Privacy policy

Data controller and data processor

• Data controller for contact, account and log information and information given when creating an account yourself: OpenSUN Systems ApS, Rømersvej 4, 7430 Ikast, Denmark, CVR 43782495, info@openmailman.com.
• Data controller for mail content, attachments, contact data, chat messages and AI summaries in OpenMailman: the customer (the organisation using the Service). We process these solely as data processor, following the customer's instructions and the data processing agreement.

If you are the sender or recipient of an email at one of our customers, or have written in a customer's chat, you should contact the customer about your rights. We help the customer respond.

What information we process

• Name, email, phone number and other contact details of the customer's users.
• Login and activity data, including IP addresses and the audit log, in connection with use of OpenMailman.
• Content you provide yourself in the system, for example when contacting our support.
• Self-service account creation (sign-up): company name, optionally CVR number, name, email, optionally phone number, language, time, IP address and browser information, and your acceptance of the terms and conditions and the privacy policy.
• Free plan (data minimisation): we process and store only mail headers, i.e. sender, recipients, subject, date, Message-ID and threading, read status, folder, size and whether the mail has attachments. We never process the content or attachments of mail on the Free plan. On Pro, the full mail content is processed.
• As data processor for the customer: emails and attachments from connected mailboxes, sender and recipient addresses, contact history, notes, chat messages from the customer's embedded chat (OMC), AI summaries and categories, and tasks and time entries created in OpenTIME. Mail content may contain any type of personal data that the customer itself receives.
• The website openmailman.com sets no cookies and uses no visitor statistics, see Cookie policy.

How we collect the information

The information comes from you when you create an account or contact us, from the mailboxes and chat the customer connects, and automatically through the system's activity logging for security and troubleshooting.

Self-service account creation (sign-up)

You create an account yourself through the form at app.openmailman.com/signup. There is no trial period. This is how it works:

• The form is protected by a self-hosted captcha (ALTCHA) that runs on our own server in the EU, without cookies and without third parties, and by limits on the number of attempts per IP address, email and domain.
• We send a confirmation link to the email you entered. The link expires after 24 hours. Unconfirmed creations expire after 7 days, and name, phone number and IP address are deleted then.
• When the creation is submitted, we send an internal message with the details entered (company name, name, email, optionally phone number and CVR number, and the time) to sales@openmailman.com.
• When you confirm the link and choose a password, the organisation is created together with you as Account administrator.

Purposes and legal basis

We process the information to deliver OpenMailman, provide support, improve the system, secure operations and communicate with you about your account. Processing is based on:

• Accounts and contact persons at customers: the commercial agreement (GDPR Art. 6(1)(b)) and our legitimate interest in operating, securing and improving the system (point (f)).
• Self-service account creation: performance of the agreement to create and use an account (point (b)) and our legitimate interest in preventing misuse of the form (point (f)).
• Accounting and bookkeeping: legal obligation (point (c)).
• Mail content and other customer data, including AI analysis: the customer determines purposes and legal basis as data controller, and we process them only on the customer's instructions (GDPR Art. 28). Mail content is data and never instructions to the AI, and AI analysis never blocks viewing, replying or assigning.

Disclosure

We do not sell your information. Information is only shared with the sub-processors necessary for operations (see Security and operations and the list below), always under a data processing agreement. Billing information (company name, CVR number, address and invoices) is processed in our accounting system Dinero.

Sub-processors

• Hetzner Online GmbH (Germany): hosting of OpenMailman, database and storage. The application and the database are physically located on servers in Germany (backups: see Hetzner Object Storage below).
• Anthropic (Claude API): AI analysis of enquiries, i.e. categorisation, summaries, suggestions for who should take a mail, and reply drafts. Only the content needed for each analysis is sent. Transfer and region: Anthropic PBC processes data in the USA. The transfer is based on the European Commission’s Standard Contractual Clauses (SCCs), which are part of Anthropic’s Data Processing Addendum (DPA). Data from API calls is not used to train Anthropic’s models and is by default deleted automatically by Anthropic within 30 days of receipt. The exception is content that Anthropic’s safety systems flag as violating their usage policy; it may be retained longer.
• TINXDK Cloud and Gigahost: sending of system emails (confirmation links for account creation, login codes, invitations, receipts and notifications) through a mail relay. The relay is never used for customers' own replies, which are always sent through the connected account.
• Hetzner Online GmbH (Object Storage, Helsinki, Finland/EU): storage of encrypted backups. Same provider as the hosting.
• Laravel Forge: administration of the server at Hetzner. Forge does not process customers' mail content.
• GitLab: storage of source code and running of tests. No customer data is ever stored in GitLab.

We only use sub-processors that are necessary for operations, always under a data processing agreement. Material changes to the list are announced to the customer, who may object.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Requests regarding your rights are sent to info@openmailman.com.

Retention

We only keep the information for as long as necessary for the purposes it was collected for, or as long as the law requires. Specifically:

• Unconfirmed account creations expire automatically after 7 days, and name, phone number and IP address are deleted then.
• Earlier requests for access (from before self-service creation) are deleted automatically 12 months after the last status change.
• Local mail copies (content, headers, attachments and AI summaries) are deleted automatically 12 months after the mail's sent or received time. The email remains in the customer's own mailbox. Your emails at your mail provider are not deleted.
• Fetched attachments in the cache are cleared after 30 days without use.
• The audit log is kept for 24 months.
• Data is deleted from backups no later than 14 days after deletion. Backups are encrypted and stored at Hetzner in Helsinki (Finland, EU).
• When a connection is deleted, all local data for that account is deleted.
• When the agreement ends, the customer's personal data is deleted under the data processing agreement, see Deleting an organisation.

Deleting an organisation

When an organisation in OpenMailman is closed, we first deactivate it. From then on nobody can log in, and we no longer fetch mail or chat. The deletion is carried out by OpenSUN Systems at the customer's request (only the platform's Superadmins can carry it out). A grace period of 30 days follows, during which the closure can be undone. The account owner (otherwise the account administrators) receives an email when the deletion is scheduled, if it is undone, and when it has been completed.

When the grace period has expired, we delete all of the organisation's data permanently and irrevocably, including our own copies of mails and headers, attachments, conversations, notes, contacts, chat, knowledge articles, AI summaries and decisions, connections and credentials, users (including passkeys and two-factor), invitations, settings and the organisation's audit log. OpenMailman's own access and subscriptions at the mail provider are revoked, for example subscriptions to notifications from Microsoft 365 and Gmail, and our stored access tokens are deleted.

Your emails in Microsoft 365, Gmail or on your mail server are not deleted. The deletion never changes anything at the customer or at the customer's mail provider. Data is deleted from backups no later than 14 days after deletion. We only keep an anonymous record that an organisation has been deleted (id, time and number of deleted rows), without personal data. Accounting records that the Danish Bookkeeping Act requires to be kept are kept outside OpenMailman in our accounting system (Dinero).

Cookies

We only use technically necessary cookies in the platform itself. The website sets no cookies. Read more in the Cookie policy.

For spam protection when creating an account we use a self-hosted captcha (ALTCHA) that runs on our own server in the EU, without cookies and without third parties.

When you start a chat with support, the chat (omc-support.js) stores a session token in your browser’s local storage (localStorage) on openmailman.com, so the conversation can continue if you reload the page. This storage is necessary for the chat you started yourself and therefore does not require consent. No cookies are set and no tracking is used. You can delete the data by clearing your browser’s stored data for openmailman.com.

Complaints to the Danish Data Protection Agency

If you believe we process personal data in breach of the rules, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. We would, however, appreciate hearing from you first so we can resolve the matter.

Contact

Questions about this policy can be sent to info@openmailman.com.