Let op: de juridische teksten van MailDash staan in het Engels en het Tsjechisch. Een Nederlandse vertaling zonder juridische nalezing zou schijnzekerheid geven, dus die volgt pas na zo’n nalezing. De Engelse “Clear”-versie is de bindende tekst.
Privacy Policy — MailDash
Version 1.3 · Effective from 31-10-2026
1. Who is responsible
Data controller: We make AI work s.r.o., IČO 29697115, registered office Nové sady 988/2, Staré Brno, 602 00 Brno, registered in the Commercial Register kept by the Regional Court in Brno, file no. C 152497. Contact: support@maildash.eu. MailDash is our product; this policy covers only it.
2. Our default: minimise
We collect as little as we can (our internal rule: minimise → hash → encrypt). We do not sell data, run advertising or track you across sites. The pages you can read without signing in set no cookies and load nothing from a third party — no fonts, no analytics, no embedded anything. When you pay, you leave this website for Mollie’s own payment page; what Mollie stores in your browser there is covered by Mollie’s privacy statement, not this one.
3. What we collect and exactly why
If it is not in this table, we do not collect it.
| What | Why | Legal basis | Kept for | Where |
|---|---|---|---|---|
| Your e-mail address and the plan you chose (only if you pre-order) | to open your account and to write to you about your subscription — its opening, the notice before each renewal, a refund, its end. Nothing else, no newsletter | contract (Art. 6(1)(b)) | for as long as Czech accounting and tax law require us to keep the record of a payment; used for nothing else once your contract has ended | our database at Scaleway (France); a mailbox at Google Workspace (EU), operated by us, gets one note when a pre-order is paid; and at Mollie, with the payment |
| The payment: amount, status, plan, promo code, Mollie’s payment reference, and the reference of your permission for the yearly renewal (Mollie calls it a mandate). We read nothing else from Mollie — not your name, card or bank details | to know that you paid, to charge the yearly renewal you agreed to, and to refund you | contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c), accounting) | as above | Mollie B.V. (Netherlands) and our database at Scaleway (France) |
| If your bank or card issuer reverses a payment (a chargeback): which payment, Mollie's chargeback reference, the amount reversed, the fee Mollie charged us (and the Czech National Bank rate if we converted it), when your access paused and what it had left then, the payment link and the payment that settled it, when we mailed you about it, and how it ended - paid, reversed by your bank, or waived, with support's reason | To pause and restore your access exactly as the terms say (Reversed payments), to ask only what is owed and never more than Mollie charged us, and to record why a justified reversal cost you nothing | contract (Art. 6(1)(b)) and our accounting duty (Art. 6(1)(c)) | As long as the payment record it belongs to (accounting law). Deleting your account unlinks it from you; the money history itself stays | Scaleway (France), EU region |
| Your mailbox credentials — the app password you give us for a mailbox you connect | to sign in to that mailbox and read it. Nothing else: we never send, never mark read, never move and never delete anything at your provider | contract (Art. 6(1)(b)) | until you disconnect that mailbox or delete your account | Scaleway (France), encrypted with AES-256-GCM under a key held only by the running service — a copy of the database on its own decrypts nothing |
| The mail we collect for you: sender, subject, date, the message itself, and which folder a rule put it in | to show you your mail in one place, sorted. It is your mail; we do not read it, profile it, or use it to train anything | contract (Art. 6(1)(b)) | until you delete it or delete your account. Some kinds expire by themselves — a verification code after a day, a notice after a month — and deleting here never deletes at your provider | Scaleway (France), EU region |
| Your sign-in address and a session | to know it is you. There is no password: we mail a single-use link and store only its hash, so our own database cannot be used to sign in as you | contract (Art. 6(1)(b)) | a session lasts 30 days; a link, fifteen minutes | Scaleway (France) |
| Your passkeys: public key, credential id, signature counter, transports, device type, backup flag, an optional label, when added and last used. The private key never leaves your device; no fingerprint or face data ever reaches us | prove it is you; notice a cloned key | contract · legitimate interest (security) | until you remove it or are erased | Scaleway (France), EU region |
| Sign-in challenges (random, single use) | one passkey ceremony | contract | valid 5 minutes; deleted a day after it expires | Scaleway (France), EU region |
Technical log lines: time, request path, a masked form of the address (b…s@example.com), the payment status, and the IP address for rate limiting | keep the site up, stop abuse of the form, and prove a pre-order was received even if the mail fails | legitimate interest (Art. 6(1)(f)) | 30 days | Scaleway (France), EU region |
A pre-order lives in our database at Scaleway and at Mollie. An account’s data — the connected mailboxes, the collected mail, the session — lives in our database and object storage at Scaleway. If you never pre-order or sign in, we hold nothing about you beyond the 30-day technical log.
4. Who else touches the data (processors)
- Scaleway SAS (France) — hosting, the database, object storage, the log and the sign-in mail; EU company, EU region.
- BunnyWay d.o.o. (Slovenia) — the network in front of the site; EU company.
- Google Ireland Ltd. — the mailbox that receives your pre-order. A US-owned provider: we say so rather than hide it, and it is the only one here.
Each is bound by a data processing agreement and none may use the data for its own purposes. Mollie B.V. (Netherlands), a licensed EU payment institution, runs the payment page and the payment. For the payment itself Mollie is an independent controller, because payment and anti-money-laundering law make it responsible for that data; its own privacy statement applies. A new processor is named here in the same release, before it receives anything.
5. Your rights
Access, rectification, erasure, restriction, portability and objection — write to support@maildash.eu and we act within 30 days. We erase on request everything except the payment record that accounting law makes us keep, and we tell you which that is. If you have an account, you can erase it yourself, from the app: it destroys your encryption key first — so every credential and every message of yours becomes unreadable at once — then deletes the stored messages, the bodies in object storage and the account. What remains is a dated note that an erasure happened, with no personal data in it, because a deletion that leaves no trace cannot be told apart from a database losing a row. Nothing at your own providers is touched. You may complain to the Czech supervisory authority: ÚOOÚ, uoou.gov.cz.
6. Cookies and consent
One cookie, and only once you sign in. It holds a random session token, nothing about you, and it exists so the app knows it is you between clicks — strictly necessary, and therefore not something we may ask consent for or set before you sign in. It is HttpOnly (JavaScript cannot read it), Secure, SameSite=Lax, and it lasts 30 days or until you sign out.
There is still no analytics cookie, no advertising cookie and no third-party anything. The pages you can read without signing in set nothing at all. Version 1.0 of this policy said no cookies at all, which was true until the app existed; it changed in the same release as the app, which is the rule we hold ourselves to.
7. If you decline everything — the honest trade-off
You can read every word of this site without giving us anything, and nothing is degraded. The only thing you give up by not pre-ordering is MailDash itself.
8. Changes
Changes to the site that touch data — a new feature, a new processor, a payment flow — update this policy in the same release. The version and date at the top always tell you where you stand.