Privacy Policy

1. Introduction & Data Controller

DaloMail Inc. (“Dalo Mail,” “we,” “us,” or “our”) provides business email hosting, custom-domain routing, webmail applications, and transactional email infrastructure.

For the purpose of the European General Data Protection Regulation (GDPR), the UK Data Protection Act, and the Nigerian Data Protection Act (NDPA), Dalo Mail acts as the Data Controller for your administrative account registration and billing information, and as the Data Processor on behalf of your workspace organization for email messages and mailbox communications stored in your account.

2. Information We Collect

We collect only the minimal data strictly necessary to provision reliable email infrastructure:

• Account Credentials: Name, work email address, hashed passwords, organization slug, and multi-factor authentication (MFA) tokens.
• Domain & DNS Records: Custom domains connected to your workspace, including MX, SPF, DKIM public keys, and DMARC verification statuses.
• Email Content & Telemetry: Inbound and outbound email messages, headers, attachments, delivery timestamps, bounce codes, and mailbox quota usage metrics.
• Billing Details: Billing address, selected currency (USD / NGN), transaction history, and processor tokens. We do not store full raw credit card numbers on our servers; payments are tokenized securely by Stripe and Paystack.
• Technical Device Logs: IP address, browser user-agent, operating system, and session tokens utilized for fraud prevention and authentication security.

3. What We NEVER Do With Your Data

4. How & Why We Use Your Information

We process information strictly for legitimate operational purposes:

• Delivering, receiving, routing, and indexing your business email communications.
• Running automated spam heuristics, virus scans, and phishing detection to protect your mailboxes from cyber threats.
• Managing your workspace subscriptions, processing renewals, and redeeming Bondle gift cards.
• Providing 24/7/365 customer support, migration troubleshooting, and system health alerts.
• Complying with statutory accounting and tax obligations.

5. Legal Bases for Processing (GDPR & NDPR)

Under Article 6 of the GDPR and equivalent provisions of the Nigerian Data Protection Act (NDPA), our legal bases include:

• Performance of Contract: To provision mailboxes, route messages, and execute the service agreement you entered into.
• Legitimate Interests: To detect malicious network traffic, combat spam, and secure our edge servers against DDoS attacks.
• Legal Compliance: To satisfy mandatory corporate record-keeping and anti-fraud regulations.

6. Cryptographic Security & Data Retention

Dalo Mail implements defense-in-depth security:

• Encryption in Transit: Mandatory TLS 1.3 encryption across all client-to-server and server-to-server SMTP/IMAP connections.
• Encryption at Rest: Mailboxes and attachment archives are encrypted with industry-standard AES-256 with partitioned tenant isolation.
• Data Retention: Active emails remain stored until deleted by the user or workspace administrator. Discarded emails in the Trash folder are permanently purged after 30 days. In the event of account cancellation, data is held for a 30-day export grace period before permanent zero-overwrite sanitization.

7. Sub-processors & Third-Party Gateways

We partner with vetted, enterprise-grade infrastructure providers that adhere strictly to international privacy frameworks:

8. International Data Transfers

Because Dalo Mail routes emails across global edge nodes (Lagos, London, Frankfurt, Ashburn, Singapore), your information may be processed in countries outside your country of residence. Where transfers occur from the European Economic Area (EEA) or Nigeria, we ensure adequate protections are in place by executing Standard Contractual Clauses (SCCs) approved by the European Commission and conforming with Nigeria Data Protection Commission (NDPC) guidelines.

9. Cookies & Local Browser Telemetry

We use cookies and HTML5 local storage strictly for functional application purposes:

• Authentication Cookies: Maintaining your secure logged-in session between tabs.
• Interface Preferences: Remembering your Dark / Light theme selection and active mailbox sidebar states.
• Security Tokens: Defending against Cross-Site Request Forgery (CSRF).

We do NOT utilize third-party tracking pixels or advertising remarketing cookies.

10. Your Statutory Privacy Rights

Depending on your jurisdiction (including the EU, UK, Nigeria, California, and Canada), you possess fundamental legal rights:

• Right to Access: Request a full copy of the personal information we hold about you.
• Right to Rectification: Correct any inaccurate or incomplete profile data in your settings.
• Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your account and email data.
• Right to Data Portability: Export your emails, contacts, and logs in machine-readable open formats.
• Right to Object & Restrict: Object to processing based on legitimate interests.

To exercise any of these rights, contact our Data Protection Officer at dpo@dalomail.com. We respond within 30 days without charging any administrative fees.

11. Children’s Privacy

Dalo Mail is an enterprise and business communications platform designed exclusively for commercial entities and individuals aged 18 and older. We do not knowingly solicit or collect personal information from children under 16. If we become aware that a minor has provisioned an unauthorized mailbox, we will promptly delete all associated data.

12. Data Protection Officer (DPO) Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our compliance with GDPR, NDPR, or international privacy laws, contact our designated Data Protection Officer: