Privacy Policy
How we handle your data and your prospects’ data: what we collect, who is the controller of what, and how to get any of it back.
Last updated 12 October 2026
This Privacy Policy explains how Meditium sp. z o.o. ("anymail", "we", "us") collects, uses, and protects personal data in connection with the anymail cold-email platform at anymail.watch and app.anymail.watch.
1. Who we are
anymail is a product of Meditium sp. z o.o., based in Warsaw, Poland, built and hosted in the European Union. For any privacy question or request, contact privacy@anymail.watch.
2. Two roles: your data and your prospects' data
anymail is used by businesses ("customers", "you") to run email outreach to their own prospects. This creates two distinct relationships:
- Your account data. We are the controller of the data you give us to create and run your account (name, email, password, billing details, workspace settings).
- Your prospects' data. When you upload or import prospect lists, connect a mailbox, or receive replies, we process that data on your behalf as a processor. You remain the controller of your prospects' data. You are responsible for having a lawful basis to contact them. See our Terms of Service and, if you are a paying customer, the Data Processing Agreement available on request.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, hashed password, workspace name | You, at signup |
| Connected mailbox data | SMTP/IMAP or Microsoft 365 credentials (encrypted at rest, AES-256), mailbox address, daily sending limits | You, when connecting a mailbox |
| Prospect data | Name, email address, company, job title, and any custom fields you import | You, via CSV import or manual entry |
| Campaign content | Email subject lines and bodies you write, sequences and delay settings | You |
| Reply and engagement data | Content of prospect replies, bounce and unsubscribe events, send/delivery timestamps | Automatically, from your connected mailbox |
| Technical data | IP address, browser/device information, log data | Automatically, for security and abuse prevention |
| Billing data | Plan, payment status; card details are handled directly by our payment processor and are not stored by us | You / payment processor |
4. Why we process this data
- To provide the service: running your campaigns, sending and receiving email through your connected mailbox, showing you statistics (contract performance, Art. 6(1)(b) GDPR).
- To protect deliverability and prevent abuse: enforcing sending limits, detecting bounce and complaint patterns, pausing campaigns that put shared sending infrastructure at risk (legitimate interest, Art. 6(1)(f)).
- To bill you for a paid plan (contract performance).
- To comply with legal obligations, such as responding to lawful requests from authorities.
We do not sell personal data, and we do not use prospect data to train any model or for any purpose beyond providing the service to you.
Applications to anymail for Startups
If you apply to anymail for Startups, we process what you enter in the form (name, work email, company details, LinkedIn address, the tools you use and how you heard about us) to assess your application and to contact you about the programme. We rely on your consent, which you can withdraw at any time by writing to privacy@anymail.watch. You get a confirmation email, and a few days later an invitation to a call. We keep the application for 12 months after our last contact, then delete it. New applications are also forwarded by email to our team inbox.
5. Who else sees this data (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | Server hosting, database | Germany (European Union) |
| Cloudflare | DNS and network security | Global network; EU data residency where configured |
| vh.net.pl (Nodea) | Email hosting for anymail.watch addresses | Poland (EU) |
| Google (Gmail) | Team inbox that receives notifications about programme applications | Global |
| Your connected email provider | Sending and receiving mail on your behalf, per the mailbox you connect | Determined by your own provider rather than by us |
| Stripe Payments Europe, Ltd. | Subscription billing; card details are entered on Stripe's pages and never reach anymail | Ireland (European Union) |
6. Data retention
We keep account and prospect data for as long as your workspace is active. If you close your account, we delete your data within 30 days, except where we are required to retain it for legal or accounting purposes. Database backups are retained on a rolling basis and are fully overwritten within 14 days.
7. Security
Connected mailbox credentials and other secrets are encrypted at rest (AES-256-GCM). Access to production systems is restricted and logged. No system is perfectly secure; if we become aware of a data breach affecting your data, we will notify you and, where required, the relevant supervisory authority, without undue delay.
8. Your rights
If you are in the European Economic Area or the UK, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact privacy@anymail.watch. If you are not satisfied with our response, you may lodge a complaint with your local data protection authority.
If a data subject you have contacted through anymail (one of your prospects) wants to exercise their rights, please direct them to you as the controller, or forward the request to us and we will assist you as required by our Data Processing Agreement.
9. Cookies
See our Cookie Policy for details on the (currently minimal) cookies we use.
10. Changes to this policy
We may update this policy as the product evolves. Material changes will be communicated by email or in-app notice before they take effect.
11. Contact
Meditium sp. z o.o. · Warsaw · Built and hosted in the EU
Email: privacy@anymail.watch