mailsign365Privacy statement
Who is responsible
the operator of mailsign365 runs mailsign365. For the people who sign up and administer an account, we decide why and how their data is used, so we are the controller. For the employee data in a customer's Microsoft 365 directory, the customer decides and we process it on their instructions, so we are the processor. A data processing agreement for that is available on request.
What we process
| Data | Whose | Why |
|---|---|---|
| Name, work email, Entra object ID and tenant ID | Administrators who sign in | To let them in and to record who changed what |
| Organisation name, country, contact email, optional phone and registration number, and the message they write | People who request a trial | To decide on the trial and to reply |
| Name, job title, department, phone numbers, office and address, profile photo | Employees of a customer | To fill in their signature. Read from the customer's Microsoft 365 directory when a message starts, and kept in memory for up to one hour. |
| Mailbox addresses and display names that hold a licence, shared mailbox grants | Employees of a customer | To know which mailboxes may receive a signature |
| Signature templates, rules, settings, uploaded images, audit trail | The customer | To provide the service |
| Sender address, message type and recipient domains of messages being written | Employees of a customer | To choose the signature. Used for that request, not stored. |
| A log of emails we sent: recipient, subject, whether it was sent | Administrators | To show what was sent and to find problems |
| Technical logs: IP address, time and requested address | Visitors and users | To keep the service secure and working |
We do not read, copy or store the content of anyone's email.
Basis
We process this data to carry out the agreement with our customer, for our legitimate interest in running a secure service, and where the law requires us to keep records, for example for tax.
How long we keep it
- Templates, rules and settings: for as long as the organisation is connected, and for 60 days after a plan ends. Then we delete them. After a disconnect, we delete them when asked.
- Trial requests: for as long as the organisation has an account, and as needed afterwards to prevent a second trial.
- Invoices and payment records, once billing opens: as long as the tax rules require.
- Server logs: only as long as needed to run and secure the service.
Who else handles data
- Microsoft, for sign-in (Entra ID), for reading your directory (Microsoft Graph) and for sending our emails.
- Cloudflare, which sits in front of the website as a network proxy and for protection against attacks.
- Stripe, once paid subscriptions open, for payments and invoices.
We tell customers before we add another provider.
Cookies and tracking
This website sets no cookies and uses no analytics or advertising trackers. The admin portal stores your Microsoft sign-in in your browser, and the connection flow sets a short-lived cookie while you approve the app. Both are needed for the service to work.
Your rights
You can ask us for access to your data, to correct it, to delete it, or to export it. For employee data in a customer's directory, ask your employer first, because they decide about it. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Last updated 29 October 2026.