Skip to content
Legal

Privacy Policy

Last updated: October 25, 2026

At MailDock (a product of Locus Websites), we believe privacy and data sovereignty are fundamental to reliable email infrastructure. This Privacy Policy outlines what information we collect, how it is used and protected, and our commitments to both account holders and end-user website visitors.

1. Roles: Data Controller vs. Data Processor

Understanding how your data is handled depends on your relationship with MailDock:

  • As a MailDock Customer (Agency or Developer): When you sign up for an account, configure SMTP credentials, or purchase a subscription, MailDock acts as a Data Controller for your account administration and billing information.
  • For Form Submissions from Website Visitors: You (the agency or website owner) are the Data Controller for the personal information your visitors submit through your forms. MailDock acts solely as a Data Processor to validate the payload, enforce spam filtering heuristics, format the email template, and transmit the message via your designated SMTP server.

2. Information We Collect

We collect information across two distinct categories:

A. Account and Billing Information

  • Account Details: Name, email address, password hash (managed securely via Firebase Authentication), and organization details.
  • Client Site Configurations: Allowed website origins/domains, template HTML and styles, brand color profiles, and generated site keys.
  • SMTP Credentials: Your SMTP host, port, username, and encrypted password. These are stored with encryption at rest and used solely to connect and dispatch emails on your behalf.
  • Billing Information: Payment processing is handled directly by Stripe. MailDock never stores or has access to full credit card numbers or banking secrets.

B. Form Submission and Telemetry Data

  • Form Field Payloads: Values submitted through HTML forms (such as names, email addresses, phone numbers, and messages) required to render your email template.
  • Anti-Spam Signals: Client IP address, user-agent string, submission timestamps, honeypot field status, and link counts used exclusively to evaluate bot behavior and prevent abuse.
  • Delivery Logs: Timestamps, delivery status (delivered, deferred, or blocked), recipient address, and SMTP diagnostic response codes.

3. Zero Data Harvesting & Model Training Guarantee

We do not sell, rent, monetize, or harvest personal data. MailDock does not inspect or aggregate end-user form submissions for commercial advertising or marketing.

Furthermore, form submission contents are never fed into public Large Language Models (LLMs) or used to train third-party artificial intelligence systems. Our AI features (such as Brand Scan and Template Generation) operate strictly on public website structure and customer-provided design prompts via secure backend proxies.

4. How We Use Information

We process data strictly to provide, maintain, and secure our email delivery service:

  • To authenticate your session and manage client accounts and templates.
  • To validate incoming form submissions and verify that the referring domain is on your allowed origins whitelist.
  • To detect and drop automated spam, brute-force form floods, and bot submissions without requiring interactive CAPTCHAs.
  • To compile Handlebars variables and transmit finished transactional emails through your configured SMTP server.
  • To populate your delivery logs, failure diagnostics, and analytics within the MailDock dashboard.
  • To manage subscription billing, account usage tiers, and send critical operational alerts.
  • To send product announcements, feature updates, educational tutorials, and marketing newsletters to registered account holders and users who have opted in, with an instant one-click unsubscribe mechanism included in every marketing communication.

5. Data Retention & Deletion

We believe in minimal data retention. Form submission records and delivery logs are retained strictly according to your subscription tier:

  • Free Tier: Detailed submission logs and payloads are retained for 30 days, after which they are automatically purged.
  • Pro & Scale Tiers: Logs and payloads are retained for 180 days for audit and dispute resolution purposes, then permanently removed.

Account holders may delete specific client websites, templates, or their entire MailDock account at any time. When an account or client site is deleted, associated SMTP credentials, site keys, and templates are immediately purged from active databases.

6. Security Measures

MailDock employs enterprise-grade defense-in-depth measures to protect your data:

  • All web traffic and API calls require HTTPS with TLS 1.3 encryption in transit.
  • Database records are encrypted at rest using industry-standard AES-256 via Google Cloud / Firebase infrastructure.
  • Origin whitelisting ensures submissions cannot be hijacked from unauthorized third-party domains.
  • Internal rate limiting restricts API endpoints to 20 requests per minute per IP to mitigate denial-of-service attempts.
  • Stripe handles all PCI-DSS compliant payment processing.

7. Third-Party Service Providers

We work with carefully selected third-party service providers who are contractually bound to confidentiality and security standards:

  • Google Cloud / Firebase: Secure application hosting, serverless functions, and encrypted database storage.
  • Stripe: Payment gateway and subscription management.
  • Your SMTP Provider: MailDock dispatches outbound email directly through whichever mail server you designate (Google Workspace, Microsoft 365, Amazon SES, SendGrid, Zoho, etc.).

8. Your Rights & Data Inquiries

Depending on your location (including the European Union under GDPR and California under CCPA/CPRA), you have the right to access, correct, export, or request deletion of personal information held by MailDock.

If you are an end visitor who submitted a form on a website powered by MailDock, please direct your data rights request directly to the website owner (the Data Controller). We will assist the controller in fulfilling valid data deletion or access requests.

If you have any questions or concerns regarding this policy, please email our security and privacy team directly at support@maildock.dev.