Privacy notice
Last updated: [DATE]
The short version
We collect as little as we can: your email address, your child's first name, and the address you choose.
Emails sent to your child's address pass through our email provider, Migadu, to your inbox. Migadu stores data in France and Germany. We don't read the emails or keep copies.
We never sell your details or use them for advertising.
Who we are
Mummy's Mail (mummysmail.com) is a trading name of Glasgow Engineering Ltd, a company registered in Scotland with company number SC146270. Our registered office is 37 Balfron Rd, Ralston, Paisley, PA1 3HD, United Kingdom. We're the "controller" for the personal information described here, which means we decide how it's used and are responsible for looking after it.
For anything about your personal information, email hello@mummysmail.com.
Information we collect
If you register your interest
Your email address, your child's first name, the address you'd like, whether you're interested in a safe contact list, and the date you registered.
If you buy an address
- Your name and email address, and your forwarding address if it's different
- Your child's first name, as it appears in their address
- The address itself, its start and end dates, and its status
- A record of your payment. Stripe handles your card details, and we never see or store them.
- Any emails you send us, for example to ask for help
Apart from their first name, we don't ask for anything else about your child: no surname, date of birth, age or school.
Emails sent to your child's address
When someone emails your child's address, our email provider, Migadu, receives the message and forwards it to you, including messages its systems consider spam. This means Migadu briefly handles the sender's details and the message content. We've set up forwarding so that no copy is kept in a mailbox, and we don't read these emails.
Migadu keeps delivery records, such as sender and recipient addresses, date and time, and whether the message was delivered, for 7 days, so we can investigate problems like missing emails. Migadu also keeps backups of its systems for 14 days, so information may remain in those backups for up to 14 days before it's deleted.
Forwarded emails then arrive at your own email provider, such as Gmail or Outlook. How they handle your emails is covered by their own privacy policy, not ours.
When you visit our website
We don't use cookies, analytics or advertising trackers, and everything on our pages, including fonts, is served from our own site. Our website's server keeps standard access logs, including IP addresses and the pages requested, for security and to fix problems. We delete them after 30 days.
How and why we use it
| What we do | Why we're allowed to |
|---|---|
| Email you about our launch and give you first pick of your chosen address | Your consent, which you can withdraw at any time |
| Set up and run your child's address, forward emails, and send renewal reminders | To provide the service you've bought (our contract with you) |
| Handle the details of people who email your child's address, so their messages reach you | Our legitimate interest, and theirs, in delivering the emails they choose to send |
| Prevent misuse of the service, for example by blocking senders who flood an address | Our legitimate interest in keeping the service and children safe |
| Answer your questions and complaints | Our contract with you, or our legitimate interest in helping you |
| Keep payment and accounting records | Our legal obligations, for example to HMRC |
We'll only send you marketing emails about new features if you've agreed to them, and every one will include an easy way to unsubscribe.
Your child's information
We've designed the service to collect as little about children as possible. Your child doesn't use the service directly, and the address can't send email. You make decisions about your child's information and can use the rights below on their behalf.
Remember that an email address can reveal a child's first name to anyone it's shared with. Only give it to people and organisations you trust.
Who we share it with
We only share information with companies that help us run the service, and they must keep it secure. Migadu and Namecheap can only use it on our instructions. Stripe also uses some payment information for its own purposes, such as preventing fraud, as explained in its privacy policy.
- Migadu (Migadu-Mail GmbH, Switzerland) receives and forwards emails to your child's address, and holds the list of addresses and where they forward to. Its data is stored in data centres run by OVH in France and Germany.
- Stripe (Stripe Payments UK Ltd, and Stripe Technology Company Ltd in Ireland) processes payments. Stripe collects payment details and information about the device you pay from, and uses it to take payments, prevent and detect fraud, and improve its services. Stripe may transfer data to the United States. You can read Stripe's privacy policy.
- Namecheap (Namecheap, Inc., United States) hosts our website and interest list, and sends our account emails, such as confirmations and renewal reminders.
We may also share information if the law requires it, or to protect a child or anyone else from harm.
Some of these companies store or process information outside the UK. Switzerland and the European Economic Area, where Migadu is based and stores data, are recognised under UK law as giving personal information adequate protection. Namecheap is based in the United States, and Stripe may also process information there. For these transfers, we make sure there are legal protections in place, such as the UK-US data bridge or the UK International Data Transfer Addendum. Email us if you'd like more details.
How long we keep it
- Interest list: until 3 months after we launch, so you have time to claim your address. If you buy one, your details move to your account. If Mummy's Mail doesn't go ahead, we delete the list.
- Account details: for your term and any grace and closed periods, then deleted within 12 months, unless you renew. We keep the address itself on record so it isn't given out again by mistake, but without any of your details.
- Email delivery records: 7 days, held by Migadu.
- Migadu's system backups: 14 days.
- Website access logs: 30 days.
- Namecheap's server backups: up to 4 weeks. These can include our website and interest list, so information we delete may remain in a backup for up to 4 weeks.
- Payment and accounting records: 6 years, as required by tax law.
- Emails you send us: up to 12 months after we last hear from you.
When an address is given to another family, none of your details or your child's go with it.
Your rights
You can ask us to:
- give you a copy of the information we hold about you or your child
- correct information that's wrong
- delete your information, where we don't need to keep it
- stop or limit how we use it, or object to how we use it
- send your information to you or another organisation in a usable format
Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email hello@mummysmail.com. We'll reply within one month. We may need to confirm who you are first.
Keeping it safe
We use two-factor authentication on the accounts that run the service, give suppliers only the access they need, and keep the interest list and account records out of public reach. Migadu encrypts email in transit, controls access to its systems, and lets us block abusive senders. If a security incident puts your information at risk, we'll tell you and, where required, the ICO.
Complaints
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.
Changes to this notice
We'll update this notice if our use of your information changes. If the change is significant, we'll email you.