Privacy Policy

Last updated: April 6, 2026

1. Data Controller

TOUT CREER — contact@ecosmail.fr
EcosMail is operated by TOUT CREER, registered in France.

2. Data We Collect

Data	Purpose	Legal Basis	Retention
Phone number	Authentication (OTP / EcoAuth)	Contract performance	Account lifetime
Email address	Email service	Contract performance	Account lifetime
Email content	Display and storage	Contract performance	Account lifetime
Imported contacts	Address book	Consent	Account lifetime
Payment data	Billing	Contract performance	5 years (legal obligation)
AI analysis	Email classification, briefing	Consent	30 days

3. Data We Do NOT Collect

EcosMail never collects:

Passwords (we use passwordless authentication)
Location data
Tracking or advertising cookies
Browser fingerprinting data
Credit card details (handled by Mollie, PCI DSS Level 1)

4. Encryption

Your emails are protected by multiple layers of encryption:

In transit: TLS 1.3 (HTTPS for web, STARTTLS for SMTP/IMAP)
At rest: AES-256-GCM (Dovecot mail_crypt, server-side)
End-to-end (E2E): in development — see security roadmap

An X25519/Ed25519 keypair is generated per user in anticipation of E2E deployment. Until client-side E2E is enabled, email and message content remains technically accessible to service operators for processing purposes (see Section 2).

5. Sub-Processors

Service	Provider	Location	Data Processed
Database	Supabase	EU (Frankfurt)	Metadata, email index
Payment	Mollie B.V.	Netherlands (EU)	Payment transactions
AI Analysis	Anthropic	USA	Email content (for classification)
SMS OTP	Twilio	USA	Phone numbers
Email hosting	IONOS	Germany (EU)	Email server

For sub-processors outside the EU (Anthropic, Twilio), data transfers are covered by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Access: Request a copy of your personal data
Rectification: Correct inaccurate information
Erasure: Request deletion of your account and all data
Portability: Export your contacts (CSV) and emails
Objection: Opt out of marketing communications
Restriction: Limit processing of your data
Withdraw consent: For AI analysis, at any time via Settings

To exercise your rights: admin@ecosmail.fr
We will respond within 30 days as required by GDPR Article 12.

7. Security

We implement technical and organizational measures to protect your data:

Strong encryption (AES-256-GCM at rest, TLS 1.3 in transit)
Passwordless authentication (EcoAuth 2FA or SMS OTP)
Daily automated backups
Fail2ban intrusion prevention
Shield VPS reverse proxy (DDoS protection, WAF)
SPF, DKIM, DMARC, MTA-STS for email authentication
Regular security audits

8. Cookies

EcosMail uses no tracking, advertising, or analytics cookies. We only use a session token (localStorage) to maintain your login. No third-party trackers are present on our website or application.

9. Children's Privacy

EcosMail is not intended for children under 16. We do not knowingly collect data from minors. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Data Breach Notification

In the event of a personal data breach, we will:

Notify the CNIL (French data protection authority) within 72 hours
Notify affected users without undue delay if the breach poses a high risk
Document the breach and remediation actions

11. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top indicates the latest revision. For significant changes, we will notify users by email.

12. Contact

For any privacy-related questions:
admin@ecosmail.fr

For security issues:
security@ecosmail.fr

French Data Protection Authority:
CNIL — Commission Nationale de l'Informatique et des Libertes