1. Who We Are

Zedmail is a Canadian email infrastructure service operated under the trade name Zedmail at zedmail.com by Ozonagram Ltd, a Canadian federal corporation (corporation no. 1198855-7), Suite M162, 110 Didsbury Road, Ottawa, Ontario K2T 0C2, Canada.

Our person in charge of the protection of personal information is Darren Atwater, Privacy Officer, who can be reached at privacy@zedmail.com.

All data is stored on servers located in Canada.

For any questions about this policy, write to privacy@zedmail.com.

2. Data We Collect

Category	Data	Purpose
Account information	Email address, name, language, billing currency, timezone	Creating and managing your account; contacting you about the service
Sending data	Sender and recipient email addresses, subject, message body, timestamp, delivery status	Email delivery, audit logs, bounce and complaint processing
Technical data	IP address (hashed for rate limiting), user agent, API requests	Security, abuse prevention, rate limiting
Billing data	Usage counters, Paddle customer ID (no card data stored by us)	Monthly invoicing and usage reporting
Tracking events	Open and click events (if enabled) — no IP address or device fingerprint stored	Deliverability statistics (opt-in per account)
Browsing statistics	Pages visited, referrer, device type — aggregated, cookieless, no personal identifier	Understanding site usage to improve our service (self-hosted Matomo, cookieless)

We do not collect browsing data for advertising purposes, use advertising trackers, or profile our users for commercial ends.

3. How We Use Your Data

• Providing and improving the email sending service
• Authenticating logins and API calls
• Detecting and preventing abuse, spam, and fraudulent activity
• Generating monthly invoices and usage reports
• Sending you important service notifications (terms changes, security alerts)
• Measuring aggregate site usage to improve our offering
• Complying with our legal obligations

We do not use your data for targeted advertising or to build profiles for purposes unrelated to the service.

4. Data Residency — Canada Only

All account and message data is stored on servers in Canada, in data centres operated by OVHcloud in Québec. Zedmail is operated by Ozonagram Ltd, a Canadian federal corporation with no office, staff or infrastructure in the United States, and we do not use US-based hosting.

If anyone demands your data. We are a Canadian corporation and are subject to Canadian law, including orders of Canadian courts and authorities. If a court or public authority, in Canada or elsewhere, requires us to disclose data, we will disclose only what we are legally compelled to disclose, notify you before disclosing unless the law prohibits us from doing so, and refer the authority to you where we can. We will not disclose data to an authority outside Canada unless we are legally compelled to.

Two things we want to be plain about, because other providers are not:

• Delivery leaves Canada. Sending a message transmits it to the recipient's email provider, wherever that provider operates. If your recipient uses Gmail or Outlook, their copy of the message is on that provider's infrastructure the moment it arrives. No email service can change this, and any provider claiming end-to-end Canadian delivery is describing something email cannot do. What we control — storage, processing and logs — is in Canada.
• We administer the service from Ontario. Your data is hosted in Québec, but Zedmail is run from Ottawa. A customer subject to Québec's Law 25 is therefore entrusting personal information to a service provider outside Québec, and has its own privacy impact assessment to complete. We will give you the information you need for it.

Our site analytics tool (Matomo) is self-hosted on our own Canadian infrastructure — no data is transmitted to any third party.

Our payment processor, Paddle (paddle.com), is a UK platform. Payment data (card numbers, etc.) is handled directly by Paddle and never passes through our servers.

5. Subprocessors

We do not sell your personal data. We engage the following subprocessors:

• OVH HEBERGEMENT INC. (Québec, Canada) — server hosting. All data remains in Canada.
• Paddle (London, UK) — payment processing. Paddle receives your email address and account ID to associate payments with your account. Paddle acts as Merchant of Record.
• Matomo Analytics — self-hosted on our own Canadian infrastructure. Cookies are disabled; no personal data is collected or transmitted outside our servers.
• Legal authorities — only where required by applicable Canadian law and to the extent permitted under Canadian law.

No sharing with advertising partners, data brokers, or non-essential third parties.

6. Data Retention

• Message logs and content: retained for a period you choose, between 7 and 365 days (sender and recipient addresses, subject, message body, and delivery status), so you can review your sent messages, then permanently deleted. Where you have not chosen a period, it is 45 days, or 90 days for mail sent using an older-style API key. The default that applies is shown against each API key in your account settings. You can change this at any time in your account settings. Shortening the period takes effect at the next nightly deletion; messages already deleted cannot be restored.
• Attachments: attachment content is never kept. Attached files are held only while the message is being sent, then deleted. We keep the file name, type and size with the message record, and those are deleted with it.
• Mail server and application logs: logs held outside the database record delivery activity and contain recipient addresses. They are kept for no more than 7 days, then deleted.
• Suppression records (addresses that unsubscribed, hard bounced or complained): kept for as long as your account is open, whatever retention period you choose, so that an unsubscribe keeps being honoured. An unsubscribe has no expiry. When your account closes these are deleted with the rest of your data; you can export them first.
• Service-wide suppression record: we also keep, on our own behalf, a record of addresses that hard bounced or produced a spam complaint, and of unsubscribe requests we processed. Addresses on that record are hashed. An entry stays while any Zedmail account still suppresses the address, and is deleted 3 years after the last account stops suppressing it. We use it only to protect the service from abuse, to maintain deliverability, and to show that a request was honoured. We never use it to contact anyone.
• Permanent do-not-mail list: where someone has demanded that they receive no further mail through the service, or the law requires it, we may add their address, in hashed form, to a permanent list, with a short factual note of the reason. Each entry is kept for as long as it is needed to honour that demand, and is used only to block sending to that address.
• Backups: encrypted backups are not edited when live data is deleted. Data you have deleted remains in a backup until that backup expires, which is no more than 90 days later. Messages waiting in the outbound queue and server logs are not included in backups. We restore from backup only to recover the service.
• Mail in transit: a message awaiting delivery or retry is held on the server for up to three days before it is delivered or abandoned. It is never included in a backup.
• Account data (your account, users and billing contacts): retained for the duration of your active account, plus 90 days following termination. Message content, delivery logs and suppression records are deleted within 30 days of your account closing — the 90 days applies to the account record itself, not to your recipients' data.
• Billing records: retained for 7 years in accordance with Canadian accounting requirements.
• Security logs (login attempts, API activity): retained for 30 days.
• Aggregate browsing statistics: retained for 13 months, then automatically deleted (Matomo retention policy).

7. Your Rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data from the Account page in your dashboard
• Delete your account and all associated data
• Export your account data in a common format (on request)
• Object to or request restriction of certain processing

To exercise these rights, write to privacy@zedmail.com. We will respond within 30 days.

8. Security

We protect your data through:

• TLS encryption for all API and SMTP communications
• Passwords hashed with bcrypt (never stored in plaintext)
• Single-use API keys, stored as hashes
• Administrative access restricted to authorised personnel
• HTTP security headers (CSP, HSTS, X-Frame-Options)

No system is perfect. If you discover a security vulnerability, please report it responsibly to hello@zedmail.com.

9. Cookies and Analytics

We use a single functional session cookie to maintain your login. We do not use tracking cookies or advertising cookies.

We use Matomo Analytics, self-hosted on our own Canadian infrastructure, to understand aggregate usage of our website. Matomo is configured with cookies disabled — it does not set any cookies in your browser and does not collect personal data. No cookie consent banner is required.

10. Changes

We may update this policy from time to time. For material changes, we will notify you by email and by an in-dashboard notice. The date of the latest update is always shown at the top of this page.

11. Contact

For questions about this policy or your personal data:

Ozonagram Ltd
Suite M162, 110 Didsbury Road
Ottawa, Ontario K2T 0C2
Canada
hello@zedmail.com