Privacy Policy

1. Data we collect

Account and profile data

When you register or connect a mailbox, we collect your name, email address, and optional details such as recovery email, recovery phone, date of birth and gender where you provide them, along with your password in hashed form.

Connected mailbox data

If you connect an external mailbox, we collect the server settings (IMAP/SMTP host and port) and store your mailbox credentials or app password in encrypted form, solely to operate the Services you request.

Usage and device data

We collect log data, device and browser information, IP address, and interactions with the Services to secure, maintain and improve them.

Customer content

We process the campaigns, messages, templates and contact lists you create or upload. This may include personal data about your recipients, which you control.

2. How we use data

• To provide, operate, secure and maintain the Services.
• To send, sync and display your email and messages, including through connected mailboxes.
• To process payments and manage subscriptions.
• To provide support and respond to your requests.
• To monitor deliverability, detect abuse, fraud and security threats.
• To comply with legal obligations and enforce our terms.
• To send you service, security and (where permitted) product communications.

3. Legal bases for processing

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of our contract with you; your consent (which you may withdraw at any time); our legitimate interests in operating and securing the Services; and compliance with legal obligations.

4. How we share data

We do not sell your personal data. We share data only as needed to run the Services:

• With service providers and sub-processors (for example hosting, email delivery infrastructure, SMS carriers and payment processors) under appropriate contractual safeguards.
• With your email provider when you connect an external mailbox, to the extent required to deliver and sync messages.
• When required by law, legal process, or to protect the rights, safety and security of Tcom, our users or the public.
• In connection with a merger, acquisition or sale of assets, subject to this policy.

5. Data retention

We retain personal data for as long as your account is active and as needed to provide the Services, then for a reasonable period afterwards to comply with legal obligations, resolve disputes and enforce agreements. You can request deletion as described below.

5a. Account and data deletion

This section applies to the Tcom Mail app, published by Tcom. You can request deletion of your Tcom (Tcom Mail) account and associated personal data at any time.

How to request deletion

• Go to our Contact page at tcom.app/contact.
• Choose “Data Deletion Request” as the Request Type.
• Enter the email address associated with your Tcom account and submit the form.
• Alternatively, email [email protected] from your account email with the subject “Data Deletion Request”.
• Signed-in users can also delete their account from the dashboard account settings.

We verify ownership of the account and process verified deletion requests within 30 days.

Data that is deleted

Upon a verified request we permanently delete: your profile and account details, connected mailbox credentials and settings, mailboxes and message content, contacts and contact lists, campaigns, templates, forms, and uploaded files and media.

Data that is retained

We may retain a limited set of data where the law requires or permits it: billing, invoice and tax records for up to 7 years as required by financial regulations; security, audit and abuse-prevention logs, kept in anonymized or aggregated form; and any records needed to resolve disputes or enforce our agreements. Retained records are isolated and are not used to re-create your account.

6. Security

We use technical and organisational measures to protect personal data, including encryption of sensitive credentials, access controls and monitoring. No method of transmission or storage is completely secure, but we work continuously to protect your information. If you discover a vulnerability, please see our Responsible Disclosure policy.

7. Your rights and choices

Depending on your location, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. You can exercise many of these rights directly in your account settings, or by contacting us.

Recipients of our customers' messages can unsubscribe using the links in those messages, or by contacting the sender. If you believe a Tcom customer has misused your data, you may also contact us at [email protected].

8. International transfers

We may process and store data in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

9. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure usage and improve the Services. You can control cookies through your browser settings; disabling some cookies may affect functionality.

10. Children

The Services are not directed to children under 16 (or the minimum age in your jurisdiction) and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and, for material changes, provide additional notice where appropriate.

12. Contact us

For privacy questions or to exercise your rights, contact our team at [email protected].