Privacy Policy
This policy explains how Adimyra Systems ("we", "us"), the operator of the adiMAIL by Adimyra email service at mail.adimyra.in, collects, uses and protects your personal data. We process personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it, and the Information Technology Act, 2000 and its rules.
What we collect
- Account details: your name, email address, phone number (if verified), recovery email and password (stored only as a one-way hash).
- Mail you send and receive: message contents, attachments and metadata needed to deliver and store your mail.
- Your address book: contacts you add or import (names, email addresses, phone numbers, company, notes and photos), and the addresses you write to, which we suggest when you compose.
- Billing details for business plans: legal name, GSTIN, billing address and billing email. Card and UPI details are handled by our payment partner, Razorpay; we never see or store full card numbers.
- App details: if you use the adiMAIL by Adimyra phone app and allow notifications, a push token for each device, so we can tell it about new mail.
- Technical data: IP addresses, device and browser type, sign-in times and security logs.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Provide and secure your mailbox | Account, mail, address book, technical | Your consent and the contract |
| Billing and invoices | Billing details | Legal obligation |
| Prevent spam, fraud and abuse | Technical, mail metadata | Legitimate use |
| Service and security notices | Email address | The contract |
We do not show ads, sell your data or read your mail to profile you. Automated systems scan incoming mail for spam and viruses only.
Google services
If you choose to use them, we connect to Google on your behalf:
- Sign in with Google asks Google for your basic profile (the
openid,emailandprofilescopes): your name, email address and Google account ID. We use them only to sign you in and to fill in your name. - Import contacts from Google asks for read-only access to your Google Contacts (the
contacts.readonlyscope). We read your contacts once, add them to your address book and do not keep the access token. - Server backups to Google Drive (used only by the operator of this server, never by customers): access to the files the app itself creates in the operator's Drive (the
drive.filescope). The access token is stored encrypted, and every backup is encrypted before it is uploaded.
adiMAIL by Adimyra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never use Google user data for advertising, never sell it, and never let people read it except with your permission, for security, or when the law requires it.
Service providers
We share data only with the service providers we need to run the service, and only what they need:
- Razorpay processes payments for business plans.
- Google Firebase sends the text-message codes that verify your mobile number (Firebase Authentication) and delivers push notifications to the phone app (Firebase Cloud Messaging).
- Google for the optional services above.
We also share data with authorities when Indian law requires it.
Cookies
We use only cookies that the service needs to work. We use no advertising or tracking cookies.
| Cookie | What it does | How long |
|---|---|---|
adimail_session | Keeps you signed in | Until you sign out, at most 30 days |
adimail_sessions | Remembers the other accounts signed in on this browser | 30 days |
adimail_google | Protects the Sign in with Google step | A few minutes |
adimail_gcontacts | Protects the Google Contacts import step | A few minutes |
adimail_drive, adimail_setup, adimail_setup_review | Server set-up and Google Drive connection (operator only) | A few minutes to a few hours |
Your browser's local storage keeps display preferences such as the theme and layout. They never leave your device.
Where your data is stored
Your mail and account data are stored on servers operated by us.
How long we keep it
- Mail and account data: while your account is active. When you close or delete your account, it is purged 30 days later.
- Server backups: local backup bundles are kept for at most 90 days. Copies sent to Google Drive are encrypted before they leave our server and are deleted as newer ones arrive.
- Mailbox backups you can download: the latest few days, and never longer than 90 days.
- Sign-in history: 90 days.
- Delivery logs of sent mail: 30 days.
- Audit and security logs: one year, and never less than the 180 days required by CERT-In.
- Invoices and credit notes: as long as tax law requires, even after your account is closed.
Your rights
Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to exercise these rights on your behalf. You can download your mail from Settings → Backup and close your account from Settings (business owners: Admin → Plan and billing). You can also raise a grievance with us, and if it is not resolved, with the Data Protection Board of India.
Grievance Officer
As required by the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:
- Name: Grievance Officer, Adimyra Systems
- Email: care@adimyra.in
- Address: Adimyra Systems, India
We acknowledge a complaint within 24 hours and resolve it within 15 days.
Security incidents and data breaches
We report cyber security incidents to CERT-In within 6 hours of noticing them. If a personal data breach affects you, we tell you and the Data Protection Board of India without delay: what happened, when, the likely impact, what we are doing about it and what you can do to protect yourself. We send the Board a detailed report within 72 hours.
Changes
We post changes here. When a change is significant, we email account holders and ask you to accept the new version the next time you sign in.
Last updated