This is an English translation of the Czech document „Zásady zpracování osobních údajů“. If the two versions differ, the Czech version prevails.
This policy explains what personal data the mail-martinsil service processes, why, on what legal basis, for how long, to whom it is disclosed and what rights you have. It provides the information required by Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, “GDPR”) and by Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
This policy complements the service's terms of service (the “Terms”). Processing that the operator carries out for users as a processor is governed by Annex 1 to the Terms, “Data Processing Terms” (Zpracovatelské podmínky).
1. Who the controller is and how to contact them
The controller of personal data is:
| Controller | Martin Šíl, sole trader |
| Company ID (IČO) | 21158100 |
| Registered address | Oskara Nedbala 694, 541 01 Trutnov 1-Střední Předměstí, Česká republika |
| mail@martinsil.cz | |
| Phone | +420 736 144 647 |
| Website | https://mail.martinsil.cz |
(the “operator” or “I”)
I have not appointed a data protection officer because the GDPR does not require me to (Art. 37 GDPR). For any data protection matter, contact me at mail@martinsil.cz.
2. What the service is and in which role the operator processes data
mail-martinsil is a private service for sending transactional email through an API (compatible with the Resend API) that delivers email via Amazon Simple Email Service (Amazon SES). The service is not public: I create accounts by invitation only, and only for businesses and persons acting on behalf of businesses (the “user” or “you”). The service has no marketing features and does not track email opens or clicks.
Depending on the data, I act in two roles:
A) As controller I process data whose purposes and means I determine myself. This covers in particular:
- user account and sign-in data,
- invitations to the service,
- service security and abuse handling (account bans, limits, sending pauses),
- API request logs,
- the global suppression list (addresses that permanently bounce or whose owners complained about unwanted mail),
- communication with users and support,
- invoicing, where an individual contribution to costs has been agreed,
- establishing, exercising and defending legal claims.
Chapters 3 to 6 and 8 to 19 apply to this processing.
B) As processor I process data that users send through the API about their recipients (addresses, headers, subject, email content, attachments etc.) and the delivery events for those emails. The controller of this data is the user who sends the email. I process it only on the user's instructions and under the Data Processing Terms (Annex 1 to the Terms). See chapter 7 for details.
If you received an email sent through this service, please direct your questions and requests primarily to the sender, i.e. the company or person the email came from. The sender is responsible for processing your data. If you send your request to me anyway, I will forward it to the relevant user or tell you whom to contact.
3. What personal data I process and where I get it
3.1Categories of data subjects
- Users – persons for whom an account has been created (businesses or persons acting on behalf of businesses).
- Invited persons – persons for whom I created an account and to whom I sent an invitation.
- Email recipients – persons whose email addresses are on the global suppression list or in API request logs (as controller), and recipients of emails sent by users (as processor, see chapter 7).
- Persons who contact me – for example with a question, request or complaint.
3.2Categories of personal data
| Category | Specific data |
|---|---|
| Identification and contact data | name, email address, the Czech vocative form of the name used to greet you, profile picture URL (taken from your Google or Discord account if you sign in with it) |
| Account data | role (user/administrator), creation date, time of last sign-in, email verification, daily sending limit, sending pause data (time and reason), account ban data (flag, reason visible only to the administrator, duration) |
| Business and terms consent data | business name or name, company ID (IČO, or a foreign registration number) and registered office of the business you use the service for; the version of the Terms you accepted and the time of acceptance |
| Domain and API key data | domain names and their verification status, API key name, key prefix, key hash, time of last use and revocation |
| Sign-in and authentication data | one-time sign-in codes, sign-in sessions (session token, IP address, browser and system identification – the “User-Agent”, creation time and expiry), links to Google or Discord accounts (provider identifier, access, refresh and ID tokens, their expiry and scope) |
| API request logs | endpoint and path called, status code and error name, request and response body with content removed (see chapter 4), idempotency key, User-Agent, processing time, request time |
| Global suppression list | email address, reason (permanent bounce or spam complaint), date added |
| Communication | content of emails and other correspondence with the operator |
| Invoicing data (only if a contribution to costs is agreed) | name or business name, company ID, tax ID, registered address, bank account number, payment and invoice data |
As controller, I do not process special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions.
3.3Sources of personal data
- From you – data you provide or that a person requesting your account provides (name, email), data you enter in the application (domain name, API key name, name) or send me by email.
- From the operator – data I enter when creating an account and invitation, setting limits or banning an account.
- From sign-in providers – if you sign in with Google or Discord, the provider gives me your identifier, name, email address, profile picture URL and sign-in tokens.
- Automatically when you use the service – IP address and User-Agent at sign-in, API request logs, sign-in times.
- From Amazon Web Services – notifications of permanent bounces and complaints, from which the global suppression list is built.
4. Purposes, personal data, legal bases and retention periods
The following table covers processing for which I am the controller.
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Managing the user account and providing the service | identification and contact data, account data, business and terms consent data, domain and API key data | performance of a contract (Art. 6(1)(b) GDPR) where the user is the contracting party; where the user acts for another person (e.g. as an employee or director), legitimate interest in performing the contract with that person and communicating with its representative (Art. 6(1)(f) GDPR) | for the life of the account; deleted within 30 days after the account is closed |
| Sign-in and authentication | email, one-time sign-in codes, sign-in sessions incl. IP address and User-Agent, links to Google and Discord accounts | performance of a contract (Art. 6(1)(b) GDPR), or legitimate interest (Art. 6(1)(f) GDPR) – see the first row | sign-in code: valid for 5 minutes; session: until sign-out, revocation or expiry (default validity 7 days, extended while you use the service); Google/Discord link: until unlinked or until the account is closed |
| Invitations to the service | name and email of the invited person, the invitation sent | legitimate interest in offering the service to persons who have shown interest in it (Art. 6(1)(f) GDPR), or steps taken at the data subject's request before entering into a contract (Art. 6(1)(b) GDPR) | the data becomes part of the account created; if the invited person does not wish to use the service, I will delete the account at their request without undue delay |
| System emails (sign-in codes, invitations, service notices) | email, name, content of the system email | performance of a contract (Art. 6(1)(b) GDPR), or legitimate interest (Art. 6(1)(f) GDPR) | account data see above; copies of messages at Resend according to its terms |
| Service security and abuse prevention (protecting accounts, handling breaches of the Terms, account bans, sending limits, sending pauses) | account data incl. bans, limits and pauses, sign-in sessions (IP address, User-Agent), per-account bounce and complaint statistics, API request logs | legitimate interest (Art. 6(1)(f) GDPR) | for the life of the account; request logs 30 days (see below) |
| API request logs (shown to the user, troubleshooting and support, security) | endpoint and path called, status code, error name, request and response body, idempotency key, User-Agent, processing time, time. The HTML and text content of the email, attachment content and attachment URLs are removed from the bodies; the log does contain recipient addresses, subject, headers, tags and attachment file names. IP addresses are not stored in the logs. | legitimate interest (Art. 6(1)(f) GDPR); towards the user also performance of a contract (Art. 6(1)(b) GDPR) | 30 days, then automatically deleted |
| Global suppression list (so the service does not send again to addresses that permanently bounce or whose owners complained) | recipient email address, reason, date added | legitimate interest in protecting recipients from unwanted mail and protecting the service's sending reputation (Art. 6(1)(f) GDPR) | without time limit, for as long as the service operates, including after the account from which the email was sent is closed |
| Communication and support | email and content of correspondence | legitimate interest in handling questions and requests (Art. 6(1)(f) GDPR), or performance of a contract (Art. 6(1)(b) GDPR) | until resolved and then for at most 3 years |
| Handling data subject requests | data in the request and data needed to verify identity | compliance with a legal obligation (Art. 6(1)(c) GDPR, in conjunction with Art. 12 to 22 GDPR) | until resolved and then for at most 3 years |
| Invoicing and accounting (only if an individual contribution to costs is agreed) | invoicing data | compliance with a legal obligation under tax law (Art. 6(1)(c) GDPR) and performance of a contract (Art. 6(1)(b) GDPR) | for the period required by tax law, usually 3 to 10 years |
| Establishing, exercising and defending legal claims | data needed to prove, exercise or defend a claim (e.g. account data, correspondence, records of breaches of the Terms) | legitimate interest (Art. 6(1)(f) GDPR) | for the limitation period and the duration of any court or other proceedings |
| Obligations towards public authorities | data requested by an authority to the extent required by law | compliance with a legal obligation (Art. 6(1)(c) GDPR) | for the period set by the applicable law |
I do not use personal data for marketing or profiling and I do not sell it.
5. Legitimate interests
Where I rely on legitimate interest (Art. 6(1)(f) GDPR), the interests are:
- Service security – protecting accounts against unauthorised access, detecting and handling abuse, network and information security (see Recital 49 GDPR).
- Protecting recipients and sending reputation – all users share one sending account with Amazon SES. If the service kept sending to non-existent addresses or to people who complain, it would harm deliverability for all users, and Amazon Web Services could restrict or stop sending. That is why I keep a global suppression list and monitor bounce and complaint rates per account. The list also includes addresses from emails that I send myself from the same Amazon SES account outside the application.
- Communicating with customers' representatives – where a user acts for another person, I need to communicate with them and provide the service to them.
- Handling questions and support and establishing, exercising and defending legal claims.
You can object at any time to processing based on legitimate interest (see chapter 14). I have weighed these interests against your rights: I process only the data needed for each purpose, the service is intended for businesses, and the processing corresponds to what users and email recipients can reasonably expect.
6. Is providing data mandatory?
Providing an email address and a name is a condition for creating an account and entering into the contract. Without them I cannot provide the service. Signing in with Google or Discord is optional; you can always use a one-time code sent by email instead. You must provide invoicing data only if a contribution to costs is agreed, because tax law requires it. Other data is generated automatically when you use the service.
7. Data of recipients of emails sent by users (processor role)
7.1What I process
When a user sends an email through the API, I process the following data on their behalf:
- the addresses of the sender, the recipients (including cc and bcc) and the reply-to address, including display names,
- the subject, the HTML content and the plain text of the email,
- custom headers and tags,
- attachment metadata (file name, type, size); I do not store attachment content in the database,
- attachments uploaded in advance to Amazon S3 storage,
- delivery events (delivery, delay, bounce, complaint, rejection, rendering failure, skipping of a suppressed address) including recipient addresses and diagnostic information from receiving servers,
- the idempotency key and request hash.
The service does not track email opens or clicks and does not insert tracking elements into emails.
7.2Who the controller is
The controller of this data is the user who sends the email. The user is responsible for having a legal basis for the processing and for informing recipients as required by the GDPR. I process the data only on the user's instructions, i.e. to send and deliver the email, to keep the overview of sent emails and events that the user sees in the application, and to comply with the Data Processing Terms.
The exception is the global suppression list and aggregated per-account bounce and complaint statistics: I keep these as controller for my own purposes described in chapters 4 and 5.
7.3Retention
| Data | Retention period |
|---|---|
| Content of sent emails (message body in HTML and text form) | 30 days from sending, then deleted automatically; earlier if the account is closed |
| Metadata of sent emails (sender and recipient addresses, subject, headers, tags, attachment metadata) and delivery events | 90 days from sending, then deleted automatically; earlier if the account is closed |
| Attachments uploaded to Amazon S3 | at most 1 day, then automatically deleted |
| Idempotency key and request hash | 24 hours |
| API request logs | 30 days |
Under its contractual terms for Amazon SES, Amazon Web Services may store and automatically scan sent emails and their content to prevent spam, phishing, malware and other abuse.
7.4Operator's access to content
As operator I have technical access to the stored data. I use it only to the extent necessary to operate and secure the service, to troubleshoot and provide support at the user's request, to handle abuse and breaches of the Terms, or to comply with a legal obligation.
7.5If you are a recipient
Please direct requests for access, rectification or erasure, and objections, primarily to the sender of the email. If you send the request to me, I will forward it to the relevant user without undue delay and assist them in handling it. You may ask me directly to remove your address from the global suppression list (for example if the address was only temporarily unavailable). After removal, however, users of the service may send you emails again.
8. Recipients of personal data and processors
I do not sell personal data or disclose it to anyone for their marketing. I use the following processors to run the service (and, for data processed for users, as sub-processors):
| Provider | Service and purpose | Processing location | Safeguards for transfers outside the EU/EEA |
|---|---|---|---|
| Amazon Web Services (contracting party Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg; group of Amazon Web Services, Inc., USA) | Amazon SES – sending email; Amazon S3 – temporary storage of attachments; Amazon SNS – delivery, bounce and complaint notifications | region eu-north-1 (Stockholm, Sweden) | EU-US Data Privacy Framework; standard contractual clauses (Commission Decision (EU) 2021/914) under the AWS Data Processing Addendum |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | hosting of the web application and API, scheduled jobs | compute region fra1 (Frankfurt, Germany); requests pass through a global CDN; the provider may also process some data (e.g. operational logs) in the USA | EU-US Data Privacy Framework; standard contractual clauses (Commission Decision (EU) 2021/914) |
| DigitalOcean, LLC, USA | managed PostgreSQL database (all application data) | data centre FRA1 (Frankfurt, Germany) | EU-US Data Privacy Framework; standard contractual clauses (Commission Decision (EU) 2021/914) as a fallback |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | sending the service's system emails (sign-in codes, invitations, notices); does not process emails that users send through the API | USA | EU-US Data Privacy Framework; standard contractual clauses (Commission Decision (EU) 2021/914) |
I have data processing agreements under Art. 28 GDPR with all processors, which form part of their contractual terms. For data processed on behalf of users, the sub-processor rules in the Data Processing Terms apply.
8.1Independent controllers – sign-in with Google and Discord
If you choose to sign in with a Google or Discord account, the provider sends me data about your account at your request (see chapter 3.3). These providers are not my processors but independent controllers who process your data under their own policies:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – https://policies.google.com/privacy
- Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands – https://discord.com/privacy
8.2Other recipients
- Recipients' mail servers – emails sent by users are, by their nature, delivered to the recipients' mail servers, which may be located anywhere in the world. This is a transfer on the instruction of the user as controller.
- Public authorities – courts, law enforcement authorities, tax authorities and other bodies where the law requires me to disclose data.
- Advisers – for example a tax adviser or lawyer bound by confidentiality, and only to the extent necessary.
9. Transfers of personal data outside the EU/EEA
I store application data in the European Union: the database runs in Frankfurt, the application in Frankfurt, and emails are sent and attachments stored in Stockholm. However, all processors are companies based in the USA or part of US groups. Data may therefore be transferred to the USA, for example during administration and support of the services, in hosting operational logs, or for system emails sent through Resend.
Transfers are governed by:
- the European Commission's adequacy decision (EU) 2023/1795 for the EU-US Data Privacy Framework, where the recipient is certified under it. The decision is valid as of the effective date of this policy; an appeal (case C-703/25 P) against the General Court judgment that upheld it is pending before the Court of Justice of the EU;
- standard contractual clauses under Commission Decision (EU) 2021/914, which form part of the agreements with the processors and also apply should the adequacy decision cease to be valid.
On request, I will provide a copy of the relevant safeguards or tell you where they are published.
10. Retention, account closure and backups
- Specific retention periods are listed in the tables in chapters 4 and 7.3. After they expire, I delete or anonymise the data.
- Account closure. The application does not yet allow you to close your account yourself. To close your account and have your data erased, email mail@martinsil.cz. I will also close the account when the contract ends under the Terms. I will delete account data, domains, API keys, sessions, Google/Discord links, records of sent emails, delivery events and request logs within 30 days of account closure.
- What remains after account closure. Addresses on the global suppression list (not linked to the account), invoicing data for the period required by tax law, and data needed to establish, exercise or defend legal claims.
- Backups. Infrastructure providers create backups that are overwritten on the provider's rotation cycle. Deleted data may remain in backups until they are overwritten. I do not restore it to the production environment.
11. Cookies
The web application uses only strictly necessary and functional first-party cookies. I do not use analytics, advertising or tracking cookies, third-party audience measurement tools, or browser storage (localStorage, sessionStorage) for tracking. These cookies do not require your consent (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications), so the application does not show a consent banner.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| Sign-in cookies (cookies of the authentication library) | keeping you signed in, verifying the session and protecting against unauthorised access | until sign-out or session expiry (default validity 7 days, extended while you use the service); some last only until the browser is closed | strictly necessary, first party |
| home-locale | remembering the language of the home page (Czech/English); set when you switch the language | 1 year | functional, first party |
| sidebar_state | remembering whether the application's sidebar is expanded or collapsed | 7 days | functional, first party |
You can delete or block cookies in your browser settings. Without the sign-in cookies, however, you cannot sign in to the application.
Email preview in the application. When you open a preview of a sent email in the application, your browser loads images from the addresses contained in the email, just like an email client. The operators of those servers may therefore receive your IP address. The application does not send information about the page from which the image is loaded.
12. Security of personal data
I have taken technical and organisational measures appropriate to the risk (Art. 32 GDPR), in particular:
- all communication with the service, and between the service and its providers, is encrypted with TLS,
- data in the database and storage is encrypted at rest by the infrastructure providers,
- data is stored in EU regions (Frankfurt, Stockholm),
- API keys are stored only as a cryptographic hash; the full key is shown only once when created and cannot be recovered,
- sign-in is passwordless, using a one-time code valid for 5 minutes or via Google or Discord,
- only the operator has access to production systems and data; each user sees only their own data,
- notifications from Amazon SNS are accepted only with a valid Amazon cryptographic signature,
- attachment storage is not publicly accessible, can be accessed only over an encrypted connection, and uploaded files are automatically deleted after at most 1 day,
- email and attachment content is removed from request logs,
- the email preview in the application runs in an isolated environment that cannot run scripts,
- sending is protected by limits and by an automatic pause when bounce or complaint rates are high.
In the event of a personal data breach, I will notify the Czech Office for Personal Data Protection and, where applicable, the affected persons in accordance with Articles 33 and 34 GDPR. For data I process as a processor, I will inform the user under the Data Processing Terms.
13. Automated decision-making and automatic sending pause
There is no decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR), and no profiling.
The service does, however, include technical safeguards:
- Sending limits – the number of emails per minute and the number of recipients per 24 hours are limited as set out in the Terms.
- Automatic sending pause – if the rate of permanently bounced emails or spam complaints from your account exceeds the thresholds set out in the Terms, the service automatically pauses sending from the account. This protects recipients and the service's ability to deliver email for all users.
- Skipping suppressed addresses – emails are automatically not sent to addresses on the global suppression list.
A pause is a temporary technical measure, not a final decision. I am notified of the pause automatically, I review the situation and I can resume sending. If you disagree with a pause or want to explain the situation, contact me at mail@martinsil.cz.
14. Your rights
In connection with the processing of your personal data you have the following rights:
- Right of access (Art. 15 GDPR) – you can find out whether I process your data and obtain a copy of it and information about the processing. You can see part of the data directly in the application (profile, active sessions, sent emails, request logs).
- Right to rectification (Art. 16 GDPR) – you can ask me to correct inaccurate or complete incomplete data. You can change your name yourself in the settings; I will change your email address on request.
- Right to erasure (Art. 17 GDPR) – you can ask me to erase your data, for example if it is no longer needed or if you raise a justified objection. I do not have to erase data I need to comply with a legal obligation or to establish, exercise or defend legal claims.
- Right to restriction of processing (Art. 18 GDPR) – for example while the accuracy of data is being verified or an objection is being assessed.
- Right to notification (Art. 19 GDPR) – I will inform recipients to whom data has been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort.
- Right to data portability (Art. 20 GDPR) – on request, I will provide data processed by automated means on the basis of a contract in a structured, commonly used and machine-readable format (e.g. JSON or CSV), or transmit it to another controller where technically feasible.
- Right to object (Art. 21 GDPR) – you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. I will then stop processing the data unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or I need the processing to establish, exercise or defend legal claims.
- Right not to be subject to automated decision-making (Art. 22 GDPR) – see chapter 13.
- Right to lodge a complaint with the supervisory authority – see chapter 16.
I do not base any processing on consent. If I ask for consent in the future, you will be able to withdraw it at any time without affecting the lawfulness of processing before withdrawal.
15. How to exercise your rights
- Send your request by email to mail@martinsil.cz, ideally from the email address you use in the service.
- To avoid disclosing data to the wrong person, I may ask you to verify your identity, for example by replying from the address linked to the account or by entering a code I send you. I will use verification data only for this purpose.
- I will reply without undue delay and at the latest within 1 month of receiving the request. For complex or numerous requests I may extend this period by a further 2 months; I will inform you of the extension and the reasons within 1 month.
- Handling a request is free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, I may charge a reasonable fee or refuse to act on the request (Art. 12(5) GDPR).
- Account closure and erasure of data must be requested by email, because the application does not yet offer this function (see chapter 10).
- If you received an email sent by a user, contact the sender first (see chapter 7.5).
16. Right to lodge a complaint with the supervisory authority
If you believe that processing of your personal data infringes the law, you can lodge a complaint with the supervisory authority:
Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Data box ID: qkbaa2n
Website: https://uoou.gov.cz
You can also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work. I would appreciate it if you contacted me first so that we can try to resolve any issue directly.
17. Minimum age
The service is intended exclusively for businesses and persons acting on their behalf. Persons under 18 may not use it and I do not knowingly process their data. If I find that an account is used by a person under 18, I will close the account and delete the data.
18. Changes to this policy
I may change this policy, in particular when the service, the processors or the law change. The current version is always published at https://mail.martinsil.cz. I will inform users of material changes in advance by email or by a notice on the website. Each version states its number and effective date.
19. Language versions and effective date
This policy is drawn up in Czech and English. In the event of any discrepancy between the language versions, the Czech version prevails.
This policy is effective from 15 October 2026 (version 1.0).