1. Data We Collect & Process
We collect only the technical telemetry and message contents strictly required to deliver business email hosting:
- Account Administration: Tenant administrator credentials, corporate domains, and billing invoice details.
- Mail Store Data: Inbound and outbound message payloads, MIME attachments, folder taxonomies, and calendar records. This data remains your property.
- MTA Diagnostic Telemetry: Outbound SMTP delivery handshakes, SPF/DKIM validation results, bounce codes, and IP connection headers.
2. In-Transit & Rest Encryption Standards
All mail transmission across public Internet backbones is secured via TLS 1.3 with forward secrecy. At rest, mailbox databases, message indices, and attachment blobs are encrypted using AES-256 with tenant-scoped cryptographic keys.
Confidentiality Guarantee: Unlike consumer webmail providers, Grapphen Mail never analyzes or profiles your message contents to serve targeted advertisements.
3. AI Inbox Triage & Reply Generation Guardrails
When users activate AI features (such as priority triage or reply generation):
- Zero Model Training: Your email text and attachments are never used to train commercial foundation models.
- Volatile RAM Processing: Prompts and reply contexts are processed in transient, encrypted memory and immediately wiped upon completion.
4. Zero Data Selling & Sub-Processors
We do not sell, rent, or trade your personal or business data. Infrastructure services are provisioned across dedicated enterprise cloud hosting clusters and Tier-1 network relays under strict Data Processing Addenda (DPA).
5. Your Rights Under GDPR & CCPA
All customers, whether in the European Economic Area, California, or worldwide, enjoy comprehensive data sovereignty:
- Right to Erasure: Tenant administrators can execute permanent cryptographic erasure of user mailboxes and historical logs.
- Right to Portability: Standardized full-mailbox MBOX/EML archival downloads are accessible directly within your administration portal.
6. Data Retention Schedule
Mailbox contents persist for the duration of your active subscription. Upon account termination, message archives are permanently expunged within 30 days.
7. Data Protection Officer & Inquiries
For privacy inquiries, DPA execution, or compliance audits, please contact our Data Protection Officer:
Grapphen LLC
Attention: Data Protection Officer & Security Compliance
30 N Gould Street, Ste 66690
Sheridan, WY-82802, United States
Direct Privacy Desk: [email protected]
