Data Protection Policy of Mailvelope

3.1 Contacting us

If you provide us with personal data for the purpose of or in connection with contacting us, these data will be stored by us only for as long as this is required for communication, customer contact, and project planning/implementation purposes. As soon as the personal data is no longer required by us for these purposes, they will be deleted immediately.

3.2 Using the website

We don't use cookies and our hosting provider logs IP addresses only in shortened form. To get basic information about the traffic on our website we use the privacy concerned Google Analytics alternative plausible.io which is handling all data absolutely anonymously without persistent identifiers (cookies). Data is neither tracked across-sites or devices nor used for any other purposes.

3.3 Using the Mailvelope download server

Our server download.mailvelope.com collects anonymous technical data, such as the name of your web browser, operating system, information about the website from which you linked to us and the pages on our server that you visit. These data are stored automatically. They are analyzed in anonymous form and solely for statistical purposes with the aim of further improving our service for you.

3.4 Download of the Mailvelope Extension

3.4.1 Chrome Extension

Chrome Extensions are hosted on the Chrome Web Store. Please refer to www.google.com/policies/privacy for information on which data is collected if you download the extension or during the regular updates.

3.4.2 Firefox Add-On

Firefox add-ons are hosted on addons.mozilla.org (AMO). Please refer to www.mozilla.org/en-US/privacy for information on which data is collected if you download the extension or during the regular updates.

3.4.3 Edge Extension

Edge Extensions are hosted on Microsoft Edge-Add-Ons. Please refer to https://privacy.microsoft.com/en-us/ for information on which data is collected if you download the extension or during the regular updates.

3.5 Using the browser extension

Mailvelope stores data only locally in the local storage of the browser, which is not accessible by other applications. Sensitive or personal user data is stored in Mailvelope only in the form of PGP keys, which contain user name and email address, and are stored in the keyring of Mailvelope. When a new PGP key is generated, Mailvelope has the option (default: on) to upload the key to the Mailvelope key server (see 3.6). Apart from that, when the resp. options are activated in the key server settings of Mailvelope (default: on), the following mechanisms could leak meta data of the user:

• The browser extension by default searches for keys on the Mailvelope key server and on keys.openpgp.org for unknown email addresses. In the process of this key search, the email address of a contact is sent from the extension to the key server.
• The browser extension by default searches for keys in the Web Key Directory (WKD). In the process of this key search, the hashed email address of a contact is sent from the extension to mail providers that support WKD.

Mailvelope will ask the user during the setup process for consent to share aggregated and anonymized analytics information with us. We use the Clean Insights measurement platform to help better understand app usage patterns. Data is captured in a privacy-preserving way: we don’t use a tracking cookie, we don't store IP addresses, we don’t capture personal information, and we don’t track users across sites. We use Matomo to collect information about your usage of the browser extension.

3.6 Using the Mailvelope key server

By uploading a key to the key server you give us your revocable consent to store the key (which may contain personal information like your real name and your email address) on the key server so that we can serve it to other users who are addressing encrypted messages to your email address. You can delete your keys from the server at any time at keys.mailvelope.com/manage.html.

When searching for keys on the key server we collect anonymous technical data, such as the name of your web browser and operating system. These data are stored automatically. They are analyzed in anonymous form and solely for statistical purposes with the aim of further improving our service for you.

3.7 Using the Gmail API integration

If you grant the Mailvelope browser extension access to your Gmail account via Google API Services, it will solely use this access for enhancing Gmail with PGP encryption services. Specifically, this means:

• The browser extension will use its access only to read Gmail message bodies (including attachments), metadata and headers to display the content of encrypted emails and attachments within the Gmail UI. Furthermore the Mailvelope email editor component allows users to compose and send encrypted emails.
• Your emails and your user data are processed only in the local installation of the browser extension and will never be shared with any third party nor transmitted to a Mailvelope server.
• The Mailvelope browser extension stores your email address and your access token for Gmail in the local storage of the browser (which is only accessible by Mailvelope). Emails and other data from your Gmail account are never stored in the browser extension.
• Mailvelope does not include advertisements. Your Gmail data will not be used for serving advertisements.
• The browser extension will never send emails without your consent. All actions have to be triggered by you.
• Mailvelope's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

3.8 Using Mailvelope Business & Enterprise

For managing the Mailvelope subscription services, processing of payments and billing we collect personal information such as your email, name, address, VAT information, preferred payment channel, etc.

We do not have direct access to your credit card or debit card information. This information is collected and processed securely directly by the third party payment processing services involved such as our payment gateway and your bank.

Mailvelope uses Chargebee for subscription management and as a payment gateway. Your data is processed in compliance with the GDPR. Please see www.chargebee.com/security/gdpr for further details. According to the chargebee.com privacy policy www.chargebee.com/privacy/ Chargebee may use cookies in order to be able to secure and process your purchase order as part of the payment and billing process of Mailvelope Business. You can remove consent at any moment by deleting such cookies from your cache in your browser settings or enabling "Do Not Track" flag in your browser settings.

If you are a non-profit and have been granted free access to our business products your personal data will be processed according to this chapter.

3.9 Signing up to our newsletter

Mailvelope uses Mailjet, a GDPR compliant and privacy concerned newsletter service provider to send its newsletters. When you sign up to our newsletter we collect your name, email and IP address as part of the newsletter signup process. This information is required to be able to get in touch with you and for security purposes such as spam and abuse detection. Privacy policies of Mailjet can be found here: https://www.mailjet.com/security-privacy/

3.10 Surveys

We may collect personal information about you and your usage of Mailvelope as part of voluntary surveys you participate in. Surveys may request personal information such as your name, email, phone number, organization name, etc.