Privacy Policy

1. Introduction

PlusMail ("we", "us", or "our") respects the privacy rights of our users, developers, and visitors. This Privacy Policy describes how we handle personal data collected through our marketing website (https://mail.pluskode.com), our management console (https://dash.pluskode.com), and our email infrastructure services.

2. Information We Collect

We collect only the minimum necessary data to provide, secure, and operate email services:

• Account & Identification Data: When registering for an account or administrative access, we collect email addresses, encrypted password hashes (using argon2/bcrypt), and role permissions.
• Domain Configuration Data: Domain names, DNS records (SPF, DKIM, DMARC), and Cloudflare Zone metadata provided by administrators to verify sending identities.
• Inquiry & Contact Submissions: Information you voluntarily submit via our contact forms or email inboxes (such as your name, corporate email address, and message contents).
• Email Transmission Metadata: Outbound message headers (From, To, Subject, Timestamp, Message-ID), SMTP status codes, delivery receipts, bounce classifications, and spam complaint events necessary to maintain mail deliverability and operate suppression lists.
• Technical & Server Logs: Standard HTTP request logs, IP addresses, browser user-agent strings, and security event logs to detect and mitigate malicious attacks and abuse.

3. How We Use Collected Information

We process collected data exclusively for legitimate operational purposes:

• To provision, authenticate, route, and deliver requested transactional emails.
• To cryptographically sign outgoing messages with DKIM keys.
• To enforce bounce and complaint suppression and protect sending domain reputation.
• To detect, investigate, and prevent spam, spoofing, fraud, and acceptable use policy violations.
• To respond to technical inquiries and support requests.

We do not sell, rent, monetize, or broker personal information or email metadata to third-party advertisers or data brokers under any circumstances.

4. Cookies and Session Data

The public marketing website (https://mail.pluskode.com) does not deploy third-party advertising cookies, cross-site trackers, or behavioral profiling analytics.

Authentication and session data are handled according to the application’s configured security mechanisms. Authenticated users are advised to access their accounts from secure, trusted devices and sign out upon concluding administrative sessions.

5. Infrastructure Subprocessors

To provide reliable email infrastructure, PlusMail partners with world-class cloud service providers who act as data subprocessors:

6. Data Retention

We retain account details and domain records for as long as your organization maintains an active account. Transient transmission logs and delivery receipts are retained for diagnostic and debugging purposes for up to 30 days before automated rotation. Suppressed recipient addresses are retained indefinitely to prevent accidental sending in violation of anti-spam rules.

7. Security Practices

We implement technical and organizational safeguards including:

• Strict TLS 1.3 encryption for web transit and mandatory opportunistic TLS for outbound SMTP.
• Role-based access control (RBAC) ensuring tenant isolation.
• Asymmetric 2048-bit RSA key handling for DKIM message signing.
• Automated rate limiting to mitigate denial of service and brute force threats.

8. User Rights & Contact Procedure

Depending on your jurisdiction, you may have rights under applicable data protection laws to request access to, correction of, or deletion of your personal data.

To submit a privacy inquiry or exercise your data rights, please contact our data privacy coordinator at:

9. Policy Modifications

We reserve the right to amend this Privacy Policy as our services and legal requirements evolve. Changes will be posted to this page with an updated revision date.