Account privacy
Account information, its uses, recipients and your rights, separately from data in your email audience.
Who processes account data?
SUCHET & BUTTIER, SAS, 102 avenue des Champs-Élysées, 75008 Paris, France — RCS Paris 802 240 341 is controller for processing needed to manage Mailie accounts, security, service administration and requests addressed to it. This is separate from its processor role for an audience managed by a customer.
Contact: contact@suchetbuttier.com. Postal address: 102 avenue des Champs-Élysées, 75008 Paris, France.
Information and purposes
Name, email address and account identifiers are used to prepare access, verify the address, sign in and manage rights. Language, timezone and notification preferences adapt the service. Organisation name, workspaces, roles and invitations organise teamwork.
Security information includes password hashes, two-factor credentials, sessions, limited authorisations and operation records. Support requests include information you choose to attach. Plan selection and usage information apply entitlements and limits; TEST documents remain labelled as such.
- Required for an account: name, valid address, password and acceptance of the terms version. Without them, creation cannot complete.
- Optional: marketing choices, unnecessary support attachments and editable preferences. MFA may be necessary for a privileged function, without becoming marketing permission.
Legal bases
Preparing and performing the requested service supports access, workspace management and account-related support. Preventing unauthorised access, fraud and abuse serves the legitimate interest of protecting the service and its users; information must remain limited to that purpose. Retention required by legislation is based on the relevant legal obligation.
Optional Mailie marketing relies on your separate choice where consent is required. Creating an account or accepting the terms does not subscribe you to a newsletter. You can change that choice in preferences or contact the company, without losing communications necessary for security and the requested service.
Who can access it?
Authorised members see information relevant to their organisation role. Authorised publisher personnel act for operations, support, security and applicable obligations within the necessary scope. Hosting and the technical providers used contribute to those operations; creating an account does not make its information public.
The legal notice describes OVHcloud hosting infrastructure. Sending messages uses transport and anti-spam filtering. Some external choices, including AI or payment, require function-specific information. TEST does not mean personal information is fictional. A provider’s headquarters, a local process or an IP address does not establish every processing country.
Cloud Linux Software, Inc.’s policy describes Imunify Email processing addresses, IPs, content and headers for security. Locations and safeguards applicable to our configuration still need confirmation.
Retention and ending use
Active account and team information follows the duration of requested access and its closure handling. Support information follows resolution and justified retention of its outcome. Closing an organisation and erasing its data are separate: a retention exception must be justified and limited to its purpose.
Verification links expire after one hour and reset links after thirty minutes. An application session is intended for twelve hours, and sensitive-action confirmation for five minutes. These authorisation periods do not mean every technical record is erased at the same instant.
Operation, objection, dispute and obligation evidence is handled according to its purpose and justified retention policy. Backups are separate from active data; their rotation and readmission after restore follow separate controls. Detailed operational periods still needing confirmation are identified in the processing-agreement annexes; neither immediate erasure nor unlimited retention is promised here.
Sign-in and security
Access checks, two-factor authentication and revocation limit sensitive use. Application session fields are minimised; this does not mean IP addresses never appear in hosting or mail logs. Automatic limits and security rules may block an operation; you can request review by explaining the problem without sharing secrets.
Your rights and recourse
You can request access, correction, erasure or restriction under the applicable conditions. Depending on the legal basis, you may also object, withdraw consent or request portability. Use available settings or the company contact. Only information needed to verify your identity and request should be requested.
Requests are answered within the GDPR period, normally one month, with any justified extension it permits. If the request concerns data processed for a customer organisation, contact that organisation; Mailie assists it as processor. You may lodge a complaint with the CNIL.