Privacy policy

1. Who we are

Mailtarn is a product of Limenzy Technologies Pvt Ltd, a company based in India ("Limenzy", "we", "us"). Limenzy decides how and why your personal data is used on this website, so under India's Digital Personal Data Protection Act, 2023 we are the data fiduciary, and under the EU and UK GDPR we are the controller.

2. What this policy covers

This policy covers the Mailtarn website at mailtarn.com, including the early-access waitlist and the contact form, and emails you send to our @mailtarn.com addresses.

Before launch, the same website also runs at a preview address, mailtarn-site.suvith.workers.dev. Its forms save to the same place and are handled exactly as described here.

The Mailtarn app isn't available yet. Before signup opens we'll publish updated terms, a data processing agreement and an updated version of this policy that cover your account and the test emails you send to Mailtarn.

3. What we collect and why

We only ask for what we need. Leave optional fields blank if you prefer.

4. What we don't do

• We don't sell or rent your personal data.
• We don't use advertising trackers or build advertising profiles.
• We don't add you to other Limenzy mailing lists without asking.
• Contacting us doesn't put you on the waitlist or any mailing list. Our replies answer your message; they aren't marketing.

5. Cookies and analytics

We don't use analytics or advertising cookies, and we don't run analytics on this site at the moment. If we add visit statistics later, we'll use a cookieless service and update this policy first.

To stop spam, our forms use Cloudflare Turnstile. It starts as soon as you open a page with one of our forms (the homepage or the contact page), whether or not you submit anything. It collects signals such as your IP address, browser user agent and TLS fingerprint to tell people from bots. Cloudflare uses these signals to run the check for us, and also, as an independent controller, to improve its bot detection. Cloudflare explains this in its Turnstile Privacy Addendum.

When you submit a form, our own server also uses your IP address, briefly, to limit repeated requests and to confirm the Turnstile check with Cloudflare. We don't store it.

6. Who we share it with

We share personal data only with service providers that help us run the website. Each one handles your data on our behalf and on our instructions, except where noted:

• Cloudflare, Inc.: hosts the website and its database, and runs bot protection. For Turnstile signals and for protecting its own network, Cloudflare also acts as an independent controller. See Cloudflare's privacy policy and Turnstile Privacy Addendum.
• Resend, Inc.: sends email from mailtarn.com. Today that's the copy of each contact message we send to our team mailbox; later it will also send waitlist emails. See Resend's privacy policy.
• Zoho Corporation: hosts our @mailtarn.com mailboxes, where we receive and reply to your emails. See Zoho's privacy policy.

Within Limenzy, only the people who need it to run Mailtarn can see this data. We may disclose data if the law requires it, for example in response to a valid order from a court or government authority.

7. Where your data is stored

• Waitlist sign-ups and contact form messages are saved in a Cloudflare database whose main copy is in the Asia-Pacific region.
• Website traffic and Turnstile checks pass through Cloudflare's global network, usually at a location near you.
• Emails sent through Resend leave from Ireland. Resend says it stores email data in the United States.
• Our mailboxes are hosted by Zoho Mail. Zoho's privacy policy lists the countries where it processes data.

So your data may be processed outside India or your own country. Each provider states its own safeguards for these transfers:

• From the EU: Cloudflare and Resend use the EU standard contractual clauses and comply with the EU–U.S. Data Privacy Framework.
• From the UK: Cloudflare and Resend use the UK Addendum to those clauses and comply with the UK Extension to the EU–U.S. Data Privacy Framework.
• Zoho uses agreements between its group companies based on the EU's model contractual clauses. Its privacy policy doesn't name a separate UK mechanism.

8. How long we keep it

• Waitlist sign-up: deleted 24 months after you signed up. Once Mailtarn launches publicly, every sign-up is deleted 12 months after the launch date, or sooner if it reaches 24 months first.
• If you unsubscribe: When you unsubscribe, we exclude you from future waitlist sends. An email already queued for delivery may still arrive. We keep your email address marked as unsubscribed so it stays excluded. That record is deleted on the same schedule as other sign-ups. If you join the waitlist again, we treat it as a new sign-up.
• Contact form messages: deleted from our database 24 months after we receive them.
• Emails in our team mailboxes, including the copy of each form message and our replies: we review the mailboxes by hand every month and delete emails once they're more than 24 months old, so an email can stay up to about a month longer than that. Deleted emails may also remain for a time in our mail provider's own recovery copies.
• Copies of emails we send through Resend: Resend keeps their content and delivery records for 30 days. If an email to you bounces permanently or is marked as spam, Resend also keeps your address on a list that stops further sends.
• Security and server logs: up to 30 days, unless we need them longer to investigate abuse.

Deletion from our database runs automatically every day. Deleted records may remain in database recovery copies for up to 30 days. This applies only to our database: mailbox copies and Resend's copies follow the rules listed above.

9. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and how we use it
• correct, complete or update it
• delete it
• withdraw your consent, as easily as you gave it

We offer these rights to everyone now, by choice.

In India, the Digital Personal Data Protection Rules, 2025 and the commencement notification for the Digital Personal Data Protection Act, 2023 were published in the Gazette of India on 13 November 2025. Their duties on notice, consent, your rights and grievance handling take effect eighteen months later, on 13 May 2027. From then, the rights above are also your legal rights under the Act. You'll also be able to nominate someone to exercise them for you if you die or can't act. You can raise a grievance with us now (see section 12).

In the EU and UK, you can also ask us to restrict or stop processing, object to processing based on legitimate interests, and receive your data in a portable format.

We'll delete your data when you ask, unless we have to keep some of it, for example to meet a legal obligation or to handle a dispute or a security investigation. We'll tell you what we kept and why.

To use any of these rights, email privacy@mailtarn.com. We may ask you to confirm your identity first. We'll reply within 30 days. To leave the waitlist, use the unsubscribe link at the bottom of any waitlist email, or email us. To have your sign-up deleted rather than just unsubscribed, email us.

10. Security

All traffic to mailtarn.com is encrypted with TLS. Access to personal data is limited to the people who need it for their work. No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.

11. Children

Mailtarn is a tool for software teams and isn't meant for anyone under 18. We don't knowingly collect personal data from children. If you believe a child has given us their data, contact us and we'll delete it.

12. Questions and complaints

For any privacy question or complaint, contact our Grievance Officer:

If we don't resolve your complaint, then once the DPDP Act's grievance provisions apply (from 13 May 2027) you can take it to the Data Protection Board of India. In the EU or UK, you can complain to your local data protection authority at any time.

13. Changes to this policy

When we change this policy, we'll publish the new version on this page and update the date at the top. If we ever want to use your data in a new way that needs your consent, we'll ask for it first and won't use your data that way unless you agree.