Privacy Policy

Last updated: December 2024

MergeMail ("we", "our", or "us") is committed to protecting your personal data in accordance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023. This policy explains what data we collect, why we collect it, how we store it, and your rights over it.

1. Data We Collect

We collect the following categories of personal data:

  • Account data: Your name, email address, profile photo URL (from Google OAuth).
  • Usage data: Campaign statistics, login timestamps, IP address at login.
  • Payment data: Transaction reference numbers and payment status. We do not store card details — all card processing is handled by Paystack.
  • Uploaded data: Spreadsheets and document templates you upload. These contain the personal data of your recipients. You are the data controller for that data; we process it only on your behalf.
  • Communications: Messages you send us via the contact form.
  • Technical data: Browser type, device type, referring URLs, and pages visited (via analytics).

2. How We Use Your Data

We use your personal data to:

  • Provide and operate the MergeMail service.
  • Process payments and issue receipts.
  • Send you transactional emails (campaign completion notices, password resets).
  • Respond to support enquiries.
  • Detect and prevent fraud, abuse, and policy violations.
  • Improve the platform through aggregate, anonymized analytics.

We do not sell your personal data to third parties. We do not use your data for targeted advertising.

3. Lawful Basis for Processing

We process your data under the following lawful bases (NDPR Article 2.2):

  • Contract performance: To deliver the services you signed up for.
  • Legitimate interests: To detect abuse, improve the service, and ensure platform security.
  • Consent: Where we ask for your explicit consent (e.g. marketing emails).
  • Legal obligation: To comply with applicable Nigerian law.

4. Data Storage and Security

  • All data is stored in Supabase infrastructure hosted in the EU (Frankfurt region).
  • Data at rest is encrypted using AES-256. Data in transit uses TLS 1.2+.
  • SMTP credentials you provide are encrypted with AES-256-GCM before being stored.
  • Uploaded files are stored in private Supabase storage buckets with Row Level Security. Only your account can access your files.
  • We perform regular security audits and dependency updates.

5. Data Sharing

We share your data only with:

  • Supabase: Our database and storage provider (EU-based). They process data strictly as a data processor under a Data Processing Agreement.
  • Paystack: Our payment processor (Nigeria). Card data never passes through our servers.
  • Vercel: Our hosting provider. Request logs may be retained briefly for debugging.
  • Law enforcement: Where required by a valid court order or regulatory authority under Nigerian law.

We do not share your recipient data (the personal data in your uploaded spreadsheets) with any third party for any purpose other than delivering your campaign.

6. Data Retention

  • Account data is retained for the lifetime of your account plus 90 days after deletion.
  • Uploaded spreadsheets and generated documents are retained until you delete them from your dashboard, or for 12 months of account inactivity, whichever comes first.
  • Payment records are retained for 7 years as required by Nigerian financial regulations.
  • Contact form submissions are retained for 2 years for support continuity.

7. Your Rights Under NDPR

You have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure: Request deletion of your account and associated data (subject to legal retention obligations).
  • Portability: Receive your data in a machine-readable format.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise these rights, use the contact form with subject "General Enquiry" or email privacy@mergemail.app. We will respond within 30 days as required by NDPR.

8. Cookies

We use only essential session cookies required for authentication. We do not use third-party advertising cookies. Analytics (if enabled) use anonymized, cookie-free tracking.

9. Children's Data

MergeMail is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy to reflect changes in the law or our practices. Material changes will be announced via the dashboard notification system at least 14 days before taking effect.

11. Contact

For privacy questions or to exercise your rights, contact our Data Protection Officer at privacy@mergemail.app or use the contact form.