Privacy Policy

Last updated: October 17, 2026

PingMail.Cloud ("PingMail", "we") is operated by StarkOne, LLC ("StarkOne"), a United States limited liability company, which is the controller of the personal data described here. This policy explains what data we collect when you use the platform, why we collect it, and how we handle it. It applies to the dashboard, the REST API, the SMTP relay, and the marketing site.

1. Data we collect

Account data

• Name, company name (optional), email address, and password (hashed with bcrypt) for the account holder, and the IP address used to sign up (kept for abuse prevention).
• Billing address and payment method (handled by our payment processor; we never store full card numbers).
• Per-site configuration: API keys, SMTP credentials, sender domains, DNS settings.

Mail metadata & content

• For every send: timestamp, sender address, recipient address, subject, status, message-id, and the rendered HTML body.
• SMTP relay handshake records: client IP, AUTH user, MAIL FROM, RCPT TO, and response codes.
• Delivery log entries from each gateway hop.

Operational telemetry

• Server-side request logs (timestamp, endpoint, response code, latency) — retained for 30 days.
• Aggregated metrics (sends per hour, bounce rates, gateway health) — retained indefinitely in anonymized form.

2. Why we collect it

• Provide the service: deliver email, enforce quotas, route through gateways, detect abuse.
• Debugging & support: answer "why didn't this arrive?" questions in your delivery log.
• Deliverability protection: monitor bounce rates and complaint signals to keep the platform's sending reputation healthy for everyone.
• Billing: count monthly sends against your plan's quota.
• Legal compliance: respond to lawful requests (warrants, court orders) and ISP abuse reports.

3. Mail content retention

The content of each email — its body, the text preview and any attachments — is deleted 30 days after it is sent. Metadata (sender, recipient, subject, status, timestamps and delivery events) is kept for 12 months for delivery analytics and dispute resolution, and then deleted. To have specific sends deleted sooner, email [email protected].

4. Sharing with third parties

We share data only with parties strictly required to operate the platform:

• Outbound mail gateways (Postmark, Mailjet, JetEmail, your own Postfix) — receive the message bytes they need to relay.
• Payment processor (Stripe) — receives billing details when you pay.
• Hosting providers — data lives on servers in Israel and the EU.

We do not sell, share, or analyze your mail content for advertising. We do not use your message content to train AI models.

5. Security

• All API + SMTP traffic uses TLS 1.2+ (TLS 1.3 preferred).
• Passwords are bcrypt-hashed; API keys are random 32-byte tokens.
• Database backups are encrypted at rest.
• Production access is limited to named operators with 2FA.

6. Your rights (GDPR / CCPA)

If you are in the EU, UK, or California, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — fix incorrect data.
• Erasure — delete your account and all associated mail.
• Portability — export your mail history as CSV/JSON.
• Objection — opt out of marketing emails (we don't send many).

To exercise any of these, email [email protected]. We respond within 30 days.

7. Cookies

The dashboard keeps your session token and language preference in your browser's local storage; it sets no tracking cookies. The marketing site sets a single cookie, pm_lang, only when you pick a language. Our CDN (Cloudflare) may set strictly necessary security cookies. No analytics cookies, no third-party trackers. The marketing site loads Google Fonts; that's the only third-party fetch.

8. International transfers

Your data is processed in Israel and may be transferred to EU member states for hosting and to wherever your chosen outbound gateway operates. Billing details are processed by Stripe in the United States. We rely on Standard Contractual Clauses for transfers outside the EEA.

9. Changes to this policy

We'll post any material change here with at least 30 days' notice via email to the account holder. Continued use of the platform after the effective date constitutes acceptance.

10. Contact