Privacy Policy

Who we are

ZeyMail is an email service for addresses ending in @zeymail.com, operated by ZeyMail Inc. (“ZeyMail”, “we”, “us”). We are responsible for the personal data described in this policy. We handle personal data in line with the Personal Data Protection Act 2010 of Malaysia.

What this policy covers

This policy applies to:

• the website at www.zeymail.com;
• the webmail application at app.zeymail.com; and
• email sent to and stored in @zeymail.com mailboxes.

There is no public sign-up. Every mailbox is created by an administrator for a specific person or organisation, who is our customer. Where we say “you”, we mean the person who uses a mailbox.

Information we collect

Account information

• Your email address and the display name your administrator sets.
• Your password, stored only as a salted, one-way hash (PBKDF2-SHA-256). We cannot read your password and will never ask you for it.
• Your role (user or administrator) and whether your account is active.

Email content

• Messages delivered to your mailbox, including sender and recipient addresses, subject, body, attachments and technical headers.
• Messages you write, save as drafts, schedule or send, and the labels and filters you create.
• Messages sent to an address that does not exist are rejected and are not stored.

Technical and security information

• For each signed-in session: the time it started and was last used, your IP address and your browser’s user agent. You can see and end your sessions in Settings.
• An activity log of security events, such as successful and failed sign-ins, password changes and administrator actions, with the time and IP address.

The website

The website at www.zeymail.com does not use cookies, analytics or advertising trackers, and has no forms. Our hosting provider processes standard request data (such as IP address) to deliver and protect the site.

How we use information

• To receive, store and display your email, and to send the messages you choose to send.
• To sign you in, keep your session secure and let you manage your devices.
• To detect and prevent abuse, spam, fraud and unauthorised access.
• To keep the service running, fix problems and restore data from backups.
• To respond to your requests and to reports sent to [email protected] or [email protected].
• To comply with the law and with valid requests from authorities.

We do not sell personal data. We do not read your messages for advertising, and we do not show advertising in ZeyMail. We do not use your messages to train artificial intelligence models.

Your organisation’s administrators

If your mailbox was issued by an organisation, that organisation’s administrators can create, reset, disable and deactivate your account, and can give themselves or others access to your mailbox. Each of these actions is recorded in the activity log. Ask your administrator how they manage access.

Who we share it with

We share personal data only with service providers who help us run ZeyMail, and only as needed:

We may also disclose information if the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger or transfer of the service, in which case this policy continues to apply.

Cookies and local storage

The application sets one cookie, which keeps you signed in. It is strictly necessary, is only sent over HTTPS to app.zeymail.com, cannot be read by scripts, and expires after 8 hours, or after 2 hours without use. The application also stores a few preferences in your browser, such as light or dark theme and saved searches. The website sets no cookies.

How long we keep it

• Email is kept until it is deleted, or until the mailbox is deleted at the request of its owner or administrator.
• When an address is deactivated, sign-in is blocked immediately. Stored mail is kept so it can be recovered, until the administrator or owner asks us to delete it.
• Session records are removed after the session expires. Security logs are kept for as long as needed to protect the service.
• Backups are overwritten on a rolling basis, so deleted data may remain in a backup for a limited time.

Security

All connections use HTTPS. Passwords are hashed, sessions expire, and access to each mailbox is checked on every request. No system is perfectly secure; if we become aware of a breach that affects your personal data, we will notify affected customers and authorities as the law requires. Please use a strong password that you do not use anywhere else.

Your rights

Subject to the law, you may ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is inaccurate or out of date;
• stop processing or delete your data, where we are not required to keep it; and
• withdraw your consent, where we rely on it.

If your mailbox was issued by an organisation, we may refer your request to that organisation’s administrator. Send requests to [email protected]. We will verify your identity before acting and reply within 21 days.

Where data is processed

Our providers operate globally, so your data may be processed and stored outside Malaysia. When this happens, we rely on providers that apply safeguards at least comparable to those required in Malaysia.

Children

ZeyMail is not intended for children under 18, and administrators must not create mailboxes for them.

Changes to this policy

We will update this page when our practices change and revise the date at the top. If a change materially affects how we use your data, we will tell administrators before it takes effect.

Contact us

• Privacy requests: [email protected]
• General enquiries: [email protected]
• Abuse and spam reports: [email protected]