Last modified: October 2026.

Your privacy is important to MAILSUITE S.L., ("Mailsuite®" or "we" or "us") and essential to our service. This Privacy Policy explains what personal data we collect, why, what we do with your personal data and how we use it. Likewise, this Privacy Policy explains in what condition we process personal data, since, in some cases, we act as a data controller, with regard to the information of our users or other interested parties related to our website; and in other cases, as a data processor on behalf of our users.

Table of contents

1. Introduction
2. Processing of Users' Personal Data by Mailsuite® (as Data Controller)
3. Processing of personal data of Recipients on behalf of the Users by Mailsuite® (as Data Processor)
4. Use of Google's APIs
5. Use of Microsoft's API
6. Opting out of Mailsuite®'s Service
7. AI apps connected by the User

1. Introduction

The purpose of this Privacy Policy is to inform you of the conditions and procedures for the collection, use and communication of personal data in connection with our service. Mailsuite® offers its users an email tracking and management service with various associated functionalities (the "Service"). Therefore, this Privacy Policy sets out the conditions for the processing of personal data by Mailsuite®: (i) when you use our Services ("User") or when you access and browse our mailtrack.io, mailsuite.com, maildoc.io, gourl.es, shortlink.es, gotourl.es, gotourl.click, jumpto.es, jumptolink.es, lnkrelay.com, lnkroute.com, linktourl.es, linktourl.eu, list-preferences.com, list-prefs.com, list-pref-center.com, list-opt-center.com websites ("Website"); and (ii) when in order to provide our Service we process on behalf of the User personal data with regard to the User's communication, including personal data of the recipient ("Recipient").

Mailsuite® will process personal data in accordance with European Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data repealing Directive 95/46/EC (“GDPR”), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPD”) and other applicable data protection laws.

We recommend you to read this Privacy Policy carefully, before using our Services or browsing through our Website.

2. Processing of Users' Personal Data by Mailsuite® (as Data Controller)

2.1. This Section explains the processing of personal data of Users or on the Website by Mailsuite® as a data controller, i.e. when Mailsuite® decides on the purposes and means to carry out the processing of such personal data. This only occurs with respect to the Users' data used by Mailsuite® for the purpose of providing the Service, with all the functionalities available at any time and including activities ancillary to the Service such as account maintenance, billing ...; or with respect to information collected from users accessing and browsing the Website. This does not include communications sent by Users through the Service and related data, which will only be processed in accordance with Section 3.

2.2. Mailsuite® may process personal data of Users or on the Website in the following cases and for the purposes and for the periods indicated below:

• For the provision of the Service, Mailsuite® may process personal data of the Users provided by them when installing or contracting the Service, such as the name, email address, language preferences, location for the correct display of price/currency, payment data, as well as any other data or information of the Users derived from the provision of the Service.

These personal data are used by Mailsuite® for the following purposes:

• to provide the Service and carry out the maintenance and management of the contractual relationship;
• to manage and improve the Service;
• to respond to requests, suggestions or complaints regarding the Service;
• to send to the User the information requested by the User;
• to send communications and news related to the Service;
• to comply with the regulations applicable in each case;
• to respond to requests or requirements from public authorities; and
• to protect our service from spam and abuse, we use Google reCAPTCHA. This service analyzes user behavior to distinguish humans from bots.

The legal basis for the processing of the above data is the performance of the contractual relationship between the User and Mailsuite® for the provision of the Service, as well as the legitimate interest of Mailsuite® in informing Users about the Service, unless Users inform Mailsuite® that they do not wish to receive commercial communications, as well as to improve the Service and prevent fraud and abuse.

Users' personal data will be processed by Mailsuite® during the contractual relationship and, subsequently, during the legal period required by the applicable regulations depending on the case.

• By means of cookies, with respect to visitors to the Website, in order to provide the functionalities of the Website and to learn about the use of the Website and to improve its functioning, as described in our Cookies Policy.

When we use cookies for the purposes set out in our Cookies Policy, we do so on the basis of prior consent in the terms provided in the applicable regulations. The user of the Website can accept or reject all of our cookies or granularly accept some cookies and not others through our consent manager.

Mailsuite® will store cookie usage information and your IP address in accordance with the Cookies Policy.

• For advertising measurement. If you accept the "Marketing" category in our cookie banner, we share with Google, in hashed form, the email address you use to sign up or purchase, to measure the effectiveness of our Google Ads campaigns. You can withdraw this consent at any time from that same banner.

• To respond to requests, suggestions or complaints. Personal data received by Mailsuite® through the means provided for this purpose, are used exclusively to respond to inquiries, suggestions or complaints sent by Users or users who access and browse the Website.

The purpose of the processing of these personal data is to manage queries, suggestions or complaints and subsequent follow-up, based on the fulfillment of a contractual relationship or, where appropriate, the legitimate interest of Mailsuite® in managing the response to these requests and the management and improvement of the Service.

Mailsuite® will keep the information for as long as it is necessary to respond to queries, suggestions or complaints and to follow up on them. Likewise, Mailsuite® may retain personal data for the periods necessary to comply with the legal obligations that may apply.

• To participate in selection processes published on the Website. When Mailsuite® receives personal data from candidates to its job offers, through the means provided on the Website, Mailsuite® will use these identification, academic, professional and profile data, along with those provided during the process, to manage such selection processes.

In such cases, the legal basis for the processing of personal data will be the performance of pre-contractual measures at the request of the data subject.

Personal information will only be stored during the period in which the corresponding selection process is in force.

• When the User connects an AI App (see Section 7), Mailsuite® processes the data relating to the connection itself: the AI App connected and the web address it connects back to, the permissions granted, the date of the authorization and a record of the requests made. Mailsuite® uses these data to provide the Service, to keep it secure and to prevent abuse, on the basis of the performance of the contract and its legitimate interest. They are kept while the User's account exists, so that the User can review which AI Apps were connected and when, and are deleted together with the account, without prejudice to the retention periods required by applicable law (Section 2.3).

2.3. Duration. The period during which personal data will be kept or the criteria used to determine such period are those indicated in each of the cases set forth above in Section 2.2 of this Privacy Policy. Additionally, personal data will be kept for the periods required by the applicable regulations.

2.4. Mailsuite®'s processors, i.e. our service providers, may have access to the above personal data when necessary and only for the purpose of managing the provision of the relevant service. To ensure that personal data receive an adequate level of protection, Mailsuite® will enter into agreements with third parties with whom it shares personal data, which require that your personal data is processed by those third parties in a manner that is consistent and compliant with data protection regulations.

We may also provide personal data to the competent judicial or administrative authorities in cases where it is necessary to comply with any applicable law or regulation.

If the User connects an AI App to his/her account (Section 7), Mailsuite® discloses to that application, on the User's instructions and only within the permissions the User has granted it, the data the application requests, including the User's own data (his/her activity in the Service, contacts and tasks). The legal basis for this disclosure is the performance of the contract. The company that provides the AI App is not a service provider of Mailsuite®: it is chosen and engaged by the User, so the agreements referred to in this Section do not apply to it and its processing is governed by Section 7.3.

2.5. In general, the User's personal data will be stored in the European Economic Area (i.e. the member states of the European Union, Norway, Iceland and Liechtenstein or "EEA"). However, Mailsuite® may share personal data with service providers located outside the EEA, in which case Mailsuite® will ensure that personal data is stored and transferred securely. These transfers will be made, depending on the case, on one of the bases permitted by the European data protection regulations, either based on the fact that the transfer is made to a country where the European Commission has established its adequacy with respect to its levels of data protection or through data transfer agreements incorporating the standard contractual clauses accepted by the European Commission in accordance with art. 46.2.c) RGPD.

2.6. The User or the data subject, as appropriate in accordance with the assumptions provided for in section 2.2 above, has the right to request a copy of any personal information we hold about him/her in our records, to correct any inaccuracies and to update any outdated information. You may also request deletion of your personal information where, among other reasons, it is no longer needed for the purposes for which it was collected or, where applicable, request portability of your data. In certain circumstances, you can request to limit the processing of your data or object to the processing of your data. Mailsuite® will stop processing the data, except for imperative legitimate reasons, or the exercise or defense of possible claims. You also have the right to withdraw your consent at any time, when this is the legal basis for the processing of your personal data.

The above rights may be exercised by contacting Mailsuite® at the following address: Calle Córcega, 301, Attic 2, 08008, Barcelona (Spain) or by sending an e-mail to privacy@mailsuite.com. You can also contact our Data Protection Officer at dpo@mailsuite.com.

In accordance with the provisions of the GDPR, when requests are manifestly unfounded or excessive, especially due to their repetitive nature, Mailsuite® may charge a reasonable fee based on the administrative costs incurred to provide the information or communication or to carry out the requested action, without prejudice to the possibility of refusing to act.

The User or interested party, as appropriate, may also seek the assistance of the Spanish Data Protection Agency at www.aepd.es.

If at any time the User or interested party, as applicable, wishes to stop receiving commercial communications from Mailsuite®, he/she may request to do so by sending an e-mail to privacy@mailsuite.com.

3. Processing of personal data of Recipients on behalf of the Users by Mailsuite® (as Data Processor)

3.1. This Section details the processing of personal data relating to communications to Recipients, which is carried out by Mailsuite® on behalf of and following the instructions of the Users. In such cases, Mailsuite® acts as a data processor, as the purposes and means of the processing of the personal data are determined by the User and Mailsuite® only accesses the data at the request of the User and to provide the Service. Mailsuite® does not act as a data controller with respect to personal data relating to communications to Recipients.

3.2. The provision of the Service in favor of the User may imply access and processing by Mailsuite® of personal data relating to communications to the Recipient, for the purposes established by the User. Mailsuite® will have access to the following data

• Information necessary to identity emails sent through the Service:
  • email address;
  • subject of email;
  • content of the message, on a temporary basis, only when necessary to provide the Service and during the transmission of the data through our Service, until the effective delivery of the email; when the User has the approval of new recipients active (Section 7.5), Mailsuite® also keeps an encrypted copy of the recipients, subject and content of the emails awaiting approval for a maximum of 72 hours;
  • date and time at which the email was sent;
  • document name, in the “Advanced documents” functionality; and
  • document, in the “Advanced documents” functionality.

• Information provided by the Service:
  • confirmation of opening;
  • content of the message, on a temporary basis, only when necessary to provide the Service and during the transmission of the data through our Service, until the effective delivery of the email;
  • opening history (number, date and time) of the email received;
  • number of links included in the email;
  • text and URL of such links;
  • history of clicks (number, date and time) made on the links contained in the email;
  • history of openings (number, date and time) of the document (in the “Advanced documents” functionality);
  • IP address, browser and operating system used by the person who clicked on the link or downloaded the document;
  • recipient's signature (with signature request functionality);
  • campaign unsubscription (with the campaing unsubscription funtionality); and
  • poll responses (with the poll functionality).

• Information from the User's email threads, when the User connects an AI App (Section 7):
  • subject, participants and date of the messages in the threads the AI App searches for on the User's instructions; and
  • full content of the messages (received from other people and sent by the User) in the threads the User looks up through the AI App.

The processing of the aforementioned personal data is carried out solely for the provision of the Service within the terms and duration indicated in the Terms and Conditions of the Service and always under the instructions of the User. When the User connects an AI App, Mailsuite® provides it, on the User's instructions and only within the permissions granted, with the data indicated in Section 7.2.

3.3. As a result, Mailsuite®:

(i) will not process the personal data relating to the communication to the Recipient for purposes other than the provision of the Service requested by the User and will not transfer such data, even for storage, to unauthorized third parties, other than to the AI Apps that the User connects in accordance with Section 7;

(ii) will process the personal data relating to the communication to the Recipient following the instructions of the User. When Mailsuite® becomes aware that the instructions given by the User violate the data protection regulations, Mailsuite® shall immediately inform the User;

(iii) will promptly notify the User if it becomes aware of any data breach and shall provide all details of the relevant infringement;

(iv) will ensure that persons authorized within Mailsuite® to process personal data relating to communications to Recipients have undertaken to respect confidentiality or are subject to a legal obligation of confidentiality;

(v) taking into account the nature of the processing, Mailsuite® will assist the User through appropriate technical and organizational measures, as far as possible, in fulfilling the Users' obligation to respond to requests for the exercise of the rights of the relevant data subject set out in Chapter III of the GDPR, for which it will notify promptly the relevant User, through the email address listed as contact in his/her account, the requests it receives. In any case, the User will be responsible for the attention and response to such exercise of rights, although in compliance with the above, Mailsuite® will follow the instructions given by the User;

(vi) will take all necessary measures in accordance with Article 32 GDPR, (security of processing);

(vii) will assist the User in fulfilling his/her obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to Mailsuite®, including but not limited to:

1. at the User's choice, Mailsuite® will delete or return all personal data relating to communications to the Recipient to the User after the end of the Service, unless the applicable regulations require the storage of the data; and
2. may make available to the User, all the information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR, and will allow and contribute to audits, including inspections, conducted by the User or by an auditor authorized by the User.

3.4. Mailsuite® will not subcontract third parties for processing operations that may involve access to personal data relating to the communication to the Recipient without the User's authorization.

In this regard, the following sub-processors shall be deemed to be authorized by the User:

• Amazon Web Services, Inc. as a provider of hosting the Service, through servers located in Ireland.
• Google Services: Google Apps, Gmail API, Google Analytics, Webmaster Tools, Google Forms and Google reCAPTCHA.
• Microsoft Service: Outlook API.

The AI Apps the User connects under Section 7 are not sub-processors of Mailsuite®: they are chosen and engaged by the User.

3.5. Mailsuite® will guarantee the confidentiality of personal data relating to communications to the Recipients, even after the termination of the Service.

3.6. In the event the User is located in a country outside the EEA and, as a result of the provision of the service, international transfers of personal data are carried out by Mailsuite® and the adequacy of the levels of data protection of the country to which the data is transferred has not been established by the European Commission, the European Commission, the Standard Contractual Clauses contained in the Commission Implementing Decision (EU) 2021/914 of 4^th June 2021 ("SCC") shall apply between Mailsuite® and the User, completed as follows:

(i) Module Four shall apply;

(ii) Clause 7 shall not apply.

(iii) The optional paragraph of Clause 11 shall not apply.

(iv) With respect to Clause 17, the SCC shall be governed by Spanish law.

(v) With respect to Clause 18, the applicable jurisdiction for future disputes arising from these SCC shall be that of Spain, and to the extent possible, that of Madrid.

(vi) The information in Annex I shall be deemed completed with the information set out in this Privacy Policy.

3.7. The User is responsible for the processing of the personal data of the Recipients or of any other type in the context of the communications sent through the Service, subject to the scope of application of the GDPR (taking into account that the processing derived from exclusively domestic activities are excluded from the GDPR), or that of any other applicable regulation. The User will be the only one to define the purposes and means for the processing of the aforementioned personal data, and in any case, it cannot be understood that Mailsuite® processes personal data relating to communications to the Recipients for its own purposes, since it will only use them for the provision of the Service and acting on behalf of the User. As a result, the User shall comply with the applicable obligations under data protection regulations, as applicable in each case, including, where applicable, obligations relating to obtaining the consent of the data subjects and informing them about the processing of their data, as a consequence of the use of the Service. The User, and not Mailsuite®, shall be solely responsible for the compliance of such obligations.

4. Use of Google's APIs

Mailsuite®'s use of information received from Google APIs, and its transfer to any other app (including the AI Apps the User connects under Section 7), will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Use of Microsoft's API

The use by Mailsuite® of the information received through the Microsoft API implies the User's adherence to the Microsoft API Terms of Use.

6. Opting out of Mailsuite®'s Service

If you are a Recipient of emails sent through Mailsuite®'s Service and you wish to exercise any rights under the GDPR, please note that you should contact the Mailsuite® User who sent you the email. The User who sends the email is the one who decides the recipient, content and purpose of the communication, and therefore, according to the regulations, is the one who has the responsibility and obligation to comply with your rights as the Recipient. For the same reason, the User in question is the only one who is in a position to make decisions regarding the rights of the Recipients whose data is processed. Mailsuite® is merely the provider of the Service.

In any case, in Mailsuite® we are committed to safeguarding and protecting privacy and we provide you with the email privacy@mailsuite.com to help you make requests to the corresponding User. You can also contact our Data Protection Officer at dpo@mailsuite.com. Likewise, we will assist the User, in his/her capacity as the data controller, to comply with his/her obligations in relation to the exercise of your rights as the Recipient. However, please note that the response and compliance will ultimately depend on the User.

7. AI apps connected by the User

7.1. The User may connect an artificial intelligence application of his/her choice (for example ChatGPT, Claude, Gemini, Microsoft Copilot, Cursor or any other compatible application, an "AI App") to his/her Mailsuite® account, by authorizing it in Mailsuite®'s authorization screen or by creating an access token in the Service. The AI App is chosen, configured and operated by the User and by the company that provides it; it is not provided by Mailsuite® and its provider is not a sub-processor of Mailsuite®.

7.2. Once connected, and only within the permissions the User grants it in the authorization screen or when creating the token, the AI App may request from Mailsuite®, on the User's instructions, information about the emails the User has sent with tracking (recipients, subject, date sent and the date and time of each opening), the User's recent activity in the Service, contacts, the subject and participants of the User's email threads, the full content of the threads the User points it to (messages received from other people and messages sent by the User), and the User's tasks; and it may ask Mailsuite® to send emails, create trackings, set follow-up reminders and create tasks on the User's behalf. In doing so Mailsuite® acts as a data processor on behalf of the User, under the terms of Section 3, with respect to third-party data, and discloses the User's own data in accordance with Section 2.4.

7.3. Everything the AI App reads leaves Mailsuite® and passes to the company that provides it (which may be established outside the European Economic Area) and to the model providers that company uses. Mailsuite® takes no part in that processing: what that company does with the information, including, where applicable, using it to train its models, depends on its terms, its privacy policy and the settings of the User's account in that application, which the User should review before connecting it. The User is responsible for choosing an AI App whose processing is appropriate for the personal data of third parties contained in his/her email, in accordance with Section 3.7. In particular, as data controller, the User is responsible for: (i) having a legal basis to disclose to the AI App provider the personal data of Recipients and of any other persons contained in the User's communications; (ii) choosing an AI App whose provider offers adequate guarantees, including, where applicable, a data processing agreement, a commitment not to use the data to train its models and an appropriate mechanism for international transfers; and (iii) informing the data subjects where required.

7.4. To limit the information that reaches the AI App, by default Mailsuite® only provides the User's tracked emails from the last 90 days, does not include blind carbon copy (BCC) recipients unless the AI App expressly asks for them, and never provides the IP address, country or device of the person who opened an email.

7.5. When the approval of new recipients is active for the User's account, Mailsuite® does not send an email requested by the AI App that is addressed to a recipient the User has never emailed before: the email is held until the User sends or discards it in Settings → AI. While held, its recipients, subject and body are stored encrypted for a maximum of 72 hours from the moment it is held, and that copy is deleted as soon as the User decides, when the time limit expires, when the User revokes the AI App's access or when the User deletes his/her account.

7.6. If the User belongs to a team, the owner of the team decides whether the members of the team may connect AI Apps; until the owner allows it, nobody in the team can connect them, the owner included. The User may revoke the access of any AI App at any time in Settings → AI, after which it can no longer obtain information through Mailsuite®. Revoking access does not delete the information the AI App has already received; its deletion must be requested from the company that provides it.