Privacy Policy
The short version. We keep your email so you can read it. We do not read it to sell you things. Advertising on the free tier is our own products and offers from businesses we work with, chosen from your relationship with Compendium — never from the contents of your messages. We do not sell your personal information, and advertisers never receive it. You can see, export and delete your data.
1. Who we are
The Compendium Company, Inc., 999 Vanderbilt Beach Road, Suite 200, Naples, Florida 34108, is the controller of the personal information described here. Contact: [email protected].
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email address, password (hashed), recovery address, two-factor settings, plan | To create and secure your mailbox |
| Your content | Messages, attachments, drafts, contacts, calendar entries, folders, signatures | To deliver, store and show you your mail |
| Mail metadata | Sender and recipient addresses, subject, timestamps, size, routing headers, spam scores | To route mail, filter spam and malware, and show your message list |
| Usage | Sign-in times, IP address, browser and device type, app version, pages and features used, crash and error logs | To operate the Service, investigate abuse, and improve it |
| Advertising signals | Which Compendium products you use, your plan, general engagement, coarse location (country or region) | To choose which of our own or our partners' offers to show on the free tier |
| Support | What you send us when you ask for help | To answer you |
| Payment | Billing contact and subscription status. Card details go directly to our payment processor; we never see the full number | To bill paid features |
3. What we do not do
- We do not read your message content, subjects or attachments to target advertising.
- We do not sell your personal information, and we do not share it with third parties for their own marketing. Under California and similar state laws, we do not "sell" or "share" personal information for cross-context behavioural advertising.
- We do not give advertisers your identity. We show their offers to you; they receive aggregate counts, not you.
- We do not use your content to train machine-learning models.
Automated systems do process your mail to run the Service — delivery, spam and malware filtering, your own rules and searches. That is operating an email service, and its results are not used for advertising.
4. Why we may lawfully use it
- To perform our agreement with you — running your mailbox.
- Our legitimate interests — securing the Service, preventing abuse and fraud, improving the product, and marketing our own related products.
- Your consent — for non-essential cookies and similar technologies, and for anything we have said we will ask permission for.
- Legal obligation — where the law requires us to keep or disclose something.
5. Cookies and similar technologies
We use a small number of cookies. Strictly necessary ones — your session, security, and your saved preferences — are always on, because the Service cannot work without them. Anything beyond that is off until you turn it on, and you can change your mind at any time from Settings → Privacy & cookies in the app, or on the cookies page. Full detail and the current category list are there.
6. Who we share it with
- Infrastructure and service providers who process data on our instructions under contract — cloud hosting and storage (Amazon Web Services, in the United States), our outbound mail relay, and our payment processor. They may not use your data for their own purposes.
- The people you email. Mail you send leaves our systems by design.
- Legal. If we are compelled by valid legal process, or where disclosure is necessary to protect rights, safety or the integrity of the Service. Where we are permitted to tell you, we will.
- Business transfer. If Compendium is acquired or merged, information may transfer as part of that transaction; this policy travels with it until superseded.
7. Where it lives, and how long
Data is stored in the United States. Mail stays until you delete it or close your account. Deleted mail leaves the Trash on its normal cycle and leaves encrypted backups as those age out (normally within 30 days). Server and security logs are kept for up to 12 months. Records of your consent choices are kept for as long as we rely on them, plus a reasonable period afterwards, so we can show what you agreed to and when. Free accounts inactive for 12 months may be closed and deleted after at least 30 days' warning.
8. Security
Mail is encrypted in transit (TLS) and at rest. Backups are encrypted before they leave our servers. Access to production systems is restricted and audited, sign-in supports two-factor authentication, and repeated failed sign-ins lock an account. No system is perfect; if a breach affects your personal information we will notify you as required by law.
9. Your rights
Wherever you live, you can ask us to:
- See what we hold about you;
- Correct it if it is wrong;
- Delete it, by closing your account or asking us;
- Export it — your mail is available over standard IMAP at any time;
- Object to or limit certain processing, including first-party marketing;
- Withdraw consent for cookies and similar technologies, at any time.
Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws have these rights by statute, including the right not to be discriminated against for exercising them. Because we do not sell or share personal information, there is nothing to opt out of on that front — but you may still tell us to stop using your information for our own marketing. Write to [email protected]; we respond within 45 days. If you are in the EEA or UK you may also complain to your supervisory authority.
10. Children
The Service is not for anyone under 16, and we do not knowingly collect their information. If you believe a child has an account, write to us and we will delete it.
11. Health information
The free tier is not covered by a HIPAA Business Associate Agreement and must not be used for protected health information. Compendium offers HIPAA-aligned mail as a separate paid arrangement.
12. Changes
We will post any new version here with a new version number and date, and for material changes we will notify you at least 30 days in advance by email or in the app.
13. Contact
The Compendium Company, Inc.
999 Vanderbilt Beach Road, Suite 200, Naples, FL 34108
[email protected]