the service and the wider email ecosystem safe (spam, malware and fraud prevention, rate limits, abuse handling) and to improve reliability.
• Legal obligation: accounting, tax and lawful requests from authorities.
• Consent: optional cookies and optional features such as biometric unlock; you can withdraw consent at any time.

5. Who we share data with

We use a small number of carefully chosen service providers under written data processing terms:

• our hosting provider, which runs our servers in data centres in the European Union;
• our payment processors, Stripe and PayPal, for subscriptions and invoices;
• a bot-protection provider that checks sign-in and sign-up forms for automated abuse.

Email you send is, by its nature, delivered to the recipient’s provider. We disclose data to authorities only where the law requires it. We never sell personal data.

6. International transfers

Our servers are in the European Union, which the Isle of Man and the UK recognise as providing adequate protection. Where a provider processes data elsewhere (for example a payment processor), we rely on adequacy decisions or standard contractual clauses with appropriate safeguards.

7. How long we keep data

• Mailbox content: until you delete it or close the mailbox, then removed from live systems within 30 days and from backups within 90 days.
• Sending message logs: 30 days. Inbound webhook copies: 7 days. API request logs: 30 days.
• Account and security records: for the life of the account plus up to 12 months.
• Invoices and billing records: as long as tax law requires (normally 6 years).
• Cookie consent records: 2 years.
• Data on your phone: until you remove the account or uninstall the app.

8. Security

Connections use TLS. Passwords are stored as strong one-way hashes, and two-step verification is available for accounts and mailboxes. Access to systems is restricted and logged, and servers are patched and monitored. On Android, stored credentials are encrypted with keys in the Android Keystore. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

9. Your rights

You can ask to access, correct, delete, restrict or object to the use of your data, and to receive a copy in a portable format. Email privacy@mxsin.com; we reply within one month. You can also complain to the Isle of Man Information Commissioner or the UK Information Commissioner’s Office.

10. Delete your account and data

You can ask us to delete your mxmoo account, mailboxes and associated data at any time:

1. Email privacy@mxsin.com with the subject “Delete my account”, sent from the email address on the account or the mailbox to be deleted (or include that address).
2. We confirm the request, which may include a check that you own the account, and then delete the account, its mailboxes, stored mail, contacts, calendars, settings and logs within 30 days (backups within 90 days).
3. We keep only what the law requires, such as invoices, and anything needed to handle an unresolved abuse or legal matter.

App data only: to remove data from your phone, remove the account in the mxmoo Mail app or uninstall it. External IMAP and Microsoft accounts are never stored on our servers, so removing them from the app deletes everything we could hold for them. You can also revoke the app’s access in your Microsoft or Google account settings.

Deleting some of your data without closing your account

• You can delete individual emails, folders, contacts and calendar events yourself at any time in the mxmoo Mail app or in webmail. Deleted items go to Trash and are permanently removed when Trash is emptied.
• On your device, signing out of the mxmoo Mail app removes all locally cached data.
• To have other specific data deleted (for example logs or settings), email privacy@mxsin.com saying what you want removed. We action requests within 30 days.

11. Children

Our services are not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

12. Cookies

We use essential cookies to keep you signed in and secure, and optional preference cookies only with your consent. We use no advertising or analytics cookies. See the cookie policy.

13. Changes to this notice

We will post any changes here and update the date above. For significant changes we will also tell account holders by email or in the app.

14. Contact

Interactive Enterprises Limited, Isle of Man · privacy@mxsin.com