Privacy policy.
Who is responsible for your data on this site, what we collect and why, who helps us process it, how long we keep it, and the rights you have.
The short version
- Browsing this site sets no cookies and loads nothing from third parties; a course video loads YouTube only when you press play.
- We collect only what you type into a form or tool, for the reason the form states.
- We do not sell data, show ads, build profiles, or use your data to train AI.
- Our database and email servers are in the European Union.
Who is responsible
The controller of your personal data is Frank (MailVitals’ founder), trading as MailVitals, a sole trader (entrepreneur individuel) in France. Registration is in progress; the SIRET and address are published in the legal notice as soon as it completes. For anything about your data, write to hello@mailvitals.com. Full details are in the legal notice.
What we collect, why, and for how long
| When | What | Why, and on what legal basis | Kept |
|---|---|---|---|
| Visiting the site | Your IP address, browser and the pages requested. | To deliver the site and protect it from attacks. Handled by our host, Cloudflare; we do not use it to identify or follow you. Legitimate interest (security). | We keep no visitor logs of our own; Cloudflare keeps its security logs briefly. |
| Counting visits | The page you open, the page you came from, your browser, country and how fast the page loaded. No cookie, nothing stored on your device. | To see which pages are read and how fast they load. Counted by Cloudflare Web Analytics, which does not fingerprint visitors or follow them across sites; we see totals only, never an individual visit. Legitimate interest (audience measurement). | We see aggregated totals only. Cloudflare keeps the underlying measurements under its own retention policy. |
| Free tools and scan | The domain or text you enter. A keyed hash of your IP address that changes every day. | To run the lookup, keep repeat lookups fast for 10 minutes, and limit abuse. Legitimate interest (providing the tool, preventing abuse). | Results: 10 minutes. Daily IP hash: 30 days. |
| Email test | The test message you send to your test address: its headers, the sender addresses, its text and links, and the address of the server that delivered it. A keyed hash of your IP address that changes every day. | To analyse the message and show you its report, and to limit abuse. The report keeps the message's header fields, its links, the first line of its text and the route it travelled, so you can read them back, and anyone you give its private link to can read it. Legitimate interest (providing the test you asked for, preventing abuse). | The report: 7 days, then deleted automatically. The body of the message is never stored. Daily IP hash: 30 days. |
| Booking a demo | Name, email, company, notes, time zone, the time chosen. A keyed hash of your IP address while the booking is live. | To arrange and hold the meeting, send its emails, and allow one live booking per person. Steps you ask for before a contract; legitimate interest for the IP hash. | 12 months after the meeting. The IP hash is deleted when the booking ends. |
| Feedback after a demo | Your rating and answers. If you allow a quote: the name and role you choose to show. | To improve the demos and, only with your permission and once we have read it, to quote you on the booking page. Legitimate interest for the feedback; your consent for a quote. | Unpublished: 24 months. A published quote: until you ask us to remove it. |
| Consulting request | The answers you give on the form. If we take it on: the proposal we write and when you accept it, shown with the steps of your request on a private page. A keyed hash of your IP address that changes every day. | To prepare and send you a proposal, and to limit how often the form can be sent. Steps you ask for before a contract; legitimate interest for the IP hash. | 24 months after our last contact. If you hire us, invoices are kept 10 years as French law requires. Daily IP hash: 30 days. |
| Pulse order | Name, email, company, website, the package and extras you choose, your domains or the names you want registered, your sending tool and any notes. For the deposit: the PayPal order and payment references and whether it was paid. The steps your order goes through, with their dates, shown on a private tracking page. A keyed hash of your IP address that changes every day. | To hold your place in a batch of IPs, set up Pulse for you, and limit how often the form can be sent. The deposit is paid on PayPal’s own pages, under PayPal’s privacy notice: we receive only its reference and status, never your card or account details. Steps you ask for before a contract; legitimate interest for the IP hash. | 24 months after the order. If you become a customer, invoices are kept 10 years as French law requires. Daily IP hash: 30 days. |
| Self-hosted Pulse order | Name, email, company, website, the licence and installation you choose, where it will run and any notes. The steps your order goes through, with their dates, shown on a private tracking page. A keyed hash of your IP address that changes every day. | To prepare your demo, invoice you after it and deliver the licence, and to limit how often the form can be sent. Steps you ask for before a contract; legitimate interest for the IP hash. | 24 months after the order. If you become a customer, invoices are kept 10 years as French law requires. Daily IP hash: 30 days. |
| Support ticket | Name, email, the subject and message you write, and optionally a domain and bounce text or headers. A keyed hash of your IP address that changes every day. | To answer your question, and to limit how often the form can be sent. The ticket is an email to our support inbox; nothing is stored in a database. Steps you ask for before or under a contract; legitimate interest for the IP hash. | In the support mailbox for 24 months after our last reply. Daily IP hash: 30 days. |
| Early-access lists | Email, and optionally company and sending volume. A keyed hash of your IP address that changes every day. | To tell you when the product opens, and to limit how often the form can be sent. Your consent; legitimate interest for the IP hash. | Until the product opens and you are told, at most 3 years, or until you withdraw consent. Daily IP hash: 30 days. |
| Academy account | Email, and which lessons you have completed. A keyed hash of your IP address that changes every day, each time you ask for a sign-in link. | To sign you in and remember your progress, and to limit how many sign-in links can be sent. Contract (providing the account you asked for); legitimate interest for the IP hash. | While the account exists. Deleted on request, or after 3 years without sign-in. Daily IP hash: 30 days. |
| Course videos | Only if you press play on a lesson video: your IP address, browser details and the request for the video, which go to Google (YouTube), not to us. | To play the video you asked for. Until you press play, the video is a picture drawn by this site and nothing is sent to Google. Google then acts under its own privacy policy. Your action: starting playback is your choice to load YouTube, and your consent to what it sets. | We keep nothing. Google keeps what it collects under its own policy. |
| Emailing us | Your message and address. | To answer you. Legitimate interest. | Up to 3 years after the conversation ends. |
The IP hashes cannot be turned back into an address: each is made with a secret key held only by our server (an HMAC), and the daily ones also change every day. An IPv6 address is hashed by its network (the first half), because one connection is given a whole network of addresses.
Who processes it for us
These providers process data on our behalf, only on our instructions, under a data processing agreement. We do not share your data with anyone else, except where the law requires it.
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting and network delivery of the site; counting visits without cookies (Web Analytics); receiving email-test messages and storing their reports | Global network; email test reports stored in the European Union; company in the United States |
| Supabase, Inc. | Database and Academy sign-in | Servers in Frankfurt, Germany |
| Resend, Inc. | Sending the emails on this page | Servers in Ireland |
| Apple | The calendar that holds demo bookings (iCloud) | Apple Distribution International Ltd., Ireland; data may be stored in the United States |
| Proton AG | Video calls for confirmed demos (Proton Meet) | Switzerland |
Where a provider is outside the European Union, transfers rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Switzerland has an adequacy decision from the European Commission.
Course videos and Google
Some Academy lessons have a video hosted on YouTube. It is served by Google (Google Ireland Limited for visitors in the European Economic Area, Google LLC in the United States elsewhere) only after you press play, in YouTube’s privacy-enhanced mode. Google then receives your IP address and the request for the video, and may set cookies; it does so as a separate controller under its own privacy policy, not as our processor, and we receive nothing back. Not pressing play, or using the “Watch on YouTube” link instead, is always an option: every lesson can be read in full without the video.
Emails
Forms send you only the emails they describe: a booking’s confirmation, reminder, meeting link and one request for feedback afterwards, a receipt for a consulting request, a receipt for a Pulse order and the confirmation of its deposit, a receipt for a self-hosted Pulse order with the link to book its demo, a confirmation with its reference for a support ticket, and, if you join an early-access list, one message when the product opens. Every email says why you are receiving it. To leave a list, reply to any of our emails or write to hello@mailvitals.com.
Cookies
None while you browse. Signing in to the Academy sets two cookies that keep you signed in, which the law treats as strictly necessary, so no consent banner is needed. Pressing play on a course video loads YouTube, which may set its own. The cookie policy lists them.
Security
Every connection is encrypted (HTTPS). The database is encrypted at rest and reachable only by our server. Links in booking emails carry random tokens of which we store only a hash, so the database alone cannot be turned into working links.
Your rights
Under the GDPR and the French data protection act, you can ask us to:
- give you a copy of your data (access) or send it to you in a portable format;
- correct it, or delete it;
- restrict how we use it, or object to a use based on legitimate interest;
- withdraw a consent you gave, at any time, without affecting what came before;
- follow your instructions for your data after your death.
Write to hello@mailvitals.com. We answer within one month. If you think we have not respected your rights, you can complain to the Commission nationale de l’informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr).
No automated decisions
Nothing on this site makes a decision about you by automated means that has legal or similarly significant effects.
Children
This site is for businesses and is not directed at anyone under 16.
Changes
When what we do with data changes, this page changes with it, and the date at the top moves. If a change affects you directly, for example on an early-access list, we will email you first.
The Beat, Pulse and Reps apps
Beat, Pulse and Reps run as separate applications, each with its own privacy notice and data processing agreement, given to customers before they start using it.
A heartbeat for your email.
Beat runs every check on this site on a schedule: 41 checks, 50 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.
- SPFpass
- DKIMpass
- DMARCp=none
- Blacklists0 / 50
Illustrative. Your domain, every few hours.
Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer