Privacy Policy

1. Who We Are and Scope

CleanerFlow LLC, doing business as Mailmundo, is a California limited liability company operating on U.S. soil, billing in U.S. Dollars, and providing email-marketing infrastructure to service businesses. We act as the data controller (and, where applicable, the "business" under U.S. state law) for information we collect about our own customers, leads, and site visitors. When our customers use the Service to send campaigns to their own audiences, those customers are the controllers of the recipient data they import, and Mailmundo acts solely as their processor/service provider, processing such data only on documented instructions as set out in our Data Processing Addendum (DPA), which is incorporated by reference. This Policy covers the former relationship; the DPA governs the latter.

2. Personal Information We Collect

Account and identity data: name, business name, email address, phone number, username, and authentication credentials (passwords are stored only as salted hashes; API keys are stored hashed). We also keep a record of your acceptance of our Terms of Service, Acceptable Use Policy and Privacy Policy: which document and version you accepted, the language, how you signed up (sign-up form or Google), and the date and time. Billing data: billing contact, address, and payment-card or bank metadata, which is collected and processed by our payment processor, Stripe; we do not store full card numbers. Usage and technical data: IP address, device and browser identifiers, log data, pages viewed, feature interactions, campaign-performance metadata (sends, opens, clicks, bounces, complaints, unsubscribes), and audit-log records of security-relevant actions. Communications data: support tickets, emails, and survey responses. Contact-list data: the recipient records our customers upload (email addresses, names, custom fields, engagement events) are processed by us only on behalf of the customer and are governed by the DPA. We may also receive data from third-party integrations, analytics providers, and publicly available sources.

Mobile app data: if you use the Mailmundo app for iPhone or Android, we also process the profile photo, phone number and address you choose to add to your profile; a code that identifies your device for push notifications, together with your notification preferences, your language and your device platform; which app screens you open and which features you use; and app error reports, sent through Sentry without your name or email address. Face ID, Touch ID and fingerprint unlock are checked only on your phone: we never receive your face or fingerprint. When you scan a business card, the photo is read on your phone and never uploaded; only the contact details you decide to save reach us. If you delete your account, we ask for the reason, and we store what you write.

3. How We Use Personal Information

We use personal information to: (a) provide, operate, secure, and maintain the Service; (b) create and administer accounts, authenticate users, and store hashed credentials and API keys; (c) process payments in USD and manage billing, invoicing, taxes, and collections through Stripe; (d) deliver email, maintain suppression and one-click-unsubscribe mechanics, manage deliverability through AWS SES, and combat spam and abuse; (e) monitor, log, and audit activity for fraud prevention, security, and compliance, including maintaining our audit log; (f) provide customer support and respond to inquiries; (g) analyze and improve the Service and develop new features; (h) send transactional, administrative, and—where permitted—marketing communications, from which you may opt out; and (i) comply with legal obligations and enforce our agreements. We do not sell personal information for money, and we do not engage in cross-context behavioral advertising that would constitute a "sale" or "share" under applicable U.S. state law; if this ever changes, we will update this Policy and provide the required opt-out.

4. Legal Bases for Processing

Where the EU/UK GDPR or similar laws apply to our processing of your personal information as a controller, we rely on the following legal bases: performance of a contract (to provide the Service you request and administer your account and billing); legitimate interests (to secure the Service, prevent fraud and abuse, maintain audit logs, analyze and improve our offerings, and conduct direct marketing to business contacts, balanced against your rights); consent (where required, such as certain cookies or optional marketing, which you may withdraw at any time); and compliance with legal obligations (tax, accounting, and lawful requests). Where we act as a processor on behalf of a customer, the customer is responsible for establishing the lawful basis for its processing of recipient data.

5. Your U.S. State Privacy Rights (California and Other States)

Depending on your state of residence, you may have rights under comprehensive state privacy laws, including the California Consumer Privacy Act as amended by the CPRA, and the consumer privacy laws of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states including Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, and Tennessee, as each becomes effective. Subject to verification and statutory exceptions, these rights may include: the right to know/access the categories and specific pieces of personal information we have collected; the right to delete; the right to correct inaccurate information; the right to data portability; the right to opt out of any "sale" or "sharing" of personal information and of "targeted advertising" and certain "profiling"; the right to limit use of sensitive personal information; and the right to non-discrimination for exercising your rights. California residents are also entitled to the "Shine the Light" disclosure regarding sharing for third-party direct marketing.

6. How to Exercise Your Rights

To submit a request, contact us at the email address in the "Contact" section below and identify the right you wish to exercise. We will verify your identity using information associated with your account before fulfilling a request and will respond within the timeframes required by applicable law (generally 45 days under most U.S. state laws, extendable as permitted). You may use an authorized agent where the law allows. If we deny a request, you may appeal by replying to our decision; where a state law provides an appeal mechanism, we will inform you of the outcome and, if denied, of your right to contact your state attorney general. We do not charge a fee for most requests unless they are excessive, repetitive, or manifestly unfounded. If you are an end recipient of a customer's campaign, please direct access/deletion requests to that customer (the controller); we will assist them as their processor.

You can also delete your account yourself, in the app (Account → Delete account) or on the website. Our account deletion page, mailmundo.com/delete-account, explains each step and what happens to your data.

7. International Visitors—GDPR and LGPD

Mailmundo is based in the United States, and your personal information will be processed in the United States and other jurisdictions that may not provide the same level of data protection as your home country. Where the EU/UK GDPR applies to us as a controller, you have rights to access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with a supervisory authority; where we rely on consent, you may withdraw it at any time. Where Brazil's LGPD applies, you have analogous rights to confirmation, access, correction, anonymization, portability, deletion, and information about sharing, and may contact the ANPD. For transfers of personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) where required. International customers are responsible for ensuring they have a lawful basis and any necessary transfer mechanism for recipient data they route through the Service.

8. How We Share Information and Sub-Processors

We share personal information with: (a) service providers and sub-processors that perform functions on our behalf under contractual confidentiality and security obligations, listed at mailmundo.com/sub-processors; (b) professional advisors (legal, accounting, audit); (c) authorities and third parties where required by law, to respond to lawful requests, or to protect rights, safety, and the integrity of the Service; and (d) acquirers or successors in connection with a merger, financing, reorganization, or sale of assets, subject to this Policy. We maintain a list of sub-processors used to process customer data and will provide notice of material changes as described in the DPA. We do not sell personal information for monetary consideration.

9. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, and thereafter only as necessary to comply with legal, tax, accounting, and audit obligations, resolve disputes, prevent fraud and abuse, enforce our agreements, and maintain the integrity of our audit and suppression records. Suppression-list and unsubscribe data are retained as long as necessary to honor opt-outs and demonstrate anti-spam compliance. Hashed credentials and API keys are deleted or rotated in accordance with security practices. Recipient data processed on a customer's behalf is retained and deleted in accordance with the customer's instructions and the DPA. When information is no longer required, we delete, anonymize, or aggregate it. Acceptance records are deleted together with your account.

When you delete your account, your account is closed as soon as you confirm, and you can cancel by signing in during the next 30 days. After 30 days we delete your login, your profile (name, phone number, address and photo), your devices, your notification preferences and your app usage records. Your workspace stops working on that day, and its content (contacts, campaigns, templates and sending history) is deleted within one year. Records we must keep by law or to fight spam and fraud follow the rules above.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, database row-level security (RLS) on our PostgreSQL/Supabase backend, storage of passwords and API keys as one-way hashes, access controls and least-privilege principles, audit logging of security-relevant events, and reputable infrastructure providers (AWS, Supabase, Stripe). Mailmundo is not currently SOC 2 certified; achieving SOC 2 is on our roadmap, and we do not claim any certification we have not obtained. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you are responsible for safeguarding your credentials and API keys and for promptly notifying us of any suspected compromise.

11. Cookies and similar technologies

Our website stores only what it needs to work: cookies that keep you signed in and remember your language and workspace, your light or dark theme, and the link or campaign that first brought you here (saved in your browser and added to your account when you sign up). We don't use advertising or third-party tracking cookies, so there's nothing to opt out of. If we ever add them, we'll ask first and honor Global Privacy Control.

When you sign up, Cloudflare Turnstile checks that you're not a bot, and your browser computes a device code that helps us spot fake accounts. If you choose "Continue with Google," Google shares your name and email with us.

Campaigns you send may include open and click tracking; recipients can block images in their email app.

12. Children's Privacy

The Service is intended for businesses and is not directed to children. We don't knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it. Customers must not use the Service to send marketing to individuals from whom such marketing is prohibited by law, including children where consent or other requirements apply.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Service. We will post the revised version with an updated effective date and, where required by law or where changes are material, provide additional notice. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact Us

For privacy questions, requests, or complaints, contact CleanerFlow LLC (d/b/a Mailmundo) at privacy@mailmundo.com (or the contact address published on our website). Please include enough detail for us to verify your identity and respond. If you have an unresolved concern, you may also contact your state attorney general or, for international users, your local supervisory or data protection authority.