Privacy Policy

How Ghosts Mail processes personal data

Version of 30 October 2026

1. General

1.1. This Privacy Policy (the "Policy") explains which personal data of Users the Company processes in the Ghosts Mail service, for what purposes and on what legal bases, how the data is protected and what rights Users have.

1.2. The Policy is based on the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the data protection laws of the Republic of Estonia.

1.3. The Policy applies to ghostsmail.com, account.ghostsmail.com, mail.ghostsmail.com and to mailboxes on the ghostsmail.com and ghostemailer.com domains (together, the "Service").

1.4. The Company does not process special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, health, sex life, criminal records) or biometric data. Such information may incidentally appear in messages a User receives; the Company does not analyse it for any purpose.

2. Definitions

2.1. Company — Talivio Technology OÜ, which operates the Service and determines the purposes and means of processing.

2.2. User — a natural person using the Service, including registering mailboxes or purchasing mailbox packages.

2.3. Personal data — any information relating directly or indirectly to an identified or identifiable natural person.

2.4. Processing — any operation on personal data: collection, recording, storage, alteration, use, disclosure, pseudonymisation, restriction, erasure.

2.5. Payment Provider — an organisation that accepts payments from Users under an agreement with the Company.

2.6. Cookie — a small piece of data a website stores in the User's browser.

3. Data we process

3.1. Mailbox data: mailbox address, password (stored only as a hash), mailbox settings, avatar (if uploaded), recovery email address (if provided).

3.2. Mail content: incoming messages and attachments stored in the User's mailbox, together with sender and recipient addresses and message headers.

3.3. Data provided by the User: contact email address when placing an Order, the text of support requests.

3.4. Order and payment data: order number, content and price, selected domain, payment date and status, payment method, Payment Provider payment or invoice identifier. Passwords of mailboxes in bulk orders are stored encrypted so that the order file can be delivered and downloaded again.

3.5. Technical data: IP address, browser information, date and time of actions in the Service, mail server and security logs, session cookies.

3.6. The Company does not receive or store the full card number, expiry date or CVC/CVV code. These are entered on the Payment Provider's secure page.

3.7. The Company processes only the data needed for the purposes in section 4. Registering a mailbox does not require a name, phone number or identity documents.

4. Purposes and legal bases

4.1. Registering and operating a mailbox: receiving and storing messages, webmail and IMAP login, account recovery. Basis: performance of a contract with the User (Art. 6(1)(b) GDPR).

4.2. Placing, paying for and fulfilling Orders, delivering mailbox packages, refunds and handling claims. Basis: performance of a contract (Art. 6(1)(b) GDPR).

4.3. Answering support requests. Basis: performance of a contract and the Company's legitimate interest in responding (Art. 6(1)(b) and 6(1)(f) GDPR).

4.4. Accounting and tax records, responding to lawful requests from public authorities. Basis: legal obligation (Art. 6(1)(c) GDPR).

4.5. Security of the Service, protection against spam, fraud, password guessing and other abuse, investigating complaints. Basis: legitimate interest of the Company and Users in a secure service (Art. 6(1)(f) GDPR).

4.6. The Company does not send marketing emails and does not use User data for advertising or profiling. Service messages (password recovery, order information) are not marketing.

4.7. The Company does not take decisions producing legal effects for a User based solely on automated processing. Automated anti-spam filters and sending restrictions may block messages or mailboxes; such a block can be appealed via support, and the appeal is decided by a human.

5. Access to mailbox content

5.1. Message content is not used for advertising or analytics and is not sold to third parties.

5.2. An administrator may access messages in a mailbox only to provide support at the User's request and to investigate abuse. The reason and actions of such access are recorded in an audit log. The Service does not claim end-to-end encryption that would prevent administrator access.

6. Disclosure of data

6.1. The Company does not sell personal data and does not disclose it to third parties except as listed below or as required by law.

6.2. Data is shared only to the extent necessary for the relevant purpose:

• with Payment Providers — order number, amount and service description, to accept payments and make refunds; Payment Providers process payment data under their own rules;
• with the Company's processors — server hosting providers and Cloudflare (DNS and Turnstile bot protection) — under agreements requiring confidentiality;
• with public authorities — in response to lawful requests.

6.3. Servers of the Service and of some processors may be located outside the European Union, including in the United States. For such transfers the Company relies on the safeguards provided in Chapter V GDPR (such as the European Commission's Standard Contractual Clauses) unless the transfer is covered by an adequacy decision.

6.4. When messages are received, their content and addresses are also processed by the senders' mail servers.

7. Retention

7.1. Messages are kept in the mailbox for 30 days after they reach the server and are then deleted automatically. Users may delete them sooner; immediate deletion from technical copies is not guaranteed.

7.2. Mailbox data (address, password hash, settings, recovery address) is kept while the mailbox exists and deleted after the mailbox is removed, except data that must be kept by law.

7.3. The registration IP address is kept for 90 days.

7.4. Order and payment data is kept for the period required by Estonian accounting law (up to 7 years).

7.5. Support correspondence is kept for no more than 3 years after the last request.

7.6. Security logs are kept for no more than 1 year, or until a disputed case is closed.

7.7. When retention periods expire or the purposes are achieved, data is deleted or anonymised.

8. Security

The Company applies organisational and technical measures to protect data:

• access to data is limited to those who need it, with separated permissions;
• connections to the websites and mail server are protected by TLS;
• mailbox passwords are stored only as hashes, bulk order passwords are stored encrypted;
• administrator access to messages is recorded in an audit log;
• protection against password guessing, rate limits and bot checks are applied;
• personal data incidents are detected and investigated; where a breach poses a risk to Users, the Company notifies the supervisory authority within 72 hours and informs affected Users in accordance with Art. 33–34 GDPR.

9. Your rights

9.1. Users have the right to:

• obtain information about the processing of their personal data and a copy of it;
• have inaccurate data corrected;
• request erasure of their data or restriction of processing;
• receive their data in a machine-readable format (portability);
• object to processing based on the Company's legitimate interest;
• lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority of their country of residence.

9.2. Requests are sent to support@ghostsmail.com. To protect correspondence, the Company verifies that the request comes from the mailbox owner. We reply within one month; for complex requests this may be extended by two further months with an explanation.

9.3. Deleting a mailbox at the User's request does not affect data that must be kept to fulfil an Order already paid or by law.

10. Cookies

10.1. The Service's websites use only technical cookies required for mailbox login and form protection. Browser local storage keeps the selected colour theme.

10.2. The Service does not use analytics or advertising cookies. Cloudflare Turnstile bot protection may use its own technical data under Cloudflare's rules.

10.3. Users can delete cookies in their browser settings; mailbox login and forms may then stop working.

11. Children

11.1. The Service is not intended for persons under 14. The Company does not knowingly collect their data.

11.2. A parent or guardian who believes a child has provided data to the Service can write to support@ghostsmail.com, and the Company will delete that data.

12. Changes to this Policy

12.1. The Company may amend this Policy. A new version takes effect when published on this page unless stated otherwise.

12.2. If a change requires new consent from Users, the Company will request it separately.

13. Contacts

Talivio Technology OÜ, registry code 16991406 (Estonia)
Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia
Privacy questions and requests: support@ghostsmail.com