Legal
Last updated: August 7, 2026. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).
mailvault365 is operated by Dominik Geimer, Heiderhoefen 19, 46049 Oberhausen, Germany. For privacy questions write to mail@mailvault365.com.
Contact form. When you submit a message, we collect the name, email and message you provide. We use it only to reply to you.
Server logs. Our server records technical information about each request (IP address, timestamp, URL, user agent). We use these logs to operate and secure the website. They are deleted after a short retention period.
Analytics. We use Umami to count page views. We do not run Umami ourselves — we use the hosted service (Umami Cloud) operated by Umami Software, Inc., United States, which acts as our processor. Umami works without cookies, does not track visitors across websites, and does not store identifiable IP addresses. Because it collects no directly identifying data and sets no cookies, no consent banner is required.
Transfer to the USA. Because our analytics provider is based in the United States, the technical request data involved (page address, referrer, browser type, approximate country) is transferred there. The transfer is based on the standard contractual clauses in the provider's data processing agreement (Art. 46 (2) (c) GDPR). No email content and no archive data is ever sent to the analytics provider — the analytics script runs only on our public marketing pages, never inside the signed-in application.
We do not sell personal data and we do not share it with third parties for advertising. We engage providers only to operate the website and the service; each is bound by a written agreement and processes data on our instructions.
The email archive itself is stored in Germany — on Hetzner Object Storage in the Falkenstein data centre, operated by Hetzner Online GmbH. Archived email never leaves the EU.
We will send you our data processing agreement (Auftragsverarbeitungsvertrag), including the complete list of subprocessors with each one's purpose and location, on request — just ask us.
We keep personal data only as long as needed for the purpose described above and as required by law. Contact-form messages are kept until the inquiry is closed and for a reasonable period thereafter. Server logs are kept for a short retention period (typically up to 30 days).
Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw any consent you have given. To exercise any of these rights, write to mail@mailvault365.com.
You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf.
We use a single strictly-necessary session cookie that is required for basic website functions. We do not use any tracking, advertising or analytics cookies. Our analytics tool is configured to operate without cookies.
The website may offer sign-in via Microsoft 365. If you choose to sign in, Microsoft processes your login data on its own terms and as a separate controller. We receive only the basic profile information that Microsoft returns after a successful sign-in. We are not responsible for Microsoft's own processing.
We may update this Privacy Policy from time to time as the website evolves. The most current version is always available on this page, with an updated "Last updated" date.