Data Processing Agreement

This Data Processing Agreement ("DPA") is between Webco S.r.l.s., Montorio al Vomano (TE), Italy, which operates FounderMail ("FounderMail", "Processor"), and each customer that holds a FounderMail account ("Customer", "Controller"). It supplements the Terms of Service and sets out the terms required by Article 28 of the GDPR for the personal data FounderMail processes on the Customer's behalf. It applies to every account from its effective date, without any further step; a copy signed by FounderMail is available on request through the contact form. If this DPA conflicts with the Terms, this DPA prevails for the processing of Personal Data; if it conflicts with the SCCs, the SCCs prevail.

1. Definitions

"GDPR" means Regulation (EU) 2016/679. "Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR. "Customer Data" means the Personal Data that the Customer's mailboxes and workspace receive, store or send through the service, described in Annex I. "Sub-processor" means a third party engaged by FounderMail that processes Customer Data. "SCCs" means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914. "Data Protection Law" means the GDPR, the Italian Personal Data Protection Code (Legislative Decree 196/2003 as amended) and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection.

2. Roles and scope

2.1 For Customer Data, the Customer is the Controller (or a processor acting for its own controller) and FounderMail is the Processor.

2.2 FounderMail is an independent Controller, under its Privacy Policy and not under this DPA, for: account and billing data; security logs; and the sending-safety records it keeps, on its legitimate interest in protecting the deliverability of the service for every customer, including bounce and complaint reports that name the recipient address and the suppression of an address that bounced permanently, applied to every account for 180 days.

2.3 The subject matter, duration, nature and purpose of the processing, and the types of data and Data Subjects, are set out in Annex I.

2.4 Where the GDPR does not apply to the Customer, FounderMail still processes Customer Data under this DPA.

3. The Customer's obligations

3.1 The Customer is responsible for having a lawful basis for the processing it instructs, including for any special categories of data its mail contains, and for the notices it gives Data Subjects.

3.2 A Customer acting as processor for another controller warrants that its instructions, and its engagement of FounderMail, are authorised by that controller.

3.3 The Customer keeps the account owner's email address current; FounderMail sends every notice under this DPA there.

3.4 Recipients the Customer configures (forwarding addresses, webhook endpoints, API and MCP clients, integrations it connects) receive Customer Data on the Customer's instruction. They are the Customer's recipients, not FounderMail's Sub-processors.

4. Instructions

4.1 FounderMail processes Customer Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the service (mailboxes, aliases, forwarders, webhooks, API keys, imports, forms, mailing lists, the optional AI assistant, deletions) are the Customer's complete instructions.

4.2 FounderMail informs the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that processing until the instruction is confirmed or changed.

4.3 FounderMail may process Customer Data otherwise only where required by Union or Member State law, and informs the Customer of that requirement before processing unless the law forbids it.

5. FounderMail's obligations

5.1 Confidentiality. Persons authorised to process Customer Data are bound by confidentiality and designated in writing under Article 2-quaterdecies of the Italian Personal Data Protection Code. Staff access message content only when the Customer asks for support, or when necessary to investigate abuse, a security incident or a legal demand.

5.2 Security. FounderMail implements the measures in Annex II and may update them provided the overall level of protection is not reduced.

5.3 No other use. FounderMail does not sell Customer Data, use it for advertising, or use it to train machine-learning models, other than the spam filter's own statistics, which learn from what users mark as junk or not junk, run on infrastructure FounderMail operates and are never shared outside the service.

5.4 Assistance. Taking into account the nature of the processing, FounderMail assists the Customer (a) with requests from Data Subjects, primarily through the service's own functions (IMAP export, deletion of messages, mailboxes, domains and the account), and passes on to the Customer, without answering it, any request a Data Subject sends FounderMail directly about Customer Data; and (b) with its obligations under Articles 32 to 36 GDPR, by providing the information reasonably available to it. Reasonable assistance is free. Assistance beyond it is charged at cost on a written estimate agreed beforehand, and never for an incident FounderMail caused.

6. Sub-processors

6.1 The Customer gives general authorisation for FounderMail to engage Sub-processors. The current list is Annex III and is published at foundermail.io/subprocessors.

6.2 FounderMail gives at least 30 days' notice of a new or replacement Sub-processor by updating the list and emailing the account owner. The Customer may object in writing, giving its reasons, within that period; a change not objected to within it is accepted. If the parties cannot resolve an objection, the Customer may terminate the affected service and receive a pro-rata refund of fees prepaid for it.

6.3 FounderMail imposes on each Sub-processor data protection obligations that offer at least the protection of this DPA, and remains liable to the Customer for its Sub-processors' performance.

7. International transfers

7.1 Customer Data is stored in Microsoft Azure's West US 2 region (United States). Outgoing mail is handed to Amazon SES in its EU (Ireland) region. Other Sub-processors and their locations are in Annex III.

7.2 Each transfer of Personal Data outside the EEA rests on a mechanism under Chapter V GDPR: the EU–US Data Privacy Framework where the recipient is certified under it, otherwise the SCCs (Module 3, processor to processor) incorporated in the Sub-processor's data processing terms. Where FounderMail contracts with a Sub-processor's entity in the EEA, that entity's onward transfer to its affiliates outside the EEA is made under that Sub-processor's own data processing terms, as Annex III states.

7.3 For a Customer established outside the EEA, the SCCs Module 4 (processor to controller) apply to the return of Customer Data to it, and are incorporated by reference.

7.4 Transfers subject to the UK GDPR are made under the UK International Data Transfer Addendum to the SCCs, and transfers subject to Swiss law under the SCCs as adapted for it.

7.5 Should a mechanism relied on be invalidated, FounderMail relies on the SCCs or another valid mechanism without undue delay.

8. Requests from public authorities

8.1 FounderMail discloses Customer Data to a public authority only when legally compelled to, and first tries to redirect the authority to request it from the Customer directly.

8.2 Unless the law forbids it, FounderMail notifies the Customer promptly of any such request, before disclosing. Where it is forbidden to notify, it seeks a waiver of the prohibition.

8.3 FounderMail reviews each request for lawfulness, challenges a request it considers unlawful, and discloses the minimum the request lawfully requires.

8.4 FounderMail gives no public authority direct, indirect, blanket or unrestricted access to Customer Data, nor its encryption keys or the means to break them.

8.5 As of the effective date of this DPA, FounderMail has received no request from a public authority for Customer Data.

9. Personal Data Breaches

9.1 FounderMail notifies the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data, by email to the account owner.

9.2 The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers concerned, likely consequences and the measures taken or proposed; information not yet available follows in phases without undue delay.

9.3 FounderMail does not notify Supervisory Authorities or Data Subjects on the Customer's behalf unless the Customer instructs it to. Notification is not an admission of fault.

10. Return and deletion

10.1 The Customer can export its mail at any time over IMAP, and delete messages, mailboxes, domains or the account from the dashboard.

10.2 On termination the Customer chooses return or deletion. Return is by IMAP export, available during the term and, unless FounderMail terminated for breach, for 30 days after termination, as the Terms provide.

10.3 After that period, or earlier on the Customer's instruction, FounderMail deletes Customer Data within 30 days. Deleted data remains in backups, isolated and not otherwise processed, until they expire: database backups are kept for 7 days and deleted files are removed 7 days after deletion.

10.4 A message delivered both to the Customer and to another FounderMail customer remains in that other customer's copy.

10.5 Retention is allowed where Union or Member State law requires it. FounderMail confirms deletion in writing on request.

11. Audits

11.1 FounderMail makes available the information necessary to demonstrate compliance with Article 28 GDPR: this DPA, Annex II, its Sub-processors' certifications and audit reports where they permit sharing, and once in twelve months the answers to a reasonable written security questionnaire.

11.2 Where that information is insufficient, the Customer may, at its own cost and on 30 days' written notice, no more than once in twelve months (except after a Personal Data Breach or at a Supervisory Authority's request), conduct or mandate an audit by an independent auditor who is not a competitor of FounderMail, under confidentiality and without access to other customers' data. FounderMail's time beyond one working day is charged at cost. Sub-processors' facilities are audited through their own third-party reports.

12. Liability, term, law

12.1 Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow them; nothing limits a Data Subject's rights under the SCCs.

12.2 This DPA lasts as long as FounderMail processes Customer Data.

12.3 It is governed by Italian law, with the jurisdiction set out in the Terms. FounderMail's lead Supervisory Authority is the Garante per la protezione dei dati personali.

13. Changes

FounderMail may update this DPA, giving each version a number and an effective date on this page. A change that reduces the protection it gives the Customer takes effect only after at least 30 days' notice by email to the account owner; a change required by law takes effect when the law requires.

Annex I: Details of the processing

Annex II: Technical and organisational measures

• Encryption in transit: TLS on the website, dashboard, API and MCP server, and on connections from mail clients to the SMTP and IMAP servers; mail from other servers is encrypted when the sending server supports it.
• Encryption at rest: database and file storage encrypted by Microsoft Azure.
• Credentials: account passwords and API keys stored as one-way hashes; mailbox passwords stored as a one-way hash for sign-in, with a copy encrypted under a key protected by Azure Key Vault so the people a mailbox belongs to can see it again; passkeys offered for sign-in; failed mailbox sign-ins slowed, IMAP sign-ins capped per mailbox per hour; credentials redacted from protocol logs.
• Isolation: every customer record is scoped to its account in application code and tested for scoping in both directions; personal mailboxes readable only by their user.
• Access control: production access limited to the people who operate the service; the operator's dashboard is behind single-tenant Azure AD sign-in and an allow-list, and only reads.
• Content safety: incoming HTML sanitised and shown in a sandbox, remote images blocked until the user asks; spam scoring on infrastructure FounderMail runs itself.
• Push notifications: encrypted end to end to the device (RFC 8291); the browser vendors' push services carry only ciphertext.
• Recovery: managed PostgreSQL with point-in-time restore over 7 days.
• Logging: server logs and error reports kept for a limited period, typically no longer than 90 days.
• Sending safety: suppression of addresses that bounced or complained, per-domain bounce and complaint monitoring, limits on mail to new recipients.
• AI assistant: off by default; nothing is sent until an owner or admin consents for the account and a user asks for a draft; the provider does not train on it.
• Inherited certifications: Microsoft Azure and Amazon Web Services hold ISO/IEC 27001 and SOC 2, among others, for the services used, as published in their compliance programmes. FounderMail holds no certification of its own.

Annex III: Sub-processors

Not Sub-processors: Stripe (payments, as its own controller); the Apple, Google, Mozilla and Microsoft push services (they carry only end-to-end encrypted notifications); recipients the Customer configures (section 3.4).