We are updating our Privacy Notice to provide clearer information about how we use your personal data, including how our systems make, or help make, decisions about your account and emails. The update also explains your privacy rights in more detail.

The FAQs on this page relate to our Privacy Notice which takes effect on 10 December 2026.

What's changing?

Here are the key changes: 

1. How we handle your data

• How we treat your emails and account. We've added a section explaining our different responsibilities for your email content and your account and billing information.
• Why we use your data. We've updated why we use your data and the legal basis that allows us to do so, including where we may need to verify your identity (such as at sign-up, to protect your account, or to prevent fraud).
• Where your data is processed. We name our key suppliers and list the countries where data may be processed, with safeguards for each.
• How long we keep your data. We provide clearer information about when personal data is deleted or anonymised after your service ends, and why some information must be kept for longer.

2. How we use technology

• Automated decisions. We explain how our systems may make decisions about your account (including billing, storage limits, security, email filtering, and data deletion) and outline safeguards that apply.
• Use of artificial intelligence (AI). We explain how we use AI to help provide our services, including through trusted suppliers on our behalf. Information you enter into AI tools, and your interactions with them, may also be used to improve our own AI models in controlled environments, subject to safeguards. We don't use your personal data to train publicly available or general-purpose third-party AI models. 

3. Your rights

• Your privacy rights. We added more detail about the privacy rights available to you, how to exercise them, and who to contact if you have a concern.

Your privacy and email security

How do you protect my information?

We use a range of safeguards, including:

• Limiting access to our team members who need access for their work;
• Protecting team member access with multi-factor authentication;
• Logging and monitoring system activity;
• Training team members in privacy and security;
• Maintaining documented policies for handling information and using our systems.
• Assessing the security of our suppliers; and
• Having our controls independently audited against recognised standards, including ISO/IEC 27001.

Do you sell data from my account or mailbox?

No. We do not sell data from your account or mailbox, including data that has been de-identified or combined with other customers’ data.

We use de-identified and aggregated data to understand how our services are used and improve them. This means looking at information without identifying you, or at overall trends across customers.

We may share this information with service providers and partners to help run, secure, and improve the service. For example, it may help our antiabuse providers detect spam and threats more effectively.

Do you share my personal data with other companies for their marketing?

No. We do not share your personal data with third parties for their own marketing purposes.

Do your staff read my emails?

Spam, phishing, and malware checks are automatic and do not involve our team members reading your emails. Our team may need to access your mailbox in limited situations, such as:

• To help you with a problem. A support agent may need to look at affected emails to resolve an issue you have reported;
• To protect your account. Our security team may review activity if your account appears to have been compromised;
• To fix a technical fault. Our engineers may need access to resolve a problem affecting your mailbox; and
• To meet a legal requirement. For example, we may need to respond to a valid request from a court or law enforcement agency.

Access is limited to team members whose role requires it, and is protected by multi-factor authentication, and logged and monitored.

How do you check my emails for spam and security threats?

Our systems automatically check every email sent or received for spam, phishing, and malware. These checks help protect your account and other customers.

The checks scan the message, attachments, links, and headers, which contain information such as the sender and recipient. Computer programs carry out these checks. Our team members do not read your emails as part of this process.

These checks are not new. The updated Privacy Notice simply explains them in more detail.

Do your security checks keep copies of my emails or information about them?

If you have a specific question about what our security checks retain, including copies of emails and records of the checks, please email our Privacy team via privacy@themessaging.co

What information do you share with antiabuse providers?

Antiabuse providers help us detect spam and security threats. If you have a specific question about what information is shared with our antiabuse providers, including copies of emails and records of the checks, please email our Privacy team via privacy@themessaging.co

AI and our service providers

Do you use my emails to train ChatGPT or other public AI models?

No. We do not use your personal data (including your emails and attachments), to train publicly available or general-purpose third-party AI models.

The exception is an email you choose to report as misclassified, We keep a copy of that email temporarily and use it to improve our filtering. The AI section (section 4, “Use of artificial intelligence” of our Privacy Notice) covers what you enter into our AI tools, such as our support assistant, and the interactions that follow. That information may be used to improve our own AI models. 

When you report an email as misclassified, a copy is stored separately from your mailbox and used to improve our filtering. Reporting an email is optional.

Separately, all incoming and outgoing email goes through automated security, spam, phishing and malware filtering as part of the service. These checks can look at the message content and attachments, as well as the sender, sending server and authentication results. This email filtering happens only while an email is in transit, before it is delivered. Once an email is in your mailbox, we don't scan it. The filtering can't be switched off, as it is essential to protecting your account and our service.

Does this apply automatically to all customers, including those who do not actively use any AI features?

The Privacy Notice applies to the service we provide to all customers. As mentioned above, we only use what you enter into our AI tools to improve models if you use those tools. All customers’ mail goes through automated security, spam and malware filtering as part of the service, as described under “Automated decision-making” in section 4.

Is there an option to opt out of having email content used for AI development while retaining the email hosting service?

As above, the ordinary contents of your mailbox are not used for AI development, so you don’t need to opt out to keep using your email service. Your email content would only be used if you report an email as misclassified, or include it in a request to our AI support assistant. These are optional. Automated security filtering applies to all email and can’t be switched off, as it protects your account and our service.

What AI tools do you use? Can I opt out of certain tools?

If you have a specific question about a particular AI tool (including questions about emails, attachments, contacts, calendars, and tasks), whether your mailbox information is used to improve an AI model, or whether you can opt out, please email our Privacy team at privacy@themessaging.co

Are emails and attachments anonymised or de-identified before being used for this purpose?

Ordinary email content is not used for this purpose. Any development or improvement of our own AI models uses de-identified or anonymised data wherever possible. Where personal data is needed, we limit it to what is necessary and apply data-minimisation and confidentiality safeguards.

Which countries can my data be processed in?

Please see Section 7 of our Privacy Notice.

Can overseas staff or suppliers access my email content?

For specific questions about who can access your email content, and why they may need access, please email privacy@themessaging.co

Your information, choices, and rights

How do I access, correct, or delete my personal data?

Update or correct your details

You can update most details, including your name, contact details, password, and billing information, by signing in to My Account.

If you cannot correct something yourself, please email our Data Protection Officer (DPO) via dpo@themessaging.co and tell us what needs changing.

Get a copy of your data

You can download your emails, contacts, and calendars yourself at any time.

To request a copy of other personal data we hold about you, please email our Data Protection Officer (DPO) via dpo@themessaging.co

Delete your data

You can delete emails, contacts, and calendar entries yourself at any time.

To close your account and request deletion of the data in it, please contact our support team. 

To request deletion of other personal data we hold about you, please email our Data Protection Officer (DPO) via dpo@themessaging.co

Note: We must keep some information, such as billing and payment records, for a set time to meet tax and legal requirements. We will let you know if this applies to your request.

How do I ask for an automated decision to be reviewed?

Our systems make some decisions automatically. Examples include:

• Restricting sending and receiving when a mailbox is over its storage limit;
• Temporarily locking an account after repeated incorrect passwords;
• Pausing outgoing email when sending limits are exceeded;
• Suspending an account when a payment is overdue;
• Securing an account that appears to have been compromised; and
• Blocking or filtering emails identified as spam, phishing, or malware.

Some restrictions clear automatically. For example, sending and receiving resume once you free up storage or upgrade your plan. Sign-in locks usually lift within 24 hours. Access is restored once an overdue payment is made.

If you think a decision is incorrect, please email our Privacy team via privacy@themessaging.co and include:

• Your email address;
• What happened and roughly when; and
• Why you think the decision is incorrect.

A member of our team will review the decision, consider the information you provide, and let you know the outcome. We aim to respond within 30 days.

Can high-risk emails be quarantined or flagged instead of removed?

For specific questions about how we handle high-risk emails, whether they can be held separately for review, or flagged, and whether you can see a record of removed emails, please email our Privacy team via privacy@themessaging.co

What if I object to changes outlined in the Privacy Notice?

Please email our Privacy team via privacy@themessaging.co to explain your concerns. Our Privacy team will review them and reply to you directly. Please note that some AI tools are essential to protect your account and our service.

How do I make a privacy complaint?

Please email the full details of your complaint to our Privacy team via privacy@themessaging.co 

If you are in Australia and are not satisfied with our response, or we have not responded within 30 days, you may also complain to the Office of the Australian Information Commissioner (OAIC).

Could my email address be reassigned to someone else after account closure?

At the time of writing, we do not reassign email addresses previously held by any of our customers.

Our Privacy Notice explains that some email addresses may be released for reuse after a hold period (see “Automated decision-making”, under “Data deletion”). This only applies to certain domains.

If we were to reassign an email address, it could only be released for reuse after the account has been permanently removed and the hold period has ended (as per our Terms of Service).