Privacy Policy

1. Who We Are

Huppmail is operated by The Lift FZE, a company registered in the DWTC (Dubai World Trade Centre) Free Zone, Dubai, United Arab Emirates. The Lift FZE is the data controller responsible for your personal data.

EU Representative (Art. 27 GDPR): The Lift FZE is established outside the European Union, and has designated the following representative in the Union, who may be addressed by supervisory authorities and by data subjects on all questions relating to our processing of personal data:

UAB "IT forma"
J. Savickio g. 4-7, 01108 Vilnius, Lithuania
Company code 304523652, VAT LT100011451417
contact@itforma.lt

You may contact either the representative or ourselves. Designating a representative does not affect our own responsibility or liability under the GDPR.

Contact: For any privacy-related inquiries, please contact us at hello@huppmail.com.

2. Data We Collect

2.1 Account Data

When you create a Huppmail account, we collect your email address and store a hashed version of your password. We never store passwords in plain text.

2.2 Usage Data

We collect data related to your use of the service, including API calls, email logs (sender, recipient, subject line, timestamps, delivery status), and delivery statistics (opens, clicks, bounces, complaints).

2.3 Technical Data

We automatically collect technical information such as IP addresses, user agent strings, browser type, and session data when you access the Huppmail dashboard or API.

3. Purpose and Legal Basis

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Huppmail service, including sending emails on your behalf, maintaining your account, and providing support.
• Legitimate interest (Art. 6(1)(f) GDPR): Processing for analytics and service improvement, security monitoring, fraud prevention, and protecting the integrity of our platform.
• Consent (Art. 6(1)(a) GDPR): Processing based on your explicit consent, such as setting optional analytics cookies or receiving marketing communications. You may withdraw consent at any time.

4. Data Storage

Your data is processed and stored on servers located in the European Union. We use industry-standard infrastructure providers with appropriate security certifications to ensure the protection of your data.

5. International Data Transfers

As The Lift FZE is based in the UAE, access to personal data from outside the European Economic Area (EEA) may occur. For any transfers of personal data outside the EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to ensure an adequate level of data protection.

6. Data Retention

• Account data: Retained for as long as your account is active, plus 30 days after account deletion to allow for recovery or address any outstanding issues.
• Email logs: Retained for 90 days from the date of sending, after which they are permanently deleted.
• Usage analytics: Retained for 12 months in aggregated or pseudonymized form for service improvement purposes.

7. Third Parties

We may share your data with the following categories of third-party service providers, solely for the purposes of operating and improving Huppmail:

• Infrastructure providers: Hosting and DNS services that power the Huppmail platform.
• Payment processor: Paddle acts as our merchant of record and handles all payment processing, invoicing, and tax compliance on our behalf.
• Email delivery partners: Where applicable, third-party providers that assist with email delivery infrastructure.

We do not sell your personal data to third parties.

8. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction: Request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please contact us at hello@huppmail.com. We will respond to your request within 30 days.

9. Cookies

Huppmail uses a limited number of cookies:

• Essential cookies: Required for the operation of the service, including session management and authentication. These cookies are strictly necessary and do not require consent.
• Analytics cookies (optional): Used to understand how visitors interact with the Huppmail website. These cookies are only set with your explicit consent and can be declined without affecting service functionality.

You can manage your cookie preferences at any time through the cookie consent banner or your browser settings.

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit: All data transmitted between your browser or application and our servers is encrypted using TLS (Transport Layer Security).
• Hashed passwords: User passwords are stored using industry-standard cryptographic hashing algorithms and are never stored in plain text.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis, with appropriate authentication and logging.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. For material changes, we will notify you via email at the address associated with your account. We encourage you to review this page periodically for the latest information on our privacy practices.

12. Children

Huppmail is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal data, please contact us at hello@huppmail.com.

13. Hosted Mailboxes (Webmail and Mobile Apps)

This section applies in addition to the rest of this policy when you use a hosted mailbox — an email address hosted by us, accessed through our webmail client or our mobile applications. A hosted mailbox differs from our sending API in one important way: we store the contents of your mail on your behalf.

What we store

• Message content. The full contents of the emails you send and receive, including subject lines, message bodies, and attachments.
• Message metadata. Senders, recipients, timestamps, message identifiers, and the conversation threading needed to display your mail.
• Mailbox state. Read and unread status, labels, folders, snoozed items, drafts, rules, contacts and preferences.
• Account data. Your mailbox address, display name, a hashed password (we never store it in readable form), and a recovery email address used for password resets and service notices.
• Linked external accounts. Where you choose to connect an external mailbox (for example Gmail) so its mail appears in your inbox, we store the messages retrieved from it and the access credentials required to continue retrieving them. You may disconnect a linked account at any time.

What we do NOT do

We want to be explicit, because it is the main reason people move to a paid mailbox:

• We do not read your mail, and no member of staff accesses mailbox contents except where you have expressly asked us to help with a specific support issue, or where we are legally compelled to.
• We do not scan your mail to build advertising or marketing profiles, and we do not use the contents of your mailbox to target advertising, whether on our services or anywhere else.
• We do not sell, rent or share your mail or your personal data with third parties for their own purposes.
• We do not use the contents of your mailbox to train artificial-intelligence models. Where you actively invoke an optional feature that processes a message (for example translating it), that processing happens only on the message you selected, only when you ask for it.

Automated processing does take place for the purposes of operating the service itself: filtering spam and detecting phishing, indexing your own mail so that you can search it, and applying rules that you have configured. This processing is automated, is performed to deliver the service you have paid for, and produces no advertising profile.

Where your mail is stored

Mailbox contents are stored on servers located in Belgium, within the European Union. Backups are held on infrastructure within the European Union. Mailbox contents are not replicated outside the EU by us; note, however, that email is a store-and-forward system and that messages you send to, or receive from, third parties will necessarily be handled by those parties' own providers, wherever they are located.

How long we keep it

We keep the contents of your mailbox for as long as your account is open, because that is the service: your mailbox is your archive. When you delete a message it is removed from your mailbox and purged from our systems, including backups, within 30 days.

If your subscription lapses, your mailbox is suspended rather than deleted: you cannot sign in or receive new mail, but your existing mail is retained for 60 days, so that you can reactivate or export it. After that period, the mailbox and its contents are permanently deleted. We will notify your recovery address before any deletion takes place.

Exporting and deleting your data

You may export the entire contents of your mailbox in a standard format at any time, and you may ask us to delete your mailbox entirely. We do not hold your mail hostage: if you use your own domain name, you can move your address to another provider and take your archive with you. To make either request, contact hello@huppmail.com. Your rights under Section 8 of this policy apply in full to mailbox contents.