Last updated 2026-09-07.
1. Two different roles
This matters more than anything else on the page.
- For your account with us — your name, email address, workspace, subscription and how you use the site and app — Wary Tech Ltd is the controller. This policy describes that.
- For the contents of the mailboxes you connect — your mail, your contacts, the people who write to you — you are the controller and we are your processor. We act on your instructions. Those terms are in the data processing information.
2. What we collect as controller
| Data | Why | Lawful basis |
|---|---|---|
| Name, email address, password hash, two-factor secret | To create and secure your account | Performance of a contract |
| Workspace name, business details you enter during onboarding | To provide the service and invoice you | Performance of a contract |
| Subscription, plan, invoices, billing address, card brand and last four digits | To take payment and meet accounting obligations | Contract; legal obligation |
| Sign-in events, IP address, browser and device, session records, audit log entries | To detect and investigate account compromise and misuse | Legitimate interests (security) |
| Support enquiries and the messages you send us | To answer you and improve the service | Legitimate interests (support) |
| Strictly necessary cookies | To keep you signed in and protect forms | Legitimate interests; required for the service you asked for |
| Optional analytics, only with consent | To understand which pages are useful | Consent |
We do not buy personal data, we do not sell it, and we do not use your mail or your account data to train machine-learning models.
3. What the application stores about your mail
As processor, and only for as long as you keep the account connected:
- Metadata — participants, subjects, dates, folders, read state and a short snippet — kept while the account is connected. Mail older than your sync window is not copied in, unless a search you run finds it on your mail server; those messages are then kept the same way.
- Message bodies — cached for display and deleted after 30 days.
- Search text — a plain-text copy of each synced message (subject, people, attachment names and the words of the message, without formatting or images), kept so your mail stays searchable while the account is connected.
- Attachments — stored only when opened, under a private per-workspace path, and removed with the account.
- Tracking events — opens and clicks on mail you sent. Each one records the time, the IP address the request came from, the browser or mail client it reported, and the device, operating system and browser we read out of that. A one-way hash of the address is stored alongside it and is what we use to recognise a repeat of the same sighting. The address, the reported client string and the device details are deleted after 90 days; the hash and the record that the message was opened are kept.
- Contacts — built from your own correspondence.
- Mailbox credentials — OAuth tokens or IMAP passwords, encrypted at rest and never displayed again.
Disconnecting an account removes its credentials and its cached content.
4. Who we share it with
Only the sub-processors we need to run the service — hosting, payments, email delivery and error reporting — each under a contract that restricts them to our instructions. They are listed, with what they see and where they are, on the sub-processors page. We also disclose data where the law requires it; we will tell you unless we are legally prevented from doing so.
5. Where it is held
Application data is hosted in the United Kingdom. Where a sub-processor operates outside that area, the transfer relies on an adequacy decision or on standard contractual clauses. The sub-processors page names the location for each one.
6. How long we keep it
- Account and workspace data — while the account exists, then deleted within 30 days of the workspace being deleted.
- Cached message bodies — 30 days.
- Search text — while the account is connected; removed when you disconnect it or delete the workspace.
- IP addresses and device details on tracking events — 90 days, after which they are erased and the event keeps only the hashed address and a general client name such as "Outlook desktop".
- Security and audit records — up to 12 months, because they exist to investigate things noticed late.
- Invoices and accounting records — as long as tax law requires, typically six years.
- Backups — deleted data disappears from backups as those backups rotate out of retention.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can withdraw consent for analytics at any time from the cookie page. You can export your workspace's data yourself from settings, without asking.
Write to hello@warymail.co.uk. We will answer within one month. If the mail in question belongs to someone else's workspace we have to pass the request to them, because they are the controller of it — not us.
If you are not satisfied you can complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
8. Security
The controls we operate are described in plain terms on the security page, including what we do not claim. If we suffer a breach affecting your data we will notify you and the relevant authority as the law requires.
9. Children
WaryMail is a business product and is not intended for anyone under 16.
10. Changes
We will post any change here and, where it is material, tell you by email or in the application before it takes effect.