1. Who this covers
Dodomail (“we”, “us”) is run from India. Questions or requests go to hello@dodomail.app. This policy covers two groups of people:
- Customers: people who sign up and use Dodomail. For your account data, we decide how it’s used (we’re the “controller”).
- Recipients: the people our customers email. Their details belong to the customer who uploaded them, and we handle them only on that customer’s instructions (we’re the “processor”). If you got an email sent with Dodomail, the sender is responsible for having your permission; see section 6.
2. What we collect from customers
- Account details: your email address and, if you sign in with Google, your name and profile picture from Google. We never see a Google password.
- Workspace details: company name, postal address, From and reply-to addresses, and the domains you verify for sending.
- What you create: email designs, templates, images you upload, campaigns, contact lists and the fields in them.
- Sign-in and security data: the IP address you signed up from, and the IP address and browser of each signed-in session. We use these to spot abuse and keep accounts safe.
- Billing: your plan and Paddle’s reference for your subscription. Card and payment details go straight to Paddle; we never see or store them.
- Messages to us: anything you send us by email, through the chat on the site or through feedback in the app.
3. How we use it
- To run Dodomail: sign you in, store your work, send your campaigns and show your reports.
- To email you about your account: sign-in links, paused or failed sends, payments and important changes.
- To protect the service and its sending reputation: checking links against unsafe-site lists, watching bounce and complaint rates, and stopping spam, phishing and abuse.
- To fix problems: error reports help us find bugs, with personal details scrubbed out first.
- To meet legal duties, such as tax records (kept by Paddle) and answering lawful requests.
Under GDPR, our legal bases are performing our contract with you, our legitimate interest in keeping Dodomail secure and free of abuse, and legal obligations. We don’t send marketing email to customers without asking.
4. Cookies
We use one cookie of our own: the session cookie that keeps you signed in. There are no analytics or advertising cookies on dodomail.app. The chat on the site sets cookies to keep your conversation open between visits; the bot check on the sign-in page, and Paddle, on checkout, may set cookies they need to work.
5. Who else handles data
We use these providers to run Dodomail. Each gets only what its job needs, and is bound by its own data protection terms. For the name of the company behind each one, email hello@dodomail.app.
| Provider | What for | Where |
|---|---|---|
| Website hosting | Hosts the dodomail.app website | United States |
| Server and database hosting | Runs our servers and database | United States |
| Campaign email delivery | Sends campaign emails and reports deliveries, bounces, opens and clicks | United States |
| Image storage and network | Stores and serves images; the bot check on sign-in; DNS | Worldwide |
| Background jobs | Runs scheduled sends and background jobs | United States |
| Account email delivery | Sends sign-in links and account emails | United States |
| Google sign-in, if you choose it; checking links against its unsafe-site list | United States | |
| Paddle | Payments, invoices and tax, as Merchant of Record | United Kingdom |
| Support chat | The chat on the site: your messages, and the browser and page you write from | European Union |
| Error monitoring | Error reports and performance monitoring, with personal details scrubbed | United States |
Our data is stored in the United States. Where data moves out of the EU or UK, we rely on our providers’ Standard Contractual Clauses or equivalent safeguards. We may also share data if the law requires it, or to protect people from fraud or harm.
6. Recipients of emails sent with Dodomail
For each person a customer emails, we hold what the customer uploaded and what happens to the email:
- The email address, and any other fields the customer imported, such as a name.
- Which lists the person is on, and whether they’ve unsubscribed.
- Whether each email was delivered, bounced or marked as spam, and, when the sender has tracking on, whether it was opened and which links were clicked. Opens are counted with a small image in the email and clicks by passing links through our tracking address. Some mail apps, such as Apple Mail, open emails automatically, so an open doesn’t always mean a person read it.
Every email has an unsubscribe link, and most mail apps show a one-click Unsubscribe button. Once you unsubscribe, that sender can’t email you through Dodomail again. Images in emails are stored at img.dodomail.app and can be seen by anyone with their address, as with any image in an email.
To see, correct or delete your details, contact the sender first, as they control your data. If you can’t reach them, or think someone is emailing you without permission, write to hello@dodomail.app with the email you received and we’ll look into it.
7. How long we keep it
- Your workspace and everything in it stays while your account is open. Cancelling a paid plan deletes nothing.
- Deleting your account: the owner can delete it from Settings. Sending stops at once, and you can change your mind for 7 days. After that, the workspace, its contacts, campaigns, reports, images and sending domains are erased.
- Raw delivery records from our email provider, which can include a recipient’s IP address and mail app, are deleted after 90 days. The counts in your reports are kept with the campaign.
- Addresses you send test emails to are deleted after 90 days.
- Unsubscribes and spam complaints are kept for as long as the workspace exists, so a person who opted out is never emailed again by mistake.
- Payment records are kept by Paddle for as long as tax law requires, including after your account is deleted; ask Paddle to erase what the law lets them.
- Deleted data may stay in our database backups for up to 30 days, until they’re replaced. Backups are never used to bring back data you deleted.
8. Your rights
Depending on where you live, you can ask to see the personal data we hold about you, correct it, have it deleted, get a copy to take elsewhere, or object to how we use it. Much of this you can do yourself: edit your workspace in Settings, export your contacts, or delete the account. For anything else, email hello@dodomail.app and we’ll reply within 30 days. You can also complain to your local data protection authority.
9. Security
Everything travels over HTTPS. There are no passwords to steal: you sign in with an email link or Google. Our database isn’t reachable from the internet, and each workspace can only see its own data. No system is perfectly secure; if a breach affects your data, we’ll tell you without undue delay.
10. Children
Dodomail is for businesses and adults. We don’t knowingly collect data from anyone under 18.
11. Changes
We’ll update this page when what we collect or who we share it with changes, and email account owners before a significant change. See also our Terms of Service.