MailAudit

Privacy Policy

Last updated: September 30, 2026

1. Who we are

GoBird OÜ, a private limited company registered in Estonia (registry code 17311365, Sepapaja tn 6, 15551 Tallinn, Estonia; "we", "our" or "us"), operates MailAudit (mailaudit.io and api.mailaudit.io) and is the controller of the personal data processed through the service. This policy explains what we collect, why, how long we keep it and what rights you have. You can reach us about any privacy matter at the address at the end of this page.

2. What we collect

2.1 Test emails

When you send an email to a test address (valid for 1 hour after it is created), we receive and analyse:

  • The complete message as received: headers, subject, body and any attachments
  • Sender details from the headers: sender and return-path addresses, the sending server's IP address and HELO name
  • The results of our checks: SPF, DKIM, DMARC, reverse DNS, MX and A records, SpamAssassin score, content analysis and blacklist status

Test emails often contain personal data, such as names and email addresses. Send only content you are entitled to share and avoid sensitive data.

2.2 Dev inbox (signed-in users)

Every signed-in account gets a disposable address (dev-xxxxxx@…, with any +tag). Messages sent to it are stored in full (the raw message plus the links and one-time codes we extract) so you can read them on the dashboard, over the API or via a share link. The inbox only receives mail, up to 200 messages a day and 10 MB per message. Anyone who has the share link of a message can read it until it is deleted.

2.3 Account data

You sign in with a GoBird account at auth.gobird.io (OpenID Connect). From the sign-in we receive your name, email address, profile photo (avatar) URL and a stable account identifier. We use them to show who is signed in and to link your API keys, test history and dev inbox to you. We never receive your password.

2.4 API keys and usage

We store only a hash of each API key (the key itself is shown to you once), together with its name, creation and last-use time, and request counters per key and per day. The counters are used for rate limits and for the usage statistics on your dashboard.

2.5 Technical data

When you use the website or the API, our servers process your IP address, your browser's user agent and the URLs you request. We use the IP address to apply rate limits and to prevent abuse. The tools (MX lookup, blacklist and reputation checks) also process the domain or IP address you enter.

2.6 Analytics (only with your consent)

If you click "Accept" in the cookie banner, we load Google Analytics 4. It collects pseudonymous usage data (pages visited, approximate location derived from your IP address, device and browser details) using the cookies listed in our Cookie Policy. Google Analytics is never loaded on the dashboard, on shared message links (/m/…) or on test reports (/test/…), and its advertising features and Google signals are disabled. Without your consent it is not loaded at all.

3. Why we use it (legal bases)

  • Running the tests, the dev inbox, your account and your API keys: to provide the service you ask for (Art. 6(1)(b) GDPR)
  • Rate limiting, security and abuse prevention: our legitimate interest in keeping the service available and safe (Art. 6(1)(f) GDPR)
  • Google Analytics: only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time
  • Meeting legal obligations where they apply (Art. 6(1)(c) GDPR)

We do not sell personal data, and we use the content of test emails only for the analysis you request.

4. How long we keep it

  • Test addresses are valid for 1 hour after they are created.
  • Test results (report, headers and message body) and the raw emails are deleted 30 days after the test.
  • Dev inbox messages and their share links are deleted after 24 hours. Deliverability tests run on a dev inbox message are also deleted after 24 hours.
  • API keys are stored only as a hash. Key records (including revoked keys) and the per-key usage counters are kept for your usage statistics and for rate limiting; we delete them on request.
  • Your name and avatar URL are kept only in your sign-in cookie (8 hours). Your account identifier links your API keys, tests and dev inbox to you, and your email address is stored with your API keys.
  • Google Analytics data is kept by Google according to the data retention setting of our Analytics property, for at most 14 months.

You can delete a dev inbox message or revoke an API key on the dashboard at any time, and you can ask us to delete other data earlier.

5. Who receives the data

We use the following recipients and processors:

  • GoBird's sign-in service (auth.gobird.io), for authentication
  • Cloudflare, Inc., through which all traffic to mailaudit.io and api.mailaudit.io passes (network protection and TLS)
  • Operators of public DNS blacklists (DNSBL), such as Spamhaus: a blacklist check sends them the sending server's IP address (or, for domain checks, the domain) as DNS queries
  • Google Ireland Limited and Google LLC, for Google Analytics, only with your consent

SpamAssassin and all other checks run on our own servers.

6. Transfers outside the EEA

Google Analytics data may be transferred to Google LLC in the United States. Google LLC has certified its adherence to the EU-U.S. Data Privacy Framework.

7. Security

We protect data with technical and organisational measures appropriate to the risk. All connections to MailAudit are encrypted in transit (HTTPS/TLS), access to our systems is restricted, API keys are stored only as hashes, and the HTML of emails is shown in a sandboxed frame, with remote images loaded only when you ask for them.

8. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you
  • have inaccurate data corrected
  • have your data deleted
  • restrict the processing of your data
  • object to processing based on our legitimate interest
  • data portability
  • withdraw your consent at any time with the "Cookie settings" link in the footer, without affecting the lawfulness of earlier processing
  • lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or with our lead authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee)

To exercise your rights, write to us at the address below. We reply within one month.

9. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version, and we announce significant changes on the website.

10. Contact us

Questions about this policy or your data? Write to us at: [email protected]