Privacy Policy

1. Scope

This Privacy Policy explains how Mailrun Partners, LLC (“Mailrun,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information in connection with mailrun.ai, our customer relationships, and our outbound email infrastructure services (collectively, the “Services”). This policy is a notice about our privacy practices; it is not a substitute for any consent required by applicable law.

2. What We Do

Mailrun provides outbound email infrastructure, including domains, mailboxes, DNS configuration, warm-up, monitoring, and related operational support. We do not create or send customer campaigns. Customers control their communications and are responsible for their recipient data and use of the infrastructure.

3. Information We Collect

Depending on how you interact with Mailrun, we may collect:

• Account and order information: name, business email address, telephone number, company name, billing address, account details, selected plan, order information, and subscription status.
• Payment and transaction information: Stripe processes payment card and payment-method details. Mailrun does not receive complete payment-card numbers. We receive transaction information such as payment status, amounts, currency, Stripe identifiers, billing contact information, refunds, and disputes.
• Contact and support information: information submitted through our contact form or in other communications, including your name, email address, company, message, source page, referrer, user agent, submission time, and a salted hash of the IP address used to submit the form. Mailrun does not store or forward the raw IP address as part of a contact-form submission.
• Service and infrastructure information: domains, mailboxes, DNS records, configuration data, provider identifiers, integration information, and credentials or access tokens you choose to provide where needed to deliver the Services.
• Agent identity phone, voice and message information: phone numbers; call direction, caller and called numbers, timestamps, duration, status and outcome; speech converted to text, call summaries and optional transcripts; optional returning-caller summaries linked to phone numbers, including names given, reasons for calling and preferences; voicemail recording identifiers, status and transcription text; customer-provided greetings and knowledge files; and email content and metadata, including addresses, timestamps, delivery status and identifiers. Hosted agents may also collect a caller's name, number and message for delivery to the customer by email and webhook, transfer calls to customer-configured numbers, and, if enabled by the customer, send plain-text emails to addresses callers provide.
• Operational information: authentication, delivery, bounce, complaint, blocklist, warm-up, reputation, and other technical signals used to provision, monitor, secure, support, and protect the Services.
• Website and device information: IP address, browser and device information, request and access times, referring pages, and similar server-log or security information generated when you visit or use the Services.
• Communications: emails, support requests, feedback, and other communications between you and Mailrun.

4. Sources of Information

We collect information directly from you; from your employer, agency, account administrator, or other authorized user; automatically when you use the website or Services; from Stripe and other service providers involved in delivering the Services; and from the infrastructure and provider systems that Mailrun operates on your behalf.

5. How and Why We Use Information

We use personal information to:

• Provide, provision, operate, maintain, and support the Services;
• Process orders, payments, subscriptions, renewals, refunds, and account changes;
• Authenticate users and protect accounts, systems, customers, and providers;
• Monitor infrastructure health, deliverability, abuse, fraud, and security events;
• Use AI models to generate hosted voice agents' replies, and automated rules and third-party AI safety services to screen outbound email and hosted-call turns for abuse, fraud and unsafe actions;
• Respond to inquiries, support requests, complaints, and legal requests;
• Communicate service, billing, security, and policy updates;
• Improve and troubleshoot the Services;
• Comply with legal obligations and enforce our agreements; and
• Send marketing communications where permitted, subject to applicable opt-out and consent requirements.

Where applicable law requires a legal basis, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in operating and protecting the Services, and consent where required. The appropriate basis depends on the information and the purpose for which it is used.

6. Customer Brand and Use-Case Information

As described in our Terms of Service, Mailrun may use a customer's company name, logo, and general description of its use case in marketing materials, case studies, testimonials, sales materials, or our client portfolio unless the customer opts out through our contact form.

7. How We Disclose Information

We may disclose personal information to:

• Payment providers: including Stripe, which processes checkout, payments, billing, fraud prevention, refunds, and disputes. Stripe's privacy practices are described in its Privacy Policy.
• Service providers: hosting, cloud, registrar, mailbox, DNS, security, communications, customer-support and professional-service providers that help us operate the Services, including a telephony carrier that provisions numbers, routes calls, converts speech to text and replies to synthesized speech in real time, and records and may transcribe voicemail. Knowledge files and extracted text are stored with our telephony/relay service provider using cloud storage; our database keeps only file metadata.
• AI model and safety providers: Anthropic receives the text of each hosted-call turn to generate replies. Third-party AI safety services may receive only the information needed to screen outbound email or hosted-call turns, such as the message being screened or the latest turns.
• Your organization: account owners, administrators, and other authorized users associated with your organization or customer account.
• Authorities and affected parties: when required by law or when reasonably necessary to protect rights, safety, security, the Services, our providers, customers, or third parties.
• Transaction participants: actual or prospective parties and advisers involved in a financing, merger, acquisition, reorganization, or sale of all or part of our business, subject to appropriate confidentiality protections.

Mailrun does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not use advertising trackers on the Mailrun website as of the date of this policy.

8. Cookies and Similar Technologies

Mailrun and its service providers may use cookies or similar technologies that are necessary to provide, secure, and operate the website and Services. Embedded Stripe Checkout may use cookies and similar technologies for checkout, fraud prevention, security, and optional Stripe services such as Link. If Mailrun introduces non-essential analytics or advertising technologies, we will update this policy and provide any notice or choice required by applicable law.

9. Retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy. The retention period depends on the nature of the information, the duration of the customer relationship, operational and security needs, applicable limitation periods, provider requirements, and legal, tax, accounting, dispute-resolution, and recordkeeping obligations. We may retain limited information after an account closes when necessary for those purposes or to maintain suppression, fraud-prevention, and security records.

For agent identities, transcript and email-subject retention is off by default; if enabled, both are deleted after 30 days. Otherwise, transcripts are discarded after calls end; only short call summaries remain. Hosted-call summaries are kept for 90 days. Returning-caller memory is separately optional and off by default: we retain the last five summaries per caller number per identity, delete them after 90 days or when the identity is released, and load them only when caller ID passes carrier authentication. Email content uses encrypted, short-lived storage needed for delivery; message metadata is kept for up to 13 months and account event logs for 90 days. Knowledge files and extracted text are deleted with the file or identity; greetings are deleted with the identity. We do not record call audio. Voicemail is recorded by the carrier and delivered to the customer; Mailrun does not archive that audio.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. No system or transmission method is completely secure, and we cannot guarantee absolute security. Customers are responsible for protecting their account credentials and promptly reporting suspected unauthorized access.

11. International Processing

Mailrun is based in the United States, and we and our service providers may process information in the United States and other countries where we or they operate. When applicable law requires safeguards for an international transfer, we use an appropriate transfer mechanism or other legally recognized safeguard. You may contact us for additional information about safeguards applicable to your information.

12. Privacy Rights and Choices

Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of, deletion of, or portability of your personal information; to restrict or object to certain processing; to withdraw consent where processing is based on consent; or to appeal a decision concerning a privacy request. You may also have the right to complain to an applicable privacy or data-protection authority.

California and certain other U.S. state laws may provide additional rights when their requirements apply to Mailrun and the individual making the request. Mailrun will not discriminate against an individual for exercising an applicable privacy right.

To make a request, opt out of Mailrun marketing, or ask a privacy question, use our contact form. We may need to verify your identity, authority, account, or request before acting. Some information may be exempt from a request or retained where permitted or required by law.

13. Customer-Controlled Data

Customers are responsible for providing any notices and obtaining any rights, permissions, or legal bases required for personal information they or their users process through Mailrun-provided infrastructure. Where Mailrun processes personal information on a customer's documented instructions as a processor or service provider, the customer's privacy policy and agreement with Mailrun govern that processing. Individuals should direct requests concerning customer-controlled data to the relevant customer first.

Connected apps. A customer may connect a third-party application, such as Anthropic's Claude, to their Agent Identities account by signing in with their Mailrun account (OAuth). When they do, we record which application connected, the permissions the customer allowed, and when the connection was created and last used, and we keep a log of sign-in, renewal and disconnection events for security purposes. Sign-in credentials issued to the application are stored only as one-way hashes. The application can access the customer's account data only within the permissions the customer allowed, and the customer can revoke the connection at any time from the portal. Information the application retains from that access is governed by the application provider's own privacy policy.

Agent identity calls and email. Callers and email correspondents are third-party individuals whose personal information Mailrun processes as a processor or service provider on the customer's instructions. Customers using their own software to answer calls receive callers' speech as text through their webhook. Hosted voice agents announce that they are AI assistants at the start of inbound calls unless the customer disables that announcement, and always on outbound calls. Customers are responsible for required caller notices and legal bases, including applicable recording and AI-disclosure requirements. Knowledge files must contain only information the customer is willing to share with any caller and must not contain confidential data.

14. Children's Privacy

The Services are intended for business users and are not directed to individuals under 18. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this policy to reflect changes in our practices, Services, or legal obligations. We will post the updated policy and revise the date above. When required by law, we will provide additional notice or obtain consent for a material change.

16. Contact Us

Mailrun Partners, LLC
30 N. Gould St, Suite R
Sheridan, WY 82801
Contact: mailrun.ai/contact