Privacy Policy

Last updated 18 October 2026

This policy explains what personal data Gundhus AS collects when you visit waymail.app, use the Waymail console or API, or write to us — and how Waymail handles the personal data of the people our customers send email to.

Who we are

Waymail is owned and operated by Gundhus AS, Hellvikskogsvei 93, 1459 Nesodden, Norway, organisation number 922 852 014 (“Gundhus AS”, “we”, “us”).

Our role depends on whose data it is.

• For the people who visit our website, sign in to the console or write to us, we are the controller: we decide what is collected and why, and this policy is our account of it.
• For the data our customers send, receive or forward through Waymail — sender and recipient addresses, messages, attachments, forwarding configuration, contacts and message activity — the customer is the controller (or a processor for its own client) and we are its processor. We process that data only on their instructions, under the data processing terms in our Terms of Service.

If you received an email sent through Waymail, the organisation that sent it is the one to ask about your data. If you ask us instead, we will pass your request on to them and help them answer it.

If you sent email to an address received or forwarded by Waymail, the organisation operating that address is the one to ask about its use of your information. A destination verification email identifies the requesting workspace and project; ignore it if you did not authorise that request. Opening its link alone does not confirm the mailbox or enable forwarding.

The short version

• The website keeps no access logs. It sets no cookies and loads nothing from third parties unless you accept analytics; if you do, Google Analytics measures your visit.
• The console signs you in through Waymail's own identity service and keeps a log of administrative actions — including the IP address each came from — for 400 days.
• Our customers' email data is stored and processed in the EU, in Frankfurt. Outgoing bodies follow the customer's 7-to-90-day or metadata-only setting; outgoing delivery history follows the plan. Received inbox messages expire after 7 days on Free and Lite, or 14 days on Pro. Forwarding uses temporary processing storage; the customer can also retain a separate inbox copy. Delivery to a chosen mailbox or webhook can leave the EU; those recipients control their own copies.
• The only company that processes our customers' email data on our behalf is Amazon Web Services, which runs the infrastructure.
• We do not sell personal data or use it for advertising.

Visiting waymail.app

The website and the documentation are static pages served by Amazon CloudFront. CloudFront's access logging is not enabled, so we keep no record of your visit. Unless you accept analytics, the pages set no cookies and load no scripts, fonts or other content from third parties.

To deliver the pages and protect its network, Amazon processes your IP address and the details of each request transiently, as any web host must. The legal basis is our legitimate interest in running a website that works and is secure (GDPR Article 6(1)(f)).

The waiting list. When you join the waiting list, the website sends your email address, and the path of the page you joined from, to our API in Frankfurt. The API turns them into one email to waitlist@waymail.app, sent through Waymail from our own workspace: your address is in its subject and is its reply-to address, and its text gives your address, the page and the date. Like everything sent to a waymail.app address, it arrives in our mailbox at Uniweb, in Norway. Like any message sent through Waymail, it is also kept in our workspace: its content for 60 days, and the record of it, which shows your address, for 13 months. We use your address to send the one email the form promises, when your seat is ready; there is no newsletter. The legal basis is steps you asked us to take before entering into a contract (Article 6(1)(b)).

To keep the form from being flooded, the API counts signups from each IP address, hour by hour. Each count is stored under the IP address it counts, and expires two hours after its hour began. So that joining twice on the same day sends us one email rather than two, the API also keeps a key made from your email address for a day. The API's logs record neither your IP address nor your email address. The legal basis for both is our legitimate interest in a form that works and is not abused (Article 6(1)(f)). If the form cannot reach the waiting list, it suggests writing to waitlist@waymail.app instead, and that email is handled as described under Writing to us.

Analytics, if you accept. To learn which pages are read and how people find them, the website can measure visits with Google Analytics 4, loaded through Google Tag Manager and provided by Google Ireland Limited as our processor. It runs only after you accept it in the banner the website shows first; declining, or not answering, loads nothing from Google. It records the pages you view, the site or campaign that brought you, how far you scroll, the links you follow to other sites, your device and browser type, your approximate location — worked out from your IP address, which Google Analytics does not store — and whether you joined the waiting list, linked by a random identifier in a cookie. We never send it your email address or anything else that names you, and Google signals and advertising features are switched off. Google Analytics keeps this data for 14 months. The legal basis is your consent (GDPR Article 6(1)(a)), which you can withdraw at any time with Cookie settings, in the website's footer whenever analytics is offered. The Cookie Policy lists the cookies it sets.

Using the console

Signing in. Waymail runs its account and sign-in service on Amazon Web Services in Frankfurt, using Better Auth software. We process your name, email address and authentication details — a password and authenticator factor, or an external sign-in provider where enabled — along with session and device information, including IP addresses, to keep your account secure.

Workspaces. For each workspace you belong to, we store your user ID, email address and role. An invitation to a workspace holds the invitee's email address until 30 days after the invitation expires.

Audit log. Administrative actions — creating or revoking an API key, adding a domain, changing members or settings, removing an address from the suppression list, and similar — are recorded with who took the action, when, and the IP address it came from. The log is kept for 400 days and is available to the workspace in the console, so a workspace can always establish what was done to it, and by whom.

Browser storage. The console keeps your region and selected workspace in your browser's session storage — and, if you sign in with an API key rather than an account, that key — all of which is cleared when you close the tab. Waymail's identity service sets the cookie that keeps you signed in. This storage supports the console and is not used to track you.

The legal bases are providing the service you signed up for (Article 6(1)(b)) and our legitimate interest in keeping accounts and workspaces secure (Article 6(1)(f)).

Billing. For a workspace on a paid plan, we keep the billing contact's name and email address, the organisation's name, address and VAT or organisation number, and our invoices and payment records. Payments are taken by Stripe, listed under the subprocessors below. When you start a checkout we send Stripe the workspace's name and your email address; the card, the billing address and any tax number are entered on Stripe's own page and never reach us. Stripe also uses what it receives, as a controller in its own right, to prevent fraud and meet its own legal obligations. We count each workspace's emails per month to apply its plan; the count is a number, not a list of recipients. The legal bases are our contract (Article 6(1)(b)) and our obligations under bookkeeping law (Article 6(1)(c)).

Writing to us

Email sent to hello@waymail.app — and to our other waymail.app addresses, which all arrive in the same place — is delivered to our mailbox at Uniweb, a Norwegian host, on servers in Norway. We use your name, address and message to reply to you and to keep a record of the conversation, and keep it for 24 months after the last message — longer only if it becomes part of a customer relationship that needs it. The legal basis is our legitimate interest in answering you (Article 6(1)(f)), or steps you asked us to take before entering into a contract (Article 6(1)(b)).

Email sent, received or forwarded through Waymail

When a customer sends, receives or forwards email through Waymail, we process the following on their behalf.

• Addresses — original senders, recipients and forwarding destinations, names where supplied, envelope recipients, and addresses in From, To, Cc, Bcc and Reply-To.
• The message — its subject, HTML and text bodies, attachments, headers and tags, and the raw MIME source where applicable. Incoming headers can themselves contain personal data, including network and mail-routing information.
• Contacts — the customer's audience: email addresses, names, custom properties and topic subscriptions.
• Delivery history — a record of each message, who it went to and when, and what followed: sent, delivered, delayed, bounced, complained, opened, clicked.
• Receiving and forwarding — source domains and addresses, inbox and rule settings, destination addresses and verification state, provider receipt identifiers, SPF/DKIM/DMARC results, spam and malware verdicts, and processing and delivery outcomes. A verification request sends an email with the requesting workspace and project, relevant source-domain context and a confirmation code. Codes are valid for 30 minutes; the configuration stores a hash, not the code itself. The verification email and its recipient's copy can outlast the code's validity.
• Suppressions — addresses that must not be emailed again, with the reason: a hard bounce, a spam complaint, an unsubscribe, or the customer's own decision.

The customer instructs which domains and addresses receive email, where it is forwarded and whether to keep an inbox copy. We parse and store incoming mail, check authentication and safety, verify destinations, deliver the instructed copies and recover interrupted work. Forwarding replaces some routing and sender headers for authenticated redelivery; it does not establish the original author's permission to disclose the message. The customer must have the required lawful basis, permissions and notices for its instructions. Deleting Waymail's copy cannot erase copies already delivered to a mailbox or webhook.

Open and click tracking. To show a sender whether a message was opened, Waymail can add a tiny invisible image to it. Click tracking passes a click through Waymail on its way to the link so it can be counted. Both are off unless the customer switches them on for a sending domain, and a customer who does is responsible for any consent the law requires for them. For an open we record when it happened and the user-agent string of the mail client that fetched the image; for a click, the same and which link was followed. We do not record IP addresses for either. Mail apps that fetch images automatically — Apple Mail Privacy Protection, for one — register opens nobody made, so an open is a hint, not proof.

Unsubscribing. Marketing email sent through Waymail carries an unsubscribe link and the standard List-Unsubscribe header, which lets your mail app offer a one-click unsubscribe button. If the message was sent for a particular topic and you are one of the sender's contacts, unsubscribing opts you out of that topic only. Otherwise it adds your address to the sender's suppression list for marketing email — their receipts and account notices can still reach you.

Bounces and complaints. When a message to you hard-bounces, or you report it as spam, Waymail adds your address to that sender's suppression list so they do not email it again.

How long we keep it

Amazon S3 lifecycle rules and DynamoDB time-to-live provide storage-expiry backstops. They act asynchronously rather than at an exact minute. Ordinary outgoing bodies also have a seven-day non-current version-expiry rule; temporary forwarding objects use the shorter rules above. Explicit erasure purges stored content rather than waiting for ordinary version expiry. When a workspace changes its outgoing retention period, we retag existing outgoing bodies, usually within the hour; storage then expires those past the new period. Metadata-only erases existing outgoing body versions. This does not extend incoming or forwarding retention. Our database keeps continuous backups for 35 days, used only to recover from a failure, so deleted records can remain in them until they age out. Incoming and outgoing counters and content-free deduplication receipts do not recreate deleted messages.

When a workspace is closed, we delete its data within 30 days, except where the law requires us to keep something.

Where the data is

For a workspace in the EU region, everything described under Email sent, received or forwarded through Waymail — and the workspace's audit log — is stored and processed in Amazon Web Services' Frankfurt region (eu-central-1), and its email is sent through Amazon SES in the same region. A workspace's region is chosen when it is created and cannot change.

Only the EU region is available today. US-region preparation does not enable US customer workspaces or move existing EU data. Delivery to recipients, customer-selected forwarding mailboxes and webhook endpoints can take data outside the EEA according to those destinations. Those copies follow their operators' policies; the customer is responsible for its destination choices and any required transfer arrangements.

The website and the console's own files are served from CloudFront's global network. They are static files and contain no personal data.

Cloudflare, which provides DNS for our domain, is based in the United States. It is certified under the EU–US Data Privacy Framework, which the European Commission recognises as giving adequate protection; a transfer outside it relies on the Commission's Standard Contractual Clauses. Waymail's account and sign-in data is held in our AWS Frankfurt identity service, rather than in a third-party sign-in service.

Stripe Payments Europe, Limited, in Ireland, takes payments for paid plans and may have the billing details processed by Stripe, LLC in the United States, which is certified under the same framework; Stripe's data processing terms add the Standard Contractual Clauses.

If you accept analytics on the website, Google Ireland Limited may have the data processed by Google LLC in the United States, which is certified under the same framework; Google's data processing terms add the Standard Contractual Clauses.

Subprocessors

Only Amazon Web Services processes our customers' email data as our infrastructure subprocessor. The others provide our DNS, our own correspondence mailbox and payments for paid plans. They do not receive customer message content or its sender/recipient lists through those roles. Separately, we deliver to the mailboxes and webhook destinations the customer instructs; a customer's selected destination is not thereby appointed as our subprocessor. We announce changes to this list at least 30 days before they take effect.

Google, which provides the website's optional analytics, is described there rather than listed here. It works only on waymail.app, for visitors who accept it, and receives nothing from the console and none of our customers' email data.

Security

• Data is encrypted in transit with TLS, and at rest with encryption keys we manage in AWS Key Management Service.
• Message bodies are kept in private storage with all public access blocked, readable only by the services that need them.
• API keys are stored only as hashes. A key is shown once, when it is created, and cannot be retrieved afterwards.
• Webhook payloads are signed, so a receiver can verify that they came from Waymail and were not altered.
• Access to production systems is restricted to the people who operate them, and administrative actions are audited.

If a personal data breach affects data we process for a customer, we tell that customer without undue delay and within 48 hours of becoming aware of it, as the Data Processing Agreement sets out, so they can meet their own obligations. If one affecting data we control is likely to put your rights at high risk, we tell you directly.

Your rights

Under the GDPR you can ask for a copy of your personal data, and ask us to correct it, delete it, restrict how we use it, or give it to you in a portable form. You can object to processing based on our legitimate interests, and withdraw consent you have given — for website analytics, with Cookie settings — without affecting what was done before. Write to hello@waymail.app; we answer within a month. For data we process for one of our customers, we pass your request to them and help them answer it.

You can also complain to a data protection authority — Datatilsynet, the Norwegian Data Protection Authority, or the authority where you live or work.

Waymail is a service for businesses, and is not directed at children. An account is for somebody aged 18 or over, acting for an organisation. We do not knowingly collect personal data from children; if you believe a child has given us some, write to hello@waymail.app and we will delete it.

Changes and contact

When this policy changes, we update the date at the top. If a change is material, we tell customers by email at least 30 days before it takes effect.

Questions about this policy or your data: hello@waymail.app, or Gundhus AS, Hellvikskogsvei 93, 1459 Nesodden, Norway.