Privacy Policy

Who we are

Viremail is provided by Svayam Incarnation Limited, a company registered in England and Wales (company number 15228262, registered office 124 City Road, London, England, EC1V 2NX). For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of the personal data described in this policy.

Data protection contact: [email protected], or contact us at [email protected].

If an organisation (such as your employer) provides your Viremail account, that organisation may be the controller of your mailbox data and we act as its processor. See our Data Processing Addendum.

The data we collect

Information you give us

• Account data: your name, email address and password. Your password is stored only as a one-way hash by our mail server.
• Recovery email (optional): stored on our mail server and used only to help you recover your account and send security notices.
• Profile (optional): profile photo, bio, job title, company, location and website.
• Your content: email messages and attachments, contacts, calendars, tasks and notes, chat messages and stories you share with other Viremail users, and the files, Write docs, Grids, Decks and forms you keep in Drive.
• Data from people without an account: when you share a link, people who open it may give us information too, for example the answers someone gives to your form, the name a guest types to join your call, or the name, email address and answers someone gives when they book a time or send you a message (an enquiry) on your booking page. For that data, you decide what is collected and we process it for you. An enquiry is sent to your own inbox only, never to the address the person typed.
• Leads: the people who book a time with you or send you a message from your booking page, and anyone you add yourself, with their stage, follow-up date, your notes, their bookings and messages, and the emails you sent them from Leads or Pinglar. Bookings, enquiries and leads are your customer data: you control them, you can export or delete any of them at any time, and we keep them encrypted and process them only for you.
• Vault: the passwords, sign-in codes and notes you keep in the Vault. They are encrypted in your browser, with keys only your devices hold, before they reach us, so we store them but cannot read them. We can see that you have a Vault, how many items it holds, the approximate size of each item (rounded up in steps of 256 bytes), when each one changed and a number that goes up with each change. When you ask the Vault to check passwords against known breaches, we receive the first 5 characters of a SHA-1 hash of each password checked, pass them to Have I Been Pwned, keep the answer in memory for up to 24 hours, and never log them. When you export your Vault, we check your password and email you about it; the file itself is made on your device.
• Support messages: anything you tell us when you contact us.

Information created when you use the service

• Session data: while you are signed in, your mailbox password is held in your server-side session, encrypted with AES-GCM, so we can open your mailbox for you. It is deleted when you sign out or the session expires.
• Security logs: the time of each sign-in attempt, IP address, device and browser type, and whether it succeeded.
• Sharing records: who you shared a folder, file or board with, what they can do and since when, and what others shared with you. As the owner of something you can always see who can open it, in Settings, People and access. If you join a workspace, its owner and admins can see this sharing information for its members (the names of the items, the roles and the dates, never their contents or your activity) and can remove access. They can never give anyone access to your own things. Each time an admin looks at or changes a member’s sharing, it is recorded in the workspace audit log.
• Mailbox sharing (delegated access): if you share your mailbox with someone, we process your mail on their behalf only as far as you allowed, using a separate password made for that access and stored encrypted. We keep a log of what they do in it (the time, the kind of action, the folder and message number, and a hashed network address, never the subject or the text), so you can see it. You can share only part of your mailbox (some folders, mail from some senders, or one conversation), and we enforce that on every request. If you let them send as you, their emails carry only your name, but the log still records who sent each one. We alert you about each such email (unless you turn that off) and when someone opens an unusual amount of your mail. The person using the access, and workspace admins who oversee either of you, can see that the access exists but not this log; admins see only what kind of part was shared, not which senders or folders. If you share a mailbox that others write to, you are responsible for telling them where that is needed, for example employees whose mail an assistant reads.
• Sharing your calendar, contacts, Drive, leads or booking page: if you share one of these, we let that person see or change it only as far as you allowed, checked on every request. A calendar or contacts share uses its own password on your mailbox, made for that access, stored encrypted and deleted when the access ends; it can reach your calendars and contacts only, never your mail. Events you mark private or confidential are only ever shown to them as busy time. We keep the same kind of log of what they do (the time, the kind of action, and which calendar, contact, lead or file, never what is in it), so you can see it.
• Shared mailboxes: if your workspace adds you to a shared mailbox (such as support@), we keep the same kind of log of what you do in it, with your name, and the workspace’s owner and admins can see it, because the mailbox belongs to the workspace. They never see this log for your own mailbox.
• Country: we may derive your approximate country from your IP address (via a header added by our network provider, Cloudflare). We use this for security and for aggregate statistics on our own internal dashboard (for example, number of people online, countries and device types). We do not use third-party analytics.
• Sign-in security: if you turn them on: your two-step verification secret (stored encrypted), one-way hashes of your backup codes, the public keys of your passkeys, and tokens for devices you choose to trust.
• Encryption keys: if you turn on end-to-end encryption, your OpenPGP public key and your private key, which is encrypted in your browser with your password before it reaches us. We cannot read it.
• Message metadata: sender, recipients, subject line, dates and sizes, which mail servers need to deliver and store mail. This is visible to us even for end-to-end encrypted messages.
• Call data: when you make audio or video calls, connection details (such as IP addresses) needed to set up the call. Calls are not recorded.
• Notification subscriptions: if you allow notifications on a device, the address your browser gives us for sending them to that device.

How we use your data and our lawful bases

We only use personal data where we have a lawful basis under UK GDPR.

Where we rely on legitimate interests, we have balanced them against your rights. You can object: see Your rights.

What we don't do

• We do not show ads, and we do not sell or rent your personal data.
• We do not use Google Analytics, advertising networks or third-party tracking.
• We do not scan your mail to build advertising profiles.
• External images in emails are blocked by default, to stop senders tracking when you open messages.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who we share data with

Your mail and account data are stored on our own mail servers. We share limited data only with:

We may use a search-engine verification meta tag (for example, Google Search Console). This is a line of text in our web page and does not track you.

Business accounts

Draft for legal review. This part describes Business Viremail and does not apply until it has been approved and published.

If your organisation gave you a mailbox on its own domain, your organisation is the controller of that mailbox’s data, and we process it on its behalf under our Data Processing Addendum. Your organisation’s privacy notice tells you how it uses it.

• What business admins can do: create mailboxes and send their sign-in details, see who has a mailbox, and reset a password. A reset signs the person out and they are told. Admins can only see what is in a mailbox through access its owner gave them, which is recorded.
• Business analytics (not yet available): if your organisation turns them on, we count activity and record presence, and location if it chooses, for your organisation as its processor, only after you have seen a notice. See our Workplace Monitoring Policy.
• Paying for Business: when a business buys a plan, Stripe processes the payment as an independent controller. We keep the billing contact, company details, tax ID, plan, seats and invoices, and never see full card details. Invoices are kept for 7 years for tax.
• The business people book: a business keeps one shared record of each of its customers and contacts, in its own people book. It holds what the business saves, such as names, email addresses, phone numbers and notes, and the business’s leads point to it. The book is kept on our contacts server, with an encrypted index so it can be searched, and the business can let its staff sync it to their phones.
• Invoices a business sends (Billing, coming soon): an issued invoice keeps a copy of the customer’s name, address, tax ID and email as they were on the day, because tax law needs the invoice to stay as it was. That copy is kept for as long as tax law requires, even if the person is later deleted from the people book.
• Review requests (coming soon): a business can email its paying customers to ask for a review. The link in the email goes through us, so the business can see that it was used; we keep counts and a hashed form of the address, never a raw IP address that could follow you from day to day. Counting opens with a tracking pixel is off by default, and a business may only turn it on if its customers agreed. Every email has a one-click unsubscribe.
• Business pages: a business decides what its page at viremail.com/<name> says and is the controller of what the page shows. We host it. The page sets no cookies; clicks on its links are counted without one. If you report a page, we keep your report, and your email address only if you give it.
• Rota and timesheets: if your employer uses Rota, it keeps your shifts, time off, clock events and timesheets as working time records. Location and network checks at clock-in are optional and only start after you have been told. See the Workplace Monitoring Policy.

The Viremail Vault browser extension

The Viremail Vault extension (in beta) fills the logins and sign-in codes in your Vault on other websites. It works only after you pair it with your Vault, and it talks only to viremail.com.

• What it can see on a page. When you click its button, the address of the tab you are on, so it can show the logins saved for that website, and that page's sign-in fields, so it can fill them when you choose Fill. If you turn on Suggest on every site, your browser lets it look at the https pages you open, to find sign-in fields and show its icon in them. When you sign in somewhere, it notes what you typed into the username and password fields so it can offer to save them; that stays in the extension's memory on your device and is forgotten after 2 minutes if you don't save it. When you choose Scan this page for a 2FA QR code, it takes a picture of the visible page, reads the code on your device and throws the picture away.
• What it sends. Only your Vault items, encrypted on your device exactly as in the Vault itself, and the changes you save. It never sends us, or anyone, the content of the pages you visit, their addresses, or anything you type. It has no analytics and no tracking.
• Where its keys are. While it's unlocked, your Vault's key is kept only in the extension's memory and in the browser's session storage, which the browser clears when it closes; it goes when the extension locks. The extension's own pairing key and its access token are kept in the browser's extension storage on that device. The token can only read your encrypted Vault and save changes to it (saving also needs your unlocked Vault); it can't open your mail or anything else.
• What we keep. For each paired browser: its name (like Chrome on Mac), when it was paired, when it was last used (to the minute) and a one-way hash of its token, never the token itself. We email you when a browser is paired. We keep this until you revoke it in Vault settings or unpair it in the extension, your Vault is erased, or your account is deleted. We process it to provide the feature you asked for (contract).

AI apps you connect (beta)

You can connect an AI app, such as Claude by Anthropic or ChatGPT by OpenAI, to your account. You approve each one in Viremail, choose the account and what it may do, and can disconnect it at any time in Settings, AI and connected apps. If you allow it, an app can also save drafts, add events, Write docs and tasks, and send email. By default each email or invitation waits for your approval: what it wants to send is kept encrypted until you decide, and deleted once you approve or decline it or after 30 minutes. A record that a request was made and what happened to it (never its content) is kept for 30 days.

• What we send. Only what the app asks for, within what you allowed, at the moment it asks: for example the results of a search in your email, one email, your events for a week, or the text of a file. Text other people wrote is marked as theirs.
• Who is responsible for it then. The company behind the AI app decides what happens to what it receives, under its own terms and privacy policy. It is an independent controller, not our sub-processor, and we do not control how it uses or keeps that data.
• What is never shared. Your Vault, your Pinglar chats, end-to-end encrypted email, mailboxes, calendars and files other people shared with you through Access sharing, files you only opened from a link, anything in the Trash, your password and your account settings.
• What we keep. For each connection: the app’s name and the address it signs in through, what you allowed, when you connected it and last used it, one-way hashes of its access tokens (never the tokens themselves), and an app password made for it, stored encrypted. We also keep a log of what it did: which action, how many results, a one-way tag for the item and a keyed hash of the network address, never the content, never your search words. Log entries are kept for 365 days. When a connection ends, its tokens and app password are deleted at once, and its record goes a year later. Everything goes when you delete your account. We process this to provide the feature you asked for (contract).

International transfers

Your data is hosted on our own servers. Where the third parties listed above process data outside the UK, transfers rely on appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. Contact us for more details. Server locations: our servers are run by Contabo GmbH, the service and its data in the European Union (France) and mail in the United Kingdom.

Viremail for desktop

The Viremail app for Mac, Windows and Linux opens the same service as your browser, so the rest of this policy applies to it in the same way. In addition:

• Every few hours the app asks our server whether a new version is out. Like any web request, this carries your IP address and the app's version number. Our server does not keep a log of these requests; the network services in front of it may keep short-lived technical logs for security.
• The installers and update files are stored with GitHub, Inc. When you download the app or an update, GitHub sees your IP address, under its own privacy statement.
• On Windows and Linux, the spelling dictionaries for the languages you choose are downloaded from Google's servers the first time they are needed. Nothing you type is sent.
• The app sends no usage data or analytics. Its own logs stay on your computer.

How long we keep data

See the full Data Retention Policy.

Your rights

Under UK data protection law you have the right to:

• Access a copy of your personal data.
• Rectify inaccurate data. You can edit most of it in Settings.
• Erase your data. Delete your account in Settings, Account.
• Restrict or object to our processing, including processing based on legitimate interests.
• Data portability: download your mail with any IMAP client or via "Show original", or ask us for an export.
• Withdraw consent at any time, where we rely on consent.

To make a request, contact us at [email protected]. We will respond within one month, and may need to confirm your identity first. There is normally no charge.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to deal with your concerns first.

Security

We use encryption in transit (TLS), encrypted storage of sensitive secrets, two-step verification, passkeys and optional end-to-end encryption. No system is perfectly secure; see our Security Overview.

Children

Viremail is not intended for children under 13 and we do not knowingly allow them to create accounts. See our Children's Privacy policy.

Changes to this policy

We may update this policy. If changes are significant, we will tell you by email or in the app before they take effect.

Contact us

For any privacy question, contact us at [email protected].