Privacy policy

VayaMail is run by Pantazi Software SRL, a company registered in Romania, which is the controller of the personal data described here. Write to hello@vayamail.com for anything on this page, including the requests listed under “Your rights”.

• Mailbox passwords are encrypted, used only for your migration, and deleted at the latest 24 hours after it ends.
• Messages pass from one server to the other in memory. We never store them.
• The record of a migration is deleted 30 days after it was created.
• We send no marketing email and sell no data.
• Visits are counted without storing anything on your device, unless you accept analytics in the cookie banner.

Mailbox logins. For the old and the new mailbox we receive the address, the server settings and the password. We need them to connect to both servers and copy your mail, which is the service you ask us for. Server settings and passwords are encrypted with AES-256-GCM before they are saved, with a key kept only in the server environment. They are deleted when you cancel or press “Delete my credentials now”, and automatically 24 hours after the migration finishes or fails, 24 hours after a checkout that was never paid, or 3 days after a migration that never finished.

Your mail. Messages are read from the old server and written to the new one in small batches held in memory. Message bodies and attachments are never written to disk or to our database. The old mailbox is opened read-only.

The migration record. We keep the two addresses, the server names, the folder list with message counts and sizes, the options you chose, the status, an optional address to notify, and the report. The report lists every message that could not be copied with its folder, message number, subject, date and the reason. Live progress is kept for up to 31 days and the record itself is deleted 30 days after the migration was created.

The free 1 GB. So that the free allowance applies once per mailbox, we keep a SHA-256 fingerprint of each mailbox login with the amount copied for free. The fingerprint does not contain the address and cannot be turned back into it by us. It is kept without a time limit, because that is what makes the allowance work.

Finding your mail server. To detect the server for an address we look up its domain in DNS, in Mozilla’s Thunderbird configuration database (autoconfig.thunderbird.net) and at autoconfig.<your domain>. Only the domain is sent, never the full address or the password.

Mail files you import (.mbox, .eml) are read in your browser. Messages are sent to our server in batches and written straight into the new mailbox; they are not stored. We keep the new mailbox’s login under the same rules as a migration, a label for what you picked (such as “Thunderbird files” or a file name), and the same migration record and report.

An account is optional. It is your email address, nothing else: you sign in with a one-time link that expires after 20 minutes, and a session lasts 30 days or until you sign out. While you have an account we keep its migrations (for 30 days each, as above), bulk uploads, credits and unlimited plan. Ask us at hello@vayamail.com and we delete the account.

Payments are made on Creem’s checkout page and processed by Creem. Your card details never reach us. When a checkout opens we pass Creem the product, the email address to pre-fill, and a reference to the migration or account it pays for. If you accepted analytics, we also pass your analytics visitor ID so the sale can be linked to the visit that led to it. Creem tells us when the payment succeeded and what was charged (price, discount code, tax and total). We keep the record of purchases and credits as long as tax and accounting rules require.

We send email only when you ask for it: the sign-in link, and the message that a migration finished or stopped. They are sent through Resend.

We count visits with Repora (repora.ro), a privacy-friendly analytics service without advertising trackers. For each page view it receives the page address, the referring page and campaign tags, the screen width, and how long the page was in view, plus the events we record on the site: for example that the pricing section was opened, a mailbox connected or a checkout started. Event data never includes addresses, passwords or server names. Like any website, Repora’s server also sees your IP address and browser user agent.

Unless you accept in the cookie banner, the counting uses a random ID that lives only in the open page, nothing is stored on your device, and one visit cannot be linked to the next. We do this on the basis of our legitimate interest in knowing how the site is used. If you accept, a random visitor ID is kept in your browser, and when you are signed in it is linked to your account ID (never your email address), so we can see which pages lead to purchases. You can change your choice at any time with “Cookie settings” at the bottom of every page. See the cookie policy for each item stored.

The settings finder, mail server check, SSL check, DNS check and BIMI checker send what you type (an address, a server name or a domain) to our server, which looks it up in DNS and, except for the DNS check, connects to the mail servers it finds without logging in. The settings finder also asks Mozilla’s configuration database about the domain, and the BIMI checker downloads the logo and certificate files named in the domain’s BIMI record. The results are returned to your browser and not stored; the request counts towards the per-IP limit described under “Security logs and backups”. The email header analyzer, the BIMI generator and the signature creator run entirely in your browser: what you paste, type or choose there is never sent to us. The signature creator remembers your last entries, and a photo or logo you upload (resized in the browser), in your browser’s local storage.

The feedback form and the “What’s new” panel are provided by FeedFast (feedfa.st). Its script is loaded from feedfa.st on every page, so, like any website, FeedFast’s server sees your IP address and browser user agent. Ideas you send are posted on VayaMail’s public feedback board, together with the category, title and details you write, and the name and email address you enter. If you are signed in, your account ID and email address are sent with it instead, so you don’t have to type them. Only send what you are happy to have on a public board.

To limit abuse, the number of requests from your IP address is counted for about a minute. Our servers log technical events such as migration IDs, server names, message counts and errors; these logs are rotated by size. The web server logs each request (time, page without its query string, status, referring page without its query string, and browser) for troubleshooting and to count visits from search engines and AI assistants. This access log holds no IP addresses and is kept for 30 days; the web server’s error log can include the IP address of a failed request. The database is backed up every night and each backup is kept for 14 days, so deleted data can remain in a backup for up to 14 days. Passwords in a backup are still encrypted, and the key is not part of the backup.

• Bluehost: the server the web app, worker and database run on.
• Cloudflare: delivers the website, so it handles every request to it, including your IP address.
• Creem: payments.
• Resend: sign-in and notification emails.
• Repora: visit analytics.
• FeedFast: the feedback form and release notes.
• Mozilla: receives the domain of an address when we look up its mail server.

And, of course, the providers of your old and new mailbox, which our servers connect to on your behalf. Bluehost, Cloudflare and Resend are companies based in the United States, so using them can mean a transfer of data outside the European Economic Area, under the safeguards those providers offer for such transfers.

The VayaMail CLI runs on your own computer. Passwords, mail and reports stay there; nothing is sent to us. It connects only to your mail servers, to DNS and to Mozilla’s configuration database to find the servers, and to npm when you install or update it.

You can ask for a copy of the personal data we hold about you, have it corrected or deleted, restrict or object to its use, receive it in a portable format, and withdraw a consent at any time. Write to hello@vayamail.com. If you think we handle your data unlawfully, you can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

When this policy changes, the date at the top changes with it.