Privacy policy

The short version

• Your email is yours. We store it to deliver it to you, and for no other reason.
• We do not read your mail, show you ads, or sell or rent any information about you.
• Your mail is stored on a dedicated server in Québec, Canada, that Velto runs itself. Backups are kept in Canada. Every outside provider we use is listed on our trust page.
• You can export your data or ask us to delete it at any time.

What we collect

Account information: the email address you sign up with (it also receives your account’s storage, security and renewal notices unless you change it), your name and business name if you give them, the people you add to your dashboard, and the domains you connect.

Mailbox contents: the messages, attachments, contacts and calendars stored in your mailboxes.

Service records: sign-in times, IP addresses, and delivery logs for messages sent and received, kept so we can secure the service and investigate delivery problems and abuse. To block automated sign-ups, we keep a scrambled (hashed) record of recent sign-up attempts.

Billing: payments are processed by Stripe. We never see or store your full card number.

Moving from another provider: if you ask us to copy your mail from another provider, we use the sign-in details for your old account, or the export files you upload, only to copy your mail into Velto. Sign-in details are kept encrypted and erased when the move ends. Uploaded files are deleted once imported, and within 7 days at most.

The Velto app: if you install it and turn on notifications, we keep your device’s notification address and a count of unread messages per mailbox, so we can tell the device when new mail arrives. The dashboard records only its own setup steps, such as a domain being verified or the app being installed, never what you read or write.

How we use it

To run the service: deliver and store your mail, filter spam, keep accounts secure, bill you, and answer support requests. Automated systems filter messages for spam. People at Velto Mail do not read your messages unless you ask us to as part of a support request, or the law requires it.

Where it is stored

Mailbox contents, account and billing records, and backups are stored in Canada: on Velto’s own server in an OVHcloud datacentre in Québec, in a Supabase database in Canada Central, and in Backblaze backups in Canada East. Outgoing mail is relayed by Amazon SES in Canada Central.

A few providers we rely on process limited information outside Canada:

• Stripe processes payments: billing name, email and address, and invoices.
• Resend, in the United States, sends our account emails (sign-in links, receipts and notices). It receives the recipient’s address and the text of those notices, never mailbox content.
• Vercel runs this website and the dashboard in Canada, and delivers pages through its worldwide network. Your mail does not pass through Vercel.
• Cloudflare provides DNS for Velto’s own domains, and for customers who choose Velto DNS hosting.
• New-mail notifications on installed devices pass through the push services of Apple, Google, Mozilla or Microsoft. They show the sender and subject, never the message body, and are encrypted so the push service cannot read them.
• Mail you send is delivered to each recipient’s mail server, wherever that is. Mail you receive passes through the sender’s provider first.

We choose providers that protect your information under contract. The trust page lists every one of them and what each handles, and we email account owners before adding or replacing one.

How long we keep it

• Mailbox contents are kept for as long as your mailbox is active.
• When you cancel a mailbox, it keeps working until the end of the period you paid for. Its mail is then kept 30 days (Compliance plan: 90 days), exportable throughout, and then permanently deleted. Backup copies of that mail expire within a further 30 days.
• If you remove a domain, its mailboxes stay read-only for 30 days so you can export them, and are then deleted.
• Delivery logs are kept for up to 90 days. Database backups (account records, not mail) are kept for up to 90 days.
• Sign-ups that are never confirmed are deleted after a few days.
• Billing records are kept as long as tax law requires.
• If the law requires us to preserve information, for example under a court order, we keep it until that requirement ends.

Your choices

You can export every mailbox at any time, correct your account information, or ask us to delete your account. To make a request, or if you have a question or complaint about privacy, email privacy@veltomail.com or write to us at the address under “Contact” below. You may also contact the Office of the Privacy Commissioner of Canada.

This website

This website uses no analytics, advertising trackers, third-party scripts or tracking cookies. It may set a cookie that remembers the language you chose, and signing in to the dashboard sets the cookies needed to keep you signed in. It uses no third-party fonts: its typeface is served from this website itself. If you email us, we use your message only to reply to you.

Changes

If we make material changes to this policy, we will tell account holders by email before they take effect.

Contact

Privacy officer: privacy@veltomail.com

Mail: Velto Corp., Attn: Privacy, 80 Mapleton Road, Suite 11-165, Moncton, New Brunswick E1C 7W8, Canada