MailNail Data Processing Agreement

Version 1.0. Effective 2026-09-28.

This agreement applies when an organization uses a MailNail team workspace. For the data the workspace owns, the organization (the "Customer") is the controller and MailNail is its processor. MailNail is run by Matyáš Černý, a Czech sole trader, IČO 10751084. When MailNail s.r.o. is incorporated, it takes over this agreement, and we will tell the Customer first.

The Customer accepts this agreement by creating a workspace or by accepting our Terms of Service for one. If it conflicts with the Terms of Service on data protection, this agreement wins. If it conflicts with the Standard Contractual Clauses, the Clauses win.

1. What we process and why

Annex I describes the processing: the people it concerns, the kinds of data, the purpose and how long it lasts. We process the Customer's data only to provide MailNail to the Customer. We never use it for advertising, never sell it, and never use it to train AI models.

2. Instructions

We process the Customer's data only on its documented instructions. These are this agreement, the Terms of Service, and the actions the Customer and its members take in MailNail, such as connecting a mailbox, granting access, creating an agent token, sending or deleting mail. If the law makes us process data in another way, we tell the Customer first, unless the law forbids it. If we believe an instruction breaks data protection law, we tell the Customer at once.

An agent token the Customer creates is an instruction too. The Customer chooses the agents it connects and their model providers, and is responsible for them.

3. Confidentiality

Everyone we let process the Customer's data is bound to keep it confidential, and only people who need it to run or secure the service get access.

4. Security

We protect the Customer's data with the measures in Annex II, as Article 32 GDPR requires. We may improve them, but never lower the overall level of protection.

5. Subprocessors

The Customer gives us general authorization to use subprocessors. Our subprocessor list names them. We tell the Customer at least 30 days before a new subprocessor starts, on that page and by email to the workspace owner. The Customer can object on reasonable data protection grounds within that time. If we cannot resolve the objection, the Customer can end the affected service without penalty.

Each subprocessor is bound by a written contract to protections at least as strong as these. We stay responsible to the Customer for its work.

6. Helping the Customer

We help the Customer answer requests from the people whose data it controls, such as access, correction, deletion and export. Members can delete mail, disconnect mailboxes and delete accounts themselves. For anything else, the Customer can write to us. If such a person contacts us directly, we send them to the Customer.

We also give the Customer the information it needs for security, breach notices, impact assessments and consultations with an authority (Articles 32 to 36 GDPR).

7. Breaches

We tell the Customer without undue delay, and within 72 hours, after we learn of a breach that affects its data. We say what happened, what data and how many people it concerns, the likely consequences and what we are doing about it. We may send the details in stages as we learn them.

8. End of the service

When the service ends, the Customer chooses whether we return its data in a common format or delete it. If it has not chosen within 30 days, we delete it. Copies in our backups leave within about 8 weeks. We keep only what the law requires us to keep.

9. Audits

We give the Customer the information it needs to show that we meet Article 28 GDPR. We first answer through documents and questionnaires, at most once a year. If those are not enough, or an authority requires it, the Customer or an independent auditor can audit us with 30 days' notice, at most once a year, under a confidentiality agreement. The Customer pays for such an audit, unless it finds that we broke this agreement.

10. International transfers

Our database and mail servers are in the EU. Where a subprocessor processes data outside the EU, we rely on the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914). Where the Clauses apply between us and the Customer, Module Two applies if the Customer is a controller and Module Three if it is a processor. The Annexes of this agreement serve as their Annexes. The Clauses are governed by Czech law, and disputes go to the Czech courts.

For the United Kingdom, the UK Addendum to the Clauses applies. For Switzerland, the Clauses apply with the Swiss data protection authority as the authority.

11. General terms

This agreement lasts as long as we process the Customer's data. Liability follows the Terms of Service, and nothing here limits the rights of the people whose data it is. Czech law governs this agreement, and the Czech courts decide disputes. Notices go to privacy@mailnail.com.

Annex I. The processing

Parties. The Customer, as controller. Matyáš Černý, IČO 10751084, as processor. Contact: privacy@mailnail.com.

People concerned. The Customer's members, the people who exchange mail with the workspace's mailboxes, and the recipients of its campaigns and API mail.

Data. Mail and attachments, their senders, recipients, dates and sizes, contacts, audiences, member accounts and access grants, credentials of connected inboxes, and records of what members and agents did. Mail can contain sensitive data that its senders put there. We treat all mail the same way and never look for such data.

Purpose and nature. To receive, sync, store, search, show and send the workspace's mail, run the AI features it switches on, and keep records that protect the account.

Duration. For as long as the service runs, then Section 8.

Authority. Úřad pro ochranu osobních údajů (ÚOOÚ), Czech Republic.

Annex II. Security measures

• Mail is encrypted as soon as it arrives, and stays encrypted at rest and in backups.
• Credentials of connected inboxes and other secrets are encrypted.
• Sign-in uses passkeys. Recovery keys and agent tokens are stored only in a form that cannot be turned back.
• Members reach only the mailboxes they have access to. Agent tokens are limited to the scopes and mailboxes set for them, and can be revoked at any time.
• Security events on each account are recorded.
• All connections to the app and the API are encrypted, and our mail servers encrypt mail in transit wherever the other server allows.
• We keep weekly backups for recovery.
• Development and production run in separate systems with separate data.
• Only people who need access to run or secure the service have it, and they are bound to confidentiality.

Annex III. Subprocessors

The subprocessor list, as updated under Section 5.