Privacy Policy

1. Scope

This policy applies to Biridea Mail websites, account and billing pages, hosted mailboxes, web and mobile mail clients, support interactions, domain purchases and renewals, DNS management, and connected IMAP, SMTP and ManageSieve functionality. It does not govern an independent third-party website or service merely because Biridea Mail links to it.

Our service is intended for businesses and people acting with authority for a business or domain owner. It is not directed to children.

2. Information we collect

Account and profile information

• Your name, Azerbaijani phone number, phone-verification status, profile image, preferred language and account creation date.
• A one-way hash of your administration password. We do not store the original administration password.
• Your subscription, plan, billing cycle, trial and service status, domain and mailbox limits, cancellation or pause instructions, and account roles.

Mailbox and authentication information

• Mailbox addresses, folder structure, quota and usage, mailbox status, and the settings needed to provide IMAP, SMTP and server-side mail rules.
• For webmail, mailbox credentials are held in the authenticated server-side session so Biridea can connect to the mail server on your behalf. For mobile access, mailbox credentials are stored in an authenticated encrypted envelope; raw bearer tokens are not stored.
• If you enable two-factor authentication, we store an encrypted authenticator seed, hashed single-use recovery codes, replay-prevention data and short-lived verification challenges.

Email and productivity data

• Messages stored on the mail server, including sender and recipient addresses, subject, date, headers, body, attachments and delivery or read flags.
• A PostgreSQL cache may contain message metadata, previews and bodies to provide faster listing, threading, search, drafts and message display. Attachment metadata may be cached; attachment files are normally streamed from the mail server when requested.
• Drafts, contacts, signatures, templates, labels, blocked senders, filters, forwarding rules, vacation/auto-reply settings, preferences and profile data you choose to save.
• Outbound abuse-control information such as sender, recipient count, rate-limit events, SpamAssassin score and whether a send was allowed, flagged or blocked. We may process message content to detect spam, malware, abuse and policy violations.

Domains, DNS and registrant data

• Domains you connect or buy, ownership relationships, DNS records and checks, DKIM/SPF/DMARC configuration, registration and expiry dates, auto-renew settings, registrar order references and fulfilment errors.
• For a domain bought through us: registrant name, organization, postal address, city, region, postal code, country, phone and email. We must pass this data to the registrar and registry to register and administer the domain.

Payments and transactions

• Order and transaction identifiers, amount, currency, status, payment history and a reusable card token supplied by epoint for automatic renewal.
• Card numbers and security codes are entered on epoint’s hosted payment service and are not stored by Biridea Mail.

Device, usage and support data

• Session identifiers, IP address, request time, browser or device information, security and error logs, locale and interactions necessary to operate and protect the service.
• For mobile notifications: mailbox address, device identifier, platform, push provider and push token. Notification delivery may reveal limited new-mail information on a locked device according to your device settings.
• Support requests, feedback, files or screenshots you submit, and diagnostic information needed to investigate the request.

3. Why and how we use information

We process information where necessary to provide the service you request, comply with law, protect legitimate business and security interests, or act with your consent where consent is required. Uses include:

• creating and verifying accounts; authenticating web and mobile sessions; providing mailbox and administration access;
• receiving, storing, displaying, searching, sending, forwarding and organizing email; applying server-side filters, blocks and auto-replies;
• provisioning mailboxes and domains, verifying DNS, signing mail with DKIM, checking quota and streaming attachments;
• registering and renewing domains and maintaining required registration data;
• processing subscription and domain payments, trials, automatic renewals, cancellation, pause, gifts, receipts and failed-payment recovery;
• sending SMS verification codes, security messages, service notices and push notifications;
• preventing spam, phishing, fraud, credential abuse and damage to our shared sending infrastructure; enforcing recipient and rate limits;
• debugging, maintaining, measuring and improving reliability, usability and security; and
• responding to support requests, legal claims, lawful authority requests and other legal obligations.

We do not sell your personal information. We do not use private mailbox content to sell advertising.

4. When information is shared

We disclose only what is reasonably necessary for the relevant purpose:

• Mail and infrastructure providers: hosting, PostgreSQL database, Dovecot/Exim mail servers, DNS and system-administration providers that process data for service delivery.
• Payments: epoint receives transaction and card information to process payments and return payment/card tokens.
• Domains: our registrar, registries, ICANN-related services and registration-data services receive registrant and domain information. Some registration information may be available through public or controlled WHOIS/RDAP access where registry policy or law requires it.
• Communications: SMS providers receive phone and verification-message data; Apple, Google, Expo or another configured push provider receives push-token and notification-delivery data.
• Mail delivery and user choices: sending email necessarily shares its contents with recipients and the mail systems they use. Loading a sender image from Gravatar or permitted remote content may cause a request to that third party.
• Professional and legal recipients: advisers, auditors, insurers, courts, regulators, law enforcement or other parties where required by law or reasonably necessary to protect rights, users, the public or the service.
• Business changes: a buyer, investor or successor may receive relevant data under confidentiality safeguards during a merger, financing, restructuring or transfer of the service.

Providers may process information in Azerbaijan or other countries. When data crosses borders, we use contractual, security or other safeguards appropriate to the data and applicable requirements.

5. Customer control and mailbox content

The customer account owner controls its domains and provisioned mailboxes and is responsible for authorizing mailbox users. If your mailbox is provided by your employer or another organization, that organization may create, suspend, access through authorized administration tools, or delete the mailbox and may have its own retention and monitoring obligations.

We access private message content only as needed to deliver requested features, provide support you request, protect the service, investigate suspected abuse or security incidents, comply with law, or maintain infrastructure. Automated spam scoring, remote-image protection, message rendering, search and rule processing are forms of content processing needed for those features.

6. Retention and deletion

We retain information for the time reasonably needed to operate the service, maintain security, meet tax/accounting and domain-registration duties, resolve disputes and enforce agreements. Retention depends on the type of data:

• account, subscription, payment and domain-order records may remain after closure where required for accounting, fraud prevention, registrar obligations or legal claims;
• mailbox content remains until it is deleted through the mailbox, the mailbox is removed, or the hosting relationship ends, subject to server operations and backup deletion cycles;
• cached message content and metadata may be rebuilt from IMAP and is removed or refreshed during normal cache, mailbox and account lifecycle operations;
• session, mobile token, challenge, OTP, rate-limit and security records expire, are revoked or are removed according to their security purpose;
• domain registrant data may need to be retained or escrowed by registrars and registries after expiry or transfer; and
• backup copies and logs may persist for a limited period before rotation or secure deletion.

Deleting a message from Trash or through storage cleanup may be permanent. Moving a message to Trash does not necessarily free quota until it is permanently deleted.

7. Security

We use measures intended to protect information against unauthorized access, loss, alteration and disclosure. These include TLS for supported network connections, password hashing, encrypted mobile credential envelopes and two-factor secrets, hashed bearer/challenge/recovery tokens, access controls, tenant scoping, DKIM and authentication controls, rate limiting, abuse detection, audit logging and restricted administrative access.

No internet or storage system is completely secure. You must use strong unique passwords, enable two-factor authentication where available, protect recovery codes and devices, keep domain/DNS access secure, and notify us promptly of suspected compromise.

8. Your choices and rights

Subject to applicable law and verification of your identity and authority, you may ask us to provide information about processing, access personal information, correct inaccurate information, delete information, stop or restrict certain processing, or withdraw consent where processing depends on consent. Some requests may be limited by another person’s rights, customer-administrator control, mailbox ownership, security needs, domain/registry rules, or legal retention obligations.

You can directly update profile and mailbox settings, revoke mobile sessions, disable notifications, delete messages and contacts, remove rules, cancel future subscription renewal, and change domain auto-renew where those controls are available. Cancellation of service does not reverse a completed domain registration or renewal.

9. Cookies and similar storage

Biridea Mail uses necessary session cookies and local browser storage for authentication, security, language, navigation and application state. Blocking necessary cookies may prevent sign-in and core functionality. We do not currently describe or rely on third-party behavioral advertising cookies in the service; if this changes, this policy and any required consent controls will be updated.

10. Changes to this policy

We may update this policy to reflect service, provider, legal or security changes. The current version will remain at this URL with a revised effective date. We will provide additional notice where a material change or applicable law requires it.

11. Contact

For privacy questions or verified requests, contact Biridea through our contact page. Include “Biridea Mail privacy” and enough information to identify the relevant customer account or mailbox without sending your password, recovery codes or payment-card details.