Privacy & data protection

Privacy Policy

This policy explains which personal data Oveyon processes, why, on what legal basis and for how long — and how you exercise your rights. It is written to meet the European GDPR, the U.S. CAN-SPAM Act and applicable state law, and — for Brazilian data subjects — Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018).

01Who we are

Oveyon is a customer-portfolio operations platform with built-in transactional email infrastructure, provided by Akamind Inc., a Delaware C-corporation ("Oveyon", "we"). Akamind Inc. is the controller for the personal data described in this policy. Registered office: contact legal@oveyon.com for the current registered address. We serve customers in the United States, Europe and Brazil, in accordance with the GDPR, CAN-SPAM and the LGPD as each applies.

02Controller and processor

Data-protection law — the GDPR and the LGPD alike — distinguishes who decides on the processing (the controller) from who carries it out on behalf of another (the processor). At Oveyon both roles exist:

• We are the controller of our customers' account data — registration, billing, authentication, platform security;
• We are the processor when a customer uses the platform to send messages to their own audience: the recipient data belongs to the customer, who is the controller. We process that data according to the customer's instructions and this policy.

If you are the recipient of a message sent by one of our customers and wish to exercise rights over your data, the primary point of contact is the sender (the controller). We can still help route your request — see Your rights.

03Data we process

The tax ID is validated by format and check digit and stored in normalized form. This is a format/PII validation, not verification against an official third-party registry.

04Legal bases

We process personal data on the following grounds (GDPR art. 6; LGPD art. 7):

• Performance of a contract — providing the service you signed up for;
• Compliance with a legal or regulatory obligation — including responding to authorities;
• Legitimate interest — information security, fraud and abuse prevention, and deliverability (authentication, reputation, suppression), always with an impact assessment and respect for your rights;
• Consent — where applicable, for example in non-essential communications.

05How we use the data

• Operate sending: authenticate (SPF, DKIM, DMARC), sign, deliver and correlate bounces and complaints;
• Protect the platform: compromised-account detection, rate limiting, content/URL scanning, sandbox and suppression;
• Maintain and demonstrate sending reputation with mailbox providers;
• Bill, provide support and meet legal obligations;
• Maintain an audit trail of actions performed on the platform.

We do not sell personal data and do not use it for third-party advertising.

06Message content

07Sharing and sub-processors

For service operations, we share data with the necessary providers under confidentiality and security obligations:

The same list — with the data each one reaches — is published at oveyon.com/sub-processors. Oveyon does not submit message content to AI models to provide the service. Our team may use AI tools to operate and maintain the system, under the same confidentiality obligations. Messages that arrive at our abuse mailbox — reports sent to Oveyon, not the traffic we carry for customers — are triaged automatically: local rules first and, for what they cannot classify, an excerpt goes to Anthropic in which email addresses, links, domains, IP addresses, long numbers and code-like strings are replaced by placeholders, including the obfuscated forms reports use (hxxp, [.]). What our local rules recognize as a machine-generated complaint report (ARF, X-ARF, SpamCop), as a report that carries the full source of the message it complains about, or as a message sent through our platform that came back to the abuse mailbox, including when forwarded, is never sent; a report written by a person may quote the message it complains about, and that quote goes masked like the rest. When the account owner connects an AI client such as Claude, ChatGPT or Grok through MCP, that client can send Oveyon the inputs needed for authorized tasks and request account data and message content through the tools and permissions granted in the connection. Oveyon returns the requested data to that client. The AI client provider has its own terms and privacy policy, which you should review before connecting. An account owner or administrator can revoke the connection in the Oveyon dashboard.

Telegram only receives data when you connect a Telegram chat to your account. On an inbound mailbox with the Telegram channel turned on, for every email that arrives, the Oveyon bot sends the chat you connected a notice with the sender, subject, recipient, arrival time and the SPF, DKIM and DMARC results. When the sender check allows it, the notice also carries the highlights: a one-time code and a confirmation link found in the email. Highlights are extracted on our servers, by fixed rules, without AI. The email body and the list of recent messages only go to the chat when you ask, and what you reply in the chat passes through Telegram before it becomes an email. Connected chats also receive the approval requests for held drafts — the recipient, the subject, the agent’s note and the beginning of the text (up to 600 characters) — and you approve or reject them there. Even from mailboxes without the Telegram channel, the account’s chats also receive: the notice from your inbound policies that notify (the policy’s name and note, with the message’s From, To and Subject); the notice of a held message when the mailbox has no channel to carry it (the mailbox, From, Subject, arrival time and the reason); the notice of a draft that expired without a decision (subject and recipient); and, if you choose a chat for them, the account notices (title and summary). Turning a mailbox’s channel off stops only that mailbox’s inbound-mail notices; everything stops when you disconnect the chat. The text of each notice is stored in our delivery queue and is deleted together with the stored copy of the message, within the same period.

We may also disclose data to comply with the law, a court order or a valid request from an authority — in those cases, the contact is legal@oveyon.com.

08International transfers

Akamind Inc. is U.S.-based. Processing and main storage are in the United States; sending nodes are in the United States and Romania; backup copies are kept in the United States and in Brazil. Some sub-processors operate in other jurisdictions (see sub-processors). Where personal data crosses borders, transfers follow the GDPR (standard contractual clauses and equivalent safeguards) and, for the data of Brazilian data subjects, the LGPD (art. 33), so that an adequate level of protection is maintained.

09Retention

• Account data — while the account is active and for the applicable legal period after closure;
• Sending metadata (envelope, headers, timestamps, outcome per recipient) — readable by you for your plan’s window, from 3 to 365 days, and purged automatically after 400 days;
• Content of the messages you send — archived only if you turn the archive on, for 30 days, then deleted;
• Messages you receive — the stored copy (body and attachments), 30 days, then deleted; in the mailbox quarantine, the period only starts when the message is released; held by a policy, the period keeps running while it is held and restarts when it is released. The record that the message arrived (sender, recipients, subject, date, Message-ID, the sending server’s IP and HELO, verdict and the list of attachments) stays in the account history for as long as the account exists — that record is not purged;
• Deliveries to the channels you turn on — what we build to deliver a received message to a channel is stored in our delivery queue: the Telegram or Slack notice and, for webhooks, the content the chosen mode includes — the body and, in the mode with attachments, the attachments that fit the delivery limit. These copies are deleted together with the stored copy of the message, within the same period;
• Notices at the return address of the messages you send (a mailing-list confirmation request, a moderation notice, someone replying to the envelope) — when the sender of the notice passes SPF or DMARC, we forward it as it arrived to the sender of your original message; the beginning of its text and selected headers, shown with that message in the panel, are deleted after 30 days. Out-of-office replies are kept the same way and are not forwarded;
• Replies you write to a received message (through the panel, Telegram, Slack or the API) — the snippet kept in the conversation history (the first 500 characters) is deleted after 30 days; the record of the reply (from, to, subject and date) stays;
• Drafts held for approval (sends or replies waiting for a person to decide) — the snippet of the text kept with the request (the first 600 characters) stays while the decision is pending and is deleted 30 days after it (approved, rejected or expired); the record of the request stays;
• API and MCP call logs (endpoint, status, time, duration, IP, user agent, the credential, and the request and response bodies with secrets redacted — message bodies and attachments only by size; in the MCP log, the connected application, the tool and the redacted arguments, without the tool result) — 180 days, then purged automatically;
• Messages sent to our own mailboxes (abuse@, postmaster@, privacy@, legal@ and the other role addresses of our domains) — the text and the headers of each message (sender, recipients, subject, date, Message-ID and the servers it passed through), 90 days, then purged automatically; the record of an abuse report (the sender’s address, the domain reported, the Message-ID of the report and our decision) is not purged automatically: it is kept to handle abuse and to show what was decided;
• Audit trail — never purged: the record of who did what does not expire;
• Suppression list — kept for as long as needed to avoid re-sending to those who unsubscribed or complained (protecting the data subject).

10Security

Technical and organizational measures we apply:

No system is completely secure. We adopt measures appropriate to the state of the art and the risk involved, but absolute security cannot be guaranteed.

11Your rights

As a data subject, under the GDPR (arts. 15–22) and the LGPD (art. 18) you may: confirm the existence of processing; access your data; correct incomplete or outdated data; request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; request portability; obtain information about sharing; and withdraw consent.

To exercise these rights, write to privacy@oveyon.com. We respond within 15 days. If you are the recipient of a message sent by one of our customers, direct your request to the sender (the controller); we can help route it. You may also lodge a complaint with your supervisory authority — your EU data protection authority, or the ANPD in Brazil.

12Cookies

In the portal and dashboard we use a strictly necessary session cookie (oveyon_sid), with the HttpOnly, Secure and SameSite attributes, to keep you authenticated. It is not used for advertising or cross-site tracking. The marketing site does not depend on cookies to function.

On the public website (oveyon.com and oveyon.com.br) we use Google Analytics 4 (Google LLC) to measure visits, pages viewed and clicks. We do not enable advertising features or Google Signals; the data is pseudonymous usage data (pages, clicks, device and browser, truncated IP address) and may be processed in the United States under Google's standard contractual clauses. The measurement script is not loaded when your browser sends the Do-Not-Track signal, and you can block it with a content blocker or by disabling JavaScript. The portal and dashboard are not measured.

The public website also keeps in your browser a copy of the pages you visit and an offline page, to show them when the network drops. None of this is sent to Oveyon, and all of it is removed when you clear the site's data in your browser.

13Changes

We may update this policy. The version in force is the one published on this page, with the date at the top. Material changes will be communicated to active customers.

Change history — 16 October 2026: retention of messages sent to our own mailboxes (abuse@, postmaster@ and the other role addresses) — text and headers for 90 days, and the record of an abuse report kept to handle abuse (§09). 15 October 2026: the automated triage of messages that arrive at our abuse mailbox, with addresses, links and numbers masked before an excerpt reaches Anthropic (§07); OpenAI joins Anthropic among the AI tools the team uses, and Hostinger and SMTP2GO left the list (§07); sending nodes in the United States and Romania (§08). 14 October 2026: the API and MCP call logs — what they keep and the 180-day period (§09). 12 October 2026: the AI tools used by the team described by the access they actually have (§07); Telegram added to the sub-processor list, with the notice channel, its highlights and the approval requests described (§07); who connects an AI client through MCP — the account owner (§07); retention of received messages detailed — what goes after 30 days, when the period starts in the mailbox quarantine and under a policy hold, what stays in the history and the copies in the channels’ delivery queue, which go together with the stored copy of the message, and the snippet of replies and held drafts, which goes after 30 days (§06, §07, §09); the copy of the pages you visit and the offline page that the public website keeps in your browser for when the network drops, never sent to Oveyon (§12). 11 October 2026: clarified data exchange through user-authorized MCP integrations (§07). 9 October 2026: retention periods stated in days (§09); the countries of processing, sending and backup named (§08); one sub-processor list, the same as the sub-processors page, now including the sending nodes and the AI agents used in operations (§07); the notice of incidents involving personal data (§10); requests from data subjects answered within 15 days (§11). 27 August 2026: audience measurement on the public website (Google Analytics 4) was added to §12. August 26, 2026: the controller for oveyon.com became Akamind Inc.; the international-transfers and supervisory-authority sections were updated accordingly. July 31, 2026: first publication.