Home · Pricing · Flight manual · Terms · Privacy · Cookies · Acceptable use · Sign in
Privacy Policy
What Cometamail collects, why, and how long we keep it. No ads, no selling data, spy pixels removed, expired messages erased, and mail stored encrypted in Valencia and Lisbon.
Who we are
This Privacy Policy explains how Cometamail S.L., Carrer de la Pau 18, 46002 València, Spain, CIF B12345678 (“Cometamail”, “we”, “us” or “our”), collects and uses personal data when you use the website cometamail.com, our web, mobile and desktop apps and our email service (together, the “Service”), and when you exchange mail with someone who uses Cometamail.
For personal Diamond and Delta accounts, and for people who visit our website or contact us, Cometamail S.L. is the controller of your personal data under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”). For accounts that an organisation provides to its members on a Festival plan, that organisation is the controller and we process the data on its behalf, as explained in the section “Festival teams”.
We have appointed a Data Protection Officer, whom you can contact at privacy@cometamail.com, or by post at the address above marked for the attention of the Data Protection Officer.
Information you give us
Account information: your name, the Cometamail address you choose, your password (which we store only as a salted cryptographic hash, never in readable form) or the public key of your passkey, and the recovery email address or phone number you add.
Preferences: the settings you choose, such as your kite colour, your default string length, your expiry and notification settings and your language.
Billing information: if you buy a paid plan, your name, billing address and country (needed to apply the correct tax), your tax identification number if you are a business, your plan and payment history, and the type, last four digits and expiry date of your card. Full card details and wallet payment details are collected and processed by our payment service provider, not by us.
Communications with us: when you contact our support team, report abuse or exercise your rights, we keep your messages and our replies, together with any information you choose to give us.
Import details: if you import mail from another provider, the authorisation you give us to access that account. Where the provider supports it, this is a temporary access token rather than your password. We delete it as soon as the import is finished or you cancel it.
Your mail and contacts
To provide the Service, we store and process the content of the messages you send and receive, including attachments, and their metadata (sender, recipients, date, subject, size and delivery information), as well as your contacts, folders, labels and files.
This processing is carried out by our own systems and only to provide the Service to you: delivering and storing your messages, showing them to you, building a private search index so that you can search your own mail, filtering spam, phishing and malware, removing tracking pixels, and carrying out your instructions to reel in, edit or expire messages or take back attachments. These checks run on our own servers, and their results are not used for any other purpose.
Our staff do not access the content of your mail, except where you expressly ask us to (for example, when you ask for help with a specific message), where it is strictly necessary to investigate a specific abuse report or security threat affecting the Service, or where we are required to do so by law. Access is limited to authorised personnel bound by confidentiality, and it is logged. We respect the secrecy of communications guaranteed by article 18.3 of the Spanish Constitution.
People you write to. When you send a message to someone who does not use Cometamail, we process their email address and the message, and, when they open the secure link to read it, the time it was opened, their IP address and their browser type. We use this only to show them the message, to protect the link against misuse, and to know whether the message has been opened so that we can tell you and apply your unsend settings. We do not record their location, set cookies on their device or use this information for any other purpose, and we delete the IP address and browser type after 14 days.
Collected automatically
Sign-in and security information: when you sign in, we record the date and time, your IP address and the country and region derived from it, and your device type, operating system and browser, so that we can show you your recent sign-ins, alert you to unusual activity and protect your account against unauthorised access.
Server logs: our servers keep technical logs of requests, including IP address, time, the page or feature requested and error information, so that we can operate the Service, fix problems and defend it against attacks.
App diagnostics: if you allow it, our mobile and desktop apps send us crash reports and technical details such as the app version. These never include the content of your mail.
We do not use analytics services, advertising identifiers, tracking pixels, fingerprinting or third-party cookies. The website cometamail.com sets no cookies at all, and the web app uses a single strictly necessary cookie to keep you signed in, as explained in our Cookie Policy.
How we use it and why
Performing our contract with you (article 6.1.b GDPR): creating and managing your account; delivering, storing and searching your mail; applying unsend, edit and expiry; importing mail; providing support; and processing payments for paid plans.
Our legitimate interests (article 6.1.f GDPR), which we have balanced against your rights and interests: keeping the Service and your account secure; filtering spam, phishing and malware; preventing fraud and abuse, including enforcing our sending limits; processing data about people who exchange mail with Cometamail users so that messages can be delivered and read; and improving the reliability and performance of the Service using technical measurements that never include the content of your mail. You can object to processing based on our legitimate interests, as explained in “Your rights”.
Compliance with legal obligations (article 6.1.c GDPR): keeping the billing and accounting records required by tax and commercial law, responding to lawful orders from courts and authorities, and handling requests to exercise your data protection rights.
Your consent (article 6.1.a GDPR): only for optional things, such as receiving our occasional product news. You can withdraw your consent at any time in Settings → Privacy or by using the link in any such email, without affecting the lawfulness of processing carried out before you withdraw it.
Service messages. We send you messages that are necessary for the Service, such as security alerts, receipts, trial and renewal reminders and notices of changes to our terms. These are part of our contract with you and are not marketing.
We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of article 22 GDPR.
What we never do
We do not show advertising in Cometamail on any plan, and we do not use your mail, contacts or activity to target advertising to you anywhere else.
We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers.
We do not build profiles of you or of the people you write to, and we do not track you across other websites or apps.
We do not use the content of your mail for any purpose other than providing the Service to you.
We remove tracking pixels and similar devices from incoming mail before a message is opened, so that senders cannot see when or where you read it.
Expired means erased
When a message you sent expires or is reeled in, or when you take back an attachment, we delete its content (the subject, body and attachments, or the attachment concerned) from our active systems immediately, and from our backups within 30 days, as backups are overwritten in their normal cycle.
We keep only a record that the message existed, consisting of its sender, recipients, date, size and the time it expired or was reeled in, so that the Service can show you what happened and so that we can protect the Service against abuse. We never keep its contents. This record is deleted when you delete the conversation it belonged to or when your account is closed.
When you edit a message, its previous versions are stored with it so that you can see your original wording, and they are deleted together with the message. The same rules apply to messages you receive from other Cometamail users: if the sender reels in a message or it expires, it is deleted from your inbox too.
The only exception is where the law requires us to preserve a specific message, for example under a court order, in which case we keep it only to the extent and for as long as required. We cannot delete copies held outside our systems, such as the preview delivered to a recipient on another provider, or copies that a recipient has saved.
Festival teams
When an organisation (the “Customer”) provides Cometamail accounts to its members under a Festival plan, the Customer is the controller of the personal data in those accounts, including member account details and the content of member mail and shared inboxes. We process that data as the Customer’s processor, only on its documented instructions, under a data processing agreement that meets the requirements of article 28 GDPR.
The Customer’s administrators can manage member accounts, including creating, suspending and deleting them, setting team expiry policies and configuring single sign-on, and can access, export or delete the data in member accounts and shared inboxes. The Customer is responsible for informing its members about this and for having a legal basis for its processing, including respecting its members’ right to privacy in the use of digital devices at work under article 87 of the LOPDGDD where it applies.
If you are a member of a Festival plan, please address requests about your personal data to your organisation. If you contact us, we will pass your request to the Customer and help it respond. Cometamail S.L. remains the controller of the Customer’s billing details and of data we process to comply with our own legal obligations and to keep the Service secure.
Who we share it with
We run the Service on infrastructure that we operate ourselves. We share personal data only with the following categories of recipients, and only to the extent necessary: our payment service provider, which processes payments for paid plans; a provider that delivers our service emails, such as receipts and password reset codes, to addresses outside Cometamail; and providers of professional services, such as auditors and legal advisers, who are bound by duties of confidentiality.
Each service provider that processes personal data on our behalf does so under a written contract that complies with article 28 GDPR, only on our instructions and with appropriate security measures. Our payment service provider acts as an independent controller for the processing it is legally required to carry out itself, such as fraud prevention and anti-money-laundering checks, under its own privacy notice.
The people you write to. When you send a message, we deliver it, together with your name and address as its sender, to its recipients and their providers, as you instruct.
Authorities. We disclose personal data to courts, law enforcement and other public authorities only when we are legally required to do so under a valid order issued in accordance with Spanish or EU law. We examine each request carefully, disclose only what is strictly required and, where the law allows, tell you before we do.
Business changes. If Cometamail S.L. is involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner, who will be bound by this Privacy Policy. We will tell you in advance, and you will be free to export your data and close your account.
Where your data lives
We store your account data and mail in data centres in València, Spain, and Lisbon, Portugal, with copies in both locations so that your mail survives the loss of either. Data is encrypted at rest, and in transit between our systems and your devices.
We do not transfer your personal data outside the European Economic Area, and our service providers process personal data only within the European Economic Area. If this ever changes, we will tell you in advance, and any transfer will be protected by one of the safeguards provided for in Chapter V of the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses.
When you send a message to someone whose email provider is located outside the European Economic Area, the message or its preview is delivered to that provider at your request. This is necessary to perform our contract with you, in accordance with article 49.1.b GDPR.
How long we keep it
Account data and mail: for as long as your account is open. Messages and files you delete are removed from our active systems when you empty the trash, or automatically 30 days after you move them to the trash, and from our backups within a further 30 days. Expired and reeled-in messages are handled as described in “Expired means erased”.
Closed accounts: when you close your account, you have 30 days to change your mind. After that, we delete your mail, files and account data from our active systems, and from our backups within a further 30 days.
Billing records: invoices and payment records are kept for six years from the end of the financial year to which they relate, as required by article 30 of the Spanish Commercial Code. This also covers the four-year period during which the tax authorities may review them under article 66 of General Tax Law 58/2003.
Logs and security records: server logs for 14 days; the sign-in history shown to you in Settings for 90 days; and abuse and security records, such as spam reports and records of accounts suspended for abuse, for up to 12 months, or longer where needed for legal proceedings.
Support conversations: two years after the conversation ends, so that we can help you with follow-up questions, unless you ask us to delete them sooner.
Where the law requires, instead of deleting data straight away we block it, in accordance with article 32 of the LOPDGDD: it is kept separately, is not used for any purpose and is only made available to courts, public authorities and the data protection authority for as long as liability arising from the processing may be claimed, after which it is deleted.
How we protect it
We apply technical and organisational measures appropriate to the risks, in accordance with article 32 GDPR. These include encryption of data at rest and in transit, using TLS for connections to our servers and to other mail providers wherever they support it; storing passwords only as salted hashes; support for passkeys and a second sign-in step; strict role-based access controls, with access to production systems limited to a small number of authorised staff and logged; separation of customer data; regular security testing and prompt application of updates; physical security at our data centres; and confidentiality obligations and data protection training for everyone who works with us.
No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Agencia Española de Protección de Datos within 72 hours of becoming aware of it and, if the risk is high, we will tell you without undue delay, as required by articles 33 and 34 GDPR.
You can help too, by using a strong, unique password or a passkey, keeping your devices up to date, and telling us at once if you suspect that someone else has accessed your account.
Your rights
Under the GDPR and the LOPDGDD you have the right to access the personal data we hold about you and receive a copy of it; to rectify inaccurate or incomplete data; to have your data erased; to restrict our processing in certain circumstances; to receive the data you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another provider; to object to processing based on our legitimate interests; and to withdraw any consent you have given, at any time.
You can exercise many of these rights directly in Settings → Privacy, where you can view and download your data, correct your details and delete your account. You can also write to privacy@cometamail.com or to our postal address. To protect your account, we may ask for information to confirm your identity before acting on a request.
We reply within one month of receiving your request. If a request is particularly complex, or we receive a large number of requests, we may extend this by up to two further months, in which case we tell you within the first month and explain why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
If you are not satisfied with how we handle your personal data, please contact our Data Protection Officer first at privacy@cometamail.com. You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the data protection authority of the EU country where you live or work.
Under article 3 of the LOPDGDD, you can also leave instructions about what should happen to your data after your death, and your heirs may ask us for access to, rectification or erasure of your data unless you have prohibited this.
US residents
This section applies if you are a resident of California or of another US state with a comprehensive consumer privacy law, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”), to the extent that those laws apply to us.
In the preceding 12 months we have collected the following categories of personal information, for the business purposes described in this policy: identifiers, such as name, email address and IP address; customer records and commercial information, such as billing details and plan history; the content of your communications, which is sensitive personal information that we use only to provide the Service to you; and internet or network activity information, such as sign-in records and server logs. We collect it from you, from your devices and from people who send you mail.
We do not sell or share personal information for cross-context behavioural advertising, as those terms are defined in the CCPA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA, and we do not sell or share the personal information of consumers under 16.
You have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and not to be discriminated against for exercising these rights. You can exercise them in Settings → Privacy or by writing to privacy@cometamail.com, and you may use an authorised agent to do so on your behalf. We confirm receipt of requests within 10 business days and respond within 45 calendar days.
Children
The Service is not intended for children under 14. Under article 7 of the LOPDGDD, people aged 14 or over can consent to the processing of their personal data themselves; for younger children, consent must be given by their parents or legal guardians, and we do not offer accounts to them.
If we learn that we have collected personal data from a child under 14 without the consent of a parent or guardian, we will delete it and close the account. If you believe this has happened, please write to privacy@cometamail.com.
Where the law of your country sets a higher age of consent for information society services, we apply that age.
Changes and contact
We may update this Privacy Policy to reflect changes in the Service or in the law. If we make significant changes, we will tell you by email and in the Service at least 30 days before they take effect. The date at the top of this policy shows when it was last updated, and previous versions are available on request.
Cometamail S.L., Carrer de la Pau 18, 46002 València, Spain. CIF B12345678. Data protection enquiries and our Data Protection Officer: privacy@cometamail.com. Support: help@cometamail.com.