Legal

Privacy notice

This notice explains what personal data Sovereign Mail collects, why, and what rights you have over it. The short version: we collect as little as we can, keep it in the UK, never sell it, and don't track the people you email.

Last updated 13 October 2026.

Two roles, two kinds of data

• Your account data (who you are, how you sign in, how you pay). For this we are the controller, and this notice applies.
• The email you send through us (recipient addresses, message content, delivery records). For this you are the controller and we are your processor: we handle it only on your instructions, under our terms and Data Processing Agreement. See UK GDPR for how we meet our processor duties. If you received an email sent through Sovereign Mail, the sender is responsible for it, so contact them first; we'll help them answer you.

What we collect about account holders

• When you sign up: your organisation name, optional Companies House number, email address and password. We store only a salted scrypt hash of the password, never the password itself.
• Company checks: if you give a company number, we look it up on the public Companies House register to confirm the organisation exists and is active.
• Security: your two-factor secret if you turn 2FA on, hashed API keys, a session cookie, IP addresses and an audit log of account actions (sign-ins, key changes, domain changes).
• Using the service: the domains you add, their DNS check results, your templates, webhook URL, usage counts and sending reputation.
• Billing: your plan, invoices and payment status. If you pay by card, Stripe collects the card details; we never see or store the card number.
• Talking to us: anything you send to support, and the service emails we send you (verification, password reset, usage and billing notices).

Why we use it, and our lawful basis

• To provide the service you signed up for (contract): running your account, sending your mail, billing you.
• To keep the platform safe (legitimate interests): reviewing new accounts, stopping spam and abuse, protecting our sending reputation, investigating errors and security incidents. Bad senders harm every customer's deliverability, so these checks protect you too.
• To meet legal obligations (legal obligation): keeping financial records and responding to lawful requests.

We do not use your data for advertising, we do not sell it, and we do not profile you. We send you service emails only, never marketing, unless you ask for it.

Cookies

We set one cookie: sid, a strictly necessary session cookie that keeps you signed in. It expires after 7 days or when you sign out. Your light/dark theme choice is kept in your browser's local storage and never sent to us. There are no analytics, advertising or third-party cookies, so there's no cookie banner.

Where it's kept and who else sees it

Our application, database and mail servers run on Brightbox, a UK-owned cloud provider, in Manchester. Error reports go to an error tracker we host ourselves. Beyond that, a small number of services see limited account data:

• Stripe (US), for card payments only: your name, email, billing details and card. This is the one transfer outside the UK, made under the UK International Data Transfer Addendum. Pay by UK bank transfer and Stripe never sees you.
• Companies House (UK government), only when you give a company number, which we look up on their public register.
• Slack (US), our internal operations channel: when a new account needs review, we post its organisation name, email address and company number there so we can approve it promptly. No email content or recipient data is ever sent to Slack.

The email you send through us, and its recipients, never leave the UK.

How long we keep it

• Delivery records (messages, recipients, events): deleted automatically after 30 days.
• Suppressions (addresses that bounced or complained): for the life of your account, so we don't email those people again.
• Account data: while your account is open. To close your account, email support@sovmail.co.uk; we then delete your account data, except what we must keep.
• Invoices and payment records: six years, as UK tax law requires.
• Sessions: 7 days.

Your rights

Under UK GDPR you can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, or get a copy to take elsewhere. Email support@sovmail.co.uk from your account address. We'll reply within one month, and there's no charge.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office.

Security

Encryption in transit, hashed passwords and API keys, optional two-factor sign-in, access controls, audit logging and a breach-notification process. More on our security posture.

Changes and contact

If we change this notice in a way that matters, we'll email account holders before it takes effect. Questions: support@sovmail.co.uk.