Last updated: 16 October 2026. Controller: Areli OS LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Contact: privacy@melunak.com.
Account data: the mailbox address, the owner's name and mobile number, an optional recovery email, and — for mailboxes created by an agent — the agent's name, contact details and the consent confirmation. Billing data: handled by Stripe; we store only the Stripe customer and subscription identifiers, never card numbers. Mail data: the contents of your mailbox, which we store so we can deliver the service. Technical data: IP addresses, login timestamps and server logs kept for security and abuse prevention.
To provide and bill the service, to send you account and security notices (including the one-time handover SMS), to prevent spam and abuse, and to comply with law. We do not read your mail except as needed to operate automated spam and virus filtering, to investigate an abuse report, or when you ask us to for support.
We do not show advertising, profile you, sell or rent your data, or scan your mail for marketing.
Where an agent creates a mailbox for a client, the agent receives only the mailbox address and billing status. The agent cannot access mail contents and loses all access when the client sets a password. The client may ask us at any time to confirm who created their mailbox and when consent was recorded.
On servers in Singapore, encrypted in transit (TLS) and at rest. Daily backups are kept for 30 days.
Stripe (payments), Twilio (SMS), our hosting provider, and authorities where legally required. Each processor is bound by contract to use data only to provide their service to us.
Mail is kept while your subscription is active and for 90 days after cancellation, then deleted. Account and consent records are kept for 3 years after closure for dispute and legal purposes. Logs are kept for 90 days.
You can export all mail from Settings at any time, correct your details, delete your account, or request a copy of the data we hold. Email privacy@melunak.com; we respond within 30 days. Depending on where you live you may also have rights under GDPR, Malaysia's PDPA, or similar laws, and may complain to your local regulator.
We will notify you by email of material changes at least 14 days before they take effect.