How we process your data

Controller for account data is PineCore Systems, a trading name of Bröderna Saxin AB, company registration number 559379-4364, Lindesby 152, 713 94 Nora.

Write to contact@pinemail.app. You do not need an account to contact us.

An account stores your email address, name, password hash and sessions, and, if you turn it on, your authenticator secret and recovery codes. We also keep which plan the account is on and how much storage and sending it uses, to apply the limits and, once card payment opens, to bill by use. Legal basis is the contract for the account and our legitimate interest in protecting it. Sessions last at most seven days.

Messages, attachments, files, calendars, contacts, recipients, subjects and delivery events are stored to provide the service you asked for. For that processing you are the controller and we are the processor; see the DPA. The database, with the message text, is on our server in Helsinki, Finland; attachments, original messages and files are stored encrypted on a server we run ourselves in Sweden, which also holds encrypted backups of the database. Message text, original messages, attachments and files are encrypted before they are written to disk; subjects, addresses, calendars and contacts are not. Which companies see content on its way is on the security page.

We do not use your data, or the mail, files, calendars and contacts you store, to train AI models, and we do not sell it or hand it to anyone who does. An assistant or app you connect yourself with your sign-in is different: it gets what you allowed it on the consent page, with personal data masked unless the account owner turns masking off (see the security page), and what its provider does with that is between you and the provider. This is also a term of the DPA and one of our promises.

If a PineMail user shares a file with your address or sends you large files, we use your address to send you the email with the link. If the file is shared with named people, you open it with a code we send to your address, valid for 15 minutes; after that a cookie in that browser lets you open it again for 24 hours. The person who shared the file sees whether your address has opened it and how many times the file has been downloaded.

The person who shared the file decides this and is the controller; we process it for them. A shared link stops working at the end date they chose or when they remove it. Large files sent this way are deleted when their time runs out, after 1 to 14 days, or sooner if the sender removes them.

If you sign up for the newsletter on /newsletter, we store the address, the language you chose, and when you signed up, when the confirmation mail was sent and when you confirmed. Until you open the link in that mail, the confirmation mail is the only thing sent to the address. Legal basis is your consent, which you withdraw with the link at the end of every letter or with your mail app's unsubscribe button; the address and everything stored about it are then deleted at once. A sign-up nobody confirms is deleted after seven days. For each letter we keep which addresses it went to, so that no one gets a letter twice; that record goes with the address. The letters go out from our own address through the same mail provider as the rest of the service. They contain no tracking images and no rewritten links, and we do not record who opens or clicks.

Account data is kept while the account exists. A free account nobody has signed in to for 12 months is warned by email and deleted six months later unless someone signs in. Mail and files you delete are removed for good 30 days after they go to the trash. Codes for shared files expire after 15 minutes and are removed a day later. Notifications in the app are deleted after 30 days. When the account ends, its data is deleted or, on request, returned first, except where the law requires us to keep it. Encrypted backups of the database are kept 30 days and are gone for good within 40 days of being taken, and a file deleted from our server in Sweden stays in its snapshots for up to 15 days, so deleted data remains that long in them. They are used only to restore the service after a failure.

Sign-in uses necessary security cookies. Visits to the public pages are counted by us, without cookies and without storing anything in your browser: the page, the site that linked to it, campaign fields in the link, and the type of device, browser, system and language. Your IP address is only used to make a code that tells one visit from another within a day; the key to that code is deleted after two days, and the address is not stored. The figures are kept for 400 days. No third-party analytics, no embedded social widgets. See cookies.

Hetzner Online GmbH, dedicated server in Helsinki, Finland, where the service and its database run, with the keys. Attachments, original messages and files are stored encrypted on a server we run ourselves in Sweden, which also holds the encrypted backups of the database.

Cloudflare answers DNS only. Cloudflare, Inc. is a US company; standard contractual clauses.

Amazon SES (AWS EMEA, part of the US company Amazon) in Stockholm relays outbound mail and sees it in transit. Content is stored only on our own servers. AWS DPA.

The public list is on /subprocessors.

You have the right of access, rectification, erasure, objection, and restriction. You may complain to Integritetsskyddsmyndigheten (imy.se). Write to us first if you can.