1. The short version
AUBOSmail (operated by AUBOS Inc., "we") provides email infrastructure with cryptographic proof receipts. To do that, we store the emails you send and metadata about delivery. We don't sell your data, we don't use it to train AI models, and we'll sign a DPA with anyone who asks.
2. What we collect
When you sign up:
- Your email address (recovery email + chosen username for personal accounts).
- Phone number, if you sign up via SMS OTP.
- Display name and company name.
- For business accounts: your sender domain.
- IP address and user agent at signup (for fraud prevention + audit log).
When you send email through us:
- The full RFC 5322 message — stored in WORM (write-once read-many) Cloudflare R2 with Object Lock.
- The canonical Block JSON document.
- Recipient email, subject, sent-at timestamp.
- Delivery status (delivered, bounced, complaint).
- Engagement events from the web reader: opens, scroll dwell per block, link clicks, video plays, poll votes, inline form submissions, replies.
When recipients open your emails:
- IP, user-agent, viewport, dwell time per block (recorded against a hashed view-token, not the recipient's identity directly).
- Click destinations (rewritten through a tracking redirect).
3. Why we collect it
- Delivery: send your email and route bounces / complaints / replies.
- Proof: cryptographically commit to what was sent, when, by whom — so anyone can verify later without trusting us.
- Compliance: jurisdiction-aware send gates (GDPR / CASL / CAN-SPAM), suppression list propagation, audit log for regulator inquiries.
- Analytics: per-send dashboards (opens, clicks, replies) for the sender. Recipients see no analytics — engagement data is private to you.
- Security: rate-limiting, lookalike-domain blocking, anomaly detection.
4. What we DON'T do
- We do not sell or rent your data to anyone.
- We do not use your email contents to train AI models.
- We do not read individual emails (proof requires us to store them, not to inspect them).
- We do not enrich recipient profiles using third-party data brokers.
- We do not embed third-party analytics (no Google Analytics, no Hotjar, no Mixpanel).
5. How long we keep it
- Account data: as long as the account is active, plus 30 days after closure.
- Proof bundles (sent emails): 365 days by default. Scale plan extends to 7 years for HIPAA-eligible tenants. After retention, the body is purged but the immutable ledger row stays.
- Analytics events: 90 days, then aggregated and the row-level data deleted.
- Audit log: 7 years, append-only.
6. Sharing & subprocessors
We use a small set of subprocessors to operate AUBOSmail. Full list with regions and data categories is at /security#subprocessors. We notify customers of changes 30 days in advance via email and in-product banner.
7. International transfers
Default infrastructure is in the US (R2 cross-region, Supabase US-East-2, Kamatera US-TX). EU-only routing is available on the Scale plan. We rely on Standard Contractual Clauses (SCCs) for EU→US transfers; UK customers are covered by the UK Addendum.
8. Data Processing Agreement (DPA)
We sign DPAs with any customer who requests one. Email security@aubosmail.comwith your company name and we'll countersign within 2 business days. Default template available at /legal/dpa.pdf.
9. Your rights
Per GDPR Art. 15-22 and CCPA §1798.100-1798.155, you have the right to access, correct, export, or delete your personal data. To exercise these rights:
- Logged-in users: Settings → Data → Export / Delete.
- Recipients (not customers): email dsar@aubosmail.com with the email address you received messages at; we'll respond within 30 days.
Note: deleting your account doesn't purge the proof ledger — the immutable record of what you sent stays (without identifying body content) so that recipients can still verify historical messages. This is a feature, not a bug.
10. Cookies
We use a single first-party cookie (aubosmail.session) for keeping you logged in. No third-party tracking cookies. The web reader uses an HMAC-pepper'd view-token in the URL, not a cookie, to attribute engagement events.
11. Security
All traffic is HTTPS (TLS 1.2+). Data at rest is encrypted (AES-256 via R2/Supabase managed encryption). Database connections use mutual TLS. Auth tokens are HMAC-pepper'd JWTs with 15-minute access TTL + 30-day rotating refresh tokens. Full architecture at /security.
12. Children
AUBOSmail is not intended for users under 16. We don't knowingly collect data from anyone under 16. If you believe we have, email hello@aubosmail.com and we'll delete it.
13. Changes
If we change this policy materially, we'll email you 30 days in advance and post a banner in the dashboard. Minor clarifications get logged at /changelog.
14. Contact
Privacy questions: privacy@aubosmail.com
Security incidents: security@aubosmail.com
EU representative: appointed on request for Scale plan customers.