Privacy policy

Data controller

The publisher, STAY WEB (SASU, 59 rue de Ponthieu, bureau 326, 75008 Paris, France), is responsible for the processing of personal data collected on mailmcp.io.

Data Protection Officer (DPO): privacy@mailmcp.io

Data collected

The data collected (name, email, mail credentials) is used exclusively for the operation of the MailMCP service.

• Your mail credentials are encrypted with AES-256 and are never stored in plain text.
• No email content is stored on our servers — transit is direct via IMAP/SMTP.
• No data is transferred outside the EU without adequate guarantees.
• No client data is used to train AI models. No third-party resale. Ever.

Data hosting

All data is hosted in France on LWS servers (Ligne Web Services), ISO 27001 certified. Your data never leaves the European Union.

Data retention

• Account data (name, email): kept for the duration of the account, deleted within 30 days of account deletion.
• Mail credentials: encrypted, deleted immediately upon account removal.
• MCP usage logs: kept for 90 days, then automatically purged.
• Connection logs: kept for 12 months (legal obligation).

Your rights

Under the GDPR, you have the right to access, rectify, delete, port, and object to the processing of your data. You can exercise these rights at any time by contacting us at privacy@mailmcp.io or by deleting your account from your dashboard.

Cookies

This site only uses strictly necessary technical cookies (session, CSRF, language preference). No tracking or advertising cookies are used.

Server-side analytics

We collect aggregated page-view statistics server-side, with no cookies and no third-party trackers. Specifically:

• IP addresses are SHA-256 hashed with a server-side secret before storage — never kept in plaintext.
• We log: URL path, locale, country (derived from IP via ip-api.com, then IP discarded), referrer domain, UTM parameters, User-Agent string (for device type & bot detection), device category (mobile/tablet/desktop).
• Raw events are purged after 90 days; only daily aggregates are retained for trend analysis.
• No Google Analytics, no Meta Pixel, no Plausible, no Matomo. Stats are stored in our own EU-hosted database.