mailtanimailtani
Log InStart Your Free Trial
Terms of ServicePrivacy PolicyCookie PolicyRefund Policy

Privacy Policy

Last updated: May 28, 2026

This Privacy Policy explains how mailtani ("we", "us", "our") collects, uses, and protects your personal information when you use our email marketing platform at mailtani.com.

1. Data Controller

The data controller responsible for your personal data is:

Edmilson Jorge Delgado Gomes NIF: 251423832 Lisboa, Portugal Email: support [at] mailtani.com

2. Information We Collect

Account Information

  • Name and email address (provided during registration).
  • Payment information (processed by Polar.sh, our Merchant of Record; we do not store card details).
  • Google account information if you sign up via Google OAuth (name, email, profile picture).

Usage Data

  • Pages visited, features used, and interactions within the application.
  • Anonymous behavioural data (pageviews, clicks) collected via PostHog for all visitors; no personal identifiers are attached until you give consent.
  • Session recordings collected via PostHog only after you give explicit consent via the cookie banner.
  • Browser type, operating system, and device information.
  • IP address and approximate location.

Data You Provide

  • Contact lists and email addresses you upload.
  • Email content and campaign configurations.
  • Amazon SES API credentials (stored encrypted).
  • Custom fields, tags, and list configurations.
  • IMAP credentials for inbox sync (stored encrypted).

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data on the following legal bases:

| Data | Legal Basis | |---|---| | Account information (name, email) | Performance of a contract (Art. 6(1)(b)) | | Payment processing | Performance of a contract (Art. 6(1)(b)) | | Transactional emails | Performance of a contract (Art. 6(1)(b)) | | Anonymous analytics (PostHog — no PII) | Legitimate interest — improving the Service (Art. 6(1)(f)) | | Identified analytics and session recordings (PostHog) | Consent (Art. 6(1)(a)) | | Error tracking (Sentry) | Legitimate interest — improving stability (Art. 6(1)(f)) | | Fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) | | Payment records retention | Legal obligation — Portuguese tax law (Art. 6(1)(c)) |

4. How We Use Your Information

We use your information to:

  • Provide and maintain the Service.
  • Process payments and manage your subscription.
  • Send transactional emails (account confirmations, password resets, etc.).
  • Analyze anonymous usage patterns via PostHog to improve the platform (all visitors, no PII).
  • Analyze identified usage patterns and session recordings via PostHog (only if you have given consent).
  • Provide customer support.
  • Detect and prevent abuse or fraud.

We do not:

  • Sell your personal data to third parties.
  • Use your contact lists for our own marketing.
  • Share your email content with anyone.
  • Send you marketing emails without your consent.

5. Analytics & Session Recordings (PostHog)

We use PostHog for product analytics. It operates in two tiers:

Anonymous analytics (no consent required): PostHog collects pageviews, clicks, and interaction patterns from all visitors. Data is held in memory only — no cookies or persistent identifiers are written — and cannot be linked back to any individual. The legal basis is legitimate interest (Art. 6(1)(f)).

Identified analytics and session recordings (consent required): After you accept analytics cookies, PostHog additionally records your session (mouse movements, clicks, scrolls, page navigation) and links events to your account. The legal basis is your consent (Art. 6(1)(a)).

These recordings help us:

  • Identify usability issues and bugs.
  • Understand how features are used.
  • Improve the user experience.

PostHog does not capture:

  • Password fields or sensitive form inputs (all inputs are automatically masked).
  • Your uploaded contact data or email content.
  • Amazon SES credentials or IMAP passwords.

You may withdraw consent at any time via Settings or by contacting us at support [at] mailtani.com. Upon withdrawal, PostHog is shut down and no further data is collected or linked to you.

6. Your Role as a Data Controller

When you use mailtani to manage contact lists and send emails, you are the data controller for your subscribers' personal data. We act as a data processor on your behalf. You are responsible for:

  • Having a valid legal basis to process your subscribers' data.
  • Complying with GDPR, CAN-SPAM, and any other applicable laws when sending emails.
  • Honouring unsubscribe requests from your subscribers.

If you require a Data Processing Agreement (DPA), contact us at support [at] mailtani.com.

7. Data Storage and Security

  • mailtani is operated from Lisbon, Portugal. Your data is stored on servers within the European Union.
  • Amazon SES credentials and IMAP credentials are encrypted at rest.
  • We use HTTPS for all data transmission.
  • Access to production systems is restricted and audited.
  • We perform regular backups to prevent data loss.

8. Third-Party Services

We use the following third-party services:

| Service | Purpose | Data Shared | |---|---|---| | Amazon SES | Email sending (your account) | Your API credentials (encrypted) | | Polar.sh | Payment processing (Merchant of Record) | Email, payment details | | PostHog | Anonymous analytics (always) + identified analytics & session recordings (consent-gated) | Anonymous: behaviour only. Identified: usage data, session recordings | | Google OAuth | Social login | Name, email (if you choose Google login) | | Sentry | Error tracking | Technical error data (no personal content) |

Each third-party service operates under their own privacy policy.

9. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

  • Access your personal data.
  • Rectify inaccurate personal data.
  • Erase your personal data ("right to be forgotten").
  • Restrict processing of your personal data.
  • Data portability — receive your data in a structured format.
  • Object to processing of your personal data.
  • Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, contact us at support [at] mailtani.com. We will respond within 30 days. For complex requests, this period may be extended by a further two months, in which case we will notify you within the initial 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados): www.cnpd.pt.

10. Data Retention

  • Account data is retained as long as your account is active.
  • Upon account deletion, your data is permanently deleted within 30 days.
  • Payment records are retained for 10 years as required by Portuguese tax law (Decreto-Lei n.º 442-B/88).
  • Server logs are retained for 90 days.

11. Cookies

We use cookies for essential functionality (authentication, session management) and, with your consent, for analytics. See our Cookie Policy for full details.

12. Children's Privacy

The Service is intended for business use only and is not directed at individuals under 18. We do not knowingly collect personal information from minors.

13. International Data Transfers

If you access the Service from outside the EU, your data may be transferred to and processed in the EU. We ensure appropriate safeguards are in place for any such transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service. The "Last updated" date at the top of this page indicates when it was last revised.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at support [at] mailtani.com.