Right to Access
Export all conversations, tickets, and processed personal data with a single click.
Privacy
notice.
Transparency notice regarding personal data processing, data principal rights, retention windows, and grievance redressal under the Digital Personal Data Protection Act, 2023.
Your rights as a data principal
DPDP Act 2023 · Section 8
Right to Correction & Erasure
Permanently delete all customer records, ticket assignments, and vector embeddings.
Right of Grievance Redressal
Fast-tracked handling of privacy disputes by our dedicated Grievance Officer.
Right to Nominate
Designate a nominee to exercise rights in the event of death or incapacity.
Effective Date: October 14, 2026 Last Revised: October 14, 2026 Jurisdiction: Digital Personal Data Protection Act, 2023 (India) and Global Data Protection Standards
This Privacy Notice explains how maildx ("we", "us", or "our") collects, uses, protects, and discloses personal data when you use our multi-tenant AI email support software platform and website.
1. Categories of Personal Data We Process
A. As a Data Fiduciary (Your Account & Workspace Data)
When business administrators and support agents register for maildx, we collect:
- Identity & Contact Details: Full name, business email address, role, and company name.
- Authentication Data: Secure session tokens, hashed credentials, and multi-factor authentication metadata.
- Billing & Account Metadata: Workspace tier, monthly AI spend caps, payment transaction IDs (card data processed directly by PCI-DSS certified gateways).
- Audit & Security Telemetry: IP address, browser user-agent, API request timestamps, and settings update logs.
B. As a Data Processor (Customer Email Support Data)
When your customers send support emails to your maildx-connected domain:
- Email Content: Sender email address, customer name, email subject, message body, message timestamp, and RFC Message-ID.
- Derived Support Records: Semantic vector embeddings, factual claims extracted during AI grounding, confidence ratings, and ticket resolution history.
2. Lawful Grounds for Processing (DPDP Act Section 6)
We process personal data only when a valid legal ground exists:
- Contractual Performance: To deliver the support automation, AI drafting, and ticket triage services requested.
- Consent & Notice: Provided by administrators during workspace signup and acceptance of the Data Processing Agreement.
- Statutory Compliance: Maintaining security audit logs and reporting security incidents under CERT-In guidelines and DPDP rules.
3. Purpose Limitation & No AI Model Training
- Zero Foundation Model Training: We never sell your personal data or use customer emails or uploaded company manuals to train, retrain, or fine-tune public artificial intelligence models.
- Tenant Isolation: All data is partitioned under strict Postgres Row-Level Security (
app.company_id). No cross-tenant access is architecturally possible.
4. Data Principal Rights (DPDP Section 8)
Under India's DPDP Act, 2023 and the GDPR, you have enforceable statutory rights:
- Right to Access & Portability: You may request an itemized summary and JSON export of your personal data at any time via
POST /api/privacy/export. - Right to Correction & Updating: You may correct inaccurate or incomplete personal records in your settings.
- Right to Erasure (Right to be Forgotten): You may initiate immediate, permanent cryptographic erasure of your personal data and derived support records via
POST /api/privacy/delete. - Right to Grievance Redressal: You have the right to contact our Grievance Officer and receive a formal response within prescribed regulatory timelines.
- Right to Nominate: In the event of death or incapacity, a data principal may designate a nominee to exercise privacy rights.
5. Automated Retention and Deletion Policy
- Workspaces configure automated data retention between 7 and 365 days (default: 90 days).
- A nightly cascade purge permanently deletes expired conversations, messages, ticket details, AI run records, and webhook payloads without leaving orphaned database rows.
6. Children's Data Protection (DPDP Section 9)
maildx is a B2B platform intended exclusively for enterprise and business support operations. We do not knowingly target, track, or process the personal data of individuals under 18 years of age without verifiable parental consent. Inbound inquiries indicating a minor are immediately escalated to human agents for appropriate handling.
7. Grievance Officer & Contact Information
In accordance with the Digital Personal Data Protection Act, 2023, the details of our Data Protection & Grievance Officer are:
- Grievance Officer: Privacy & Compliance Lead
- Email:
grievance@maildx.dev/privacy@maildx.dev - Address: maildx Legal & Compliance, Tech Innovation Park, Kalyan, India
- Response SLA: Within 7 business days for grievance complaints.