Privacy policy

Updated 26 October 2026 · Pilot policy version 1.1

Moonemail is operated by Halyard Labs Pty Ltd (ABN 71 694 449 637), Australia, with its main business location in NSW 2010. This policy covers our website, dashboard, API, connected-agent service and support. Privacy contact: al@halyard.studio.

Information we collect and why

• Account information: email address, team name, authentication records, verified domains, API-key identifiers and authorised integrations, to operate and secure your account.
• Email delivery information: senders, recipients, subjects, message bodies, attachments, headers, timestamps, delivery results, suppression records and webhook destinations, supplied by customers and senders to their receiving addresses so we can send, receive, route and troubleshoot their messages.
• Technical information: IP addresses, request and device information, errors and usage counts, to serve the website, prevent abuse, investigate incidents and manage limits.
• Support information: your contact details and information you choose to send us, to answer enquiries, resolve complaints and provide support.
• Billing information, if enabled: billing contact, account identifier, subscription and payment status. Stripe handles payment-card entry; our email service does not receive full card details.

We collect information directly from account users and enquirers, automatically when our services are used, from customers sending messages to recipients, and from third parties sending or forwarding email to customer-configured receiving addresses. If you do not provide information needed for an account or delivery, we may be unable to provide that part of the service. You can ask general questions without opening an account and may use a pseudonym where identification is not needed.

Customers and email recipients

Customers decide who receives their messages and what those messages contain. We handle delivery data to provide their requested service, maintain security, manage abuse and meet applicable legal obligations. If you received an email from a Moonemail customer, contact that sender about its use of your information. You can also report abuse or ask us for help identifying the responsible sender.

Customers must have authority to provide recipient data and must give their own appropriate privacy notices. Do not place health information, government identifiers, financial account credentials or other sensitive information in emails without an agreed assessment of the requirements.

When receiving is enabled, customers also decide which addresses and integrations handle incoming mail. We store original messages, parse bodies and attachments, and evaluate provider spam, malware and authentication verdicts. Quarantined content is not exposed through customer retrieval APIs. Raw mail to disabled or unrecognised addresses may remain in temporary intake storage until its retention period expires, but is not routed to a customer inbox. Do not forward information you are not authorised to disclose.

Disclosures and overseas processing

We share information with the providers described in our service-provider register as needed for hosting, delivery, security, support and optional billing. We may also disclose information when required or authorised by law, or to investigate abuse and protect the service. We do not sell recipient lists.

Our application’s email storage and processing are configured in AWS Sydney. This does not mean every associated service or recipient is in Australia. Website traffic uses Cloudflare’s global network; business enquiries use Google Workspace; optional billing uses Stripe; authorised administrative assistance can use OpenAI tools. These services may process information overseas, including in the United States. The provider register links to further location information. We have not verified a complete fixed country list for all support and provider operations; contact us before relying on a particular geographic restriction.

Recipient mail systems and customer-selected webhook endpoints may be anywhere in the world. Connecting an agent or other integration can disclose data to that provider according to the scopes you approve, including email content where read access is granted. Review its practices before connecting. These destinations are not covered by our Sydney hosting statement.

Storage, security and retention

We use access controls, encrypted application storage and HTTPS. See security and data & hosting for details and limitations.

• Message bodies and stored attachment content are scheduled for expiry after 30 days in the current deployment. Delivery events and webhook-attempt records are also scheduled to expire after 30 days. Cloud lifecycle deletion is asynchronous, rather than an exact deletion deadline.
• Application logs are configured for 30-day retention. Queue retries and failed-message queues have separate, shorter retention periods.
• Received-message summaries, original messages, parsed bodies and attachments are scheduled to expire after 30 days. Retrieval APIs deny access after expiry; backend lifecycle deletion can take longer.
• Outbound message summaries, including subjects and recipient addresses, account records and suppression records do not currently share that automatic expiry. We retain these for account operation, delivery history and preventing unwanted messages. Ask us to review or delete information that is no longer needed; account deletion is currently handled through support, not a self-service button.
• Database recovery backups can preserve earlier records for up to 35 days. Provider-managed copies, recipient mailboxes and data sent to your integrations are subject to their own controls. We cannot recall an already delivered email.
• Support, billing and legal records are retained as needed for the enquiry, service administration, dispute resolution and applicable recordkeeping obligations. We review deletion requests against those purposes and explain any information we must retain.

Cookies, local storage and tracking

The marketing site does not add advertising pixels or analytics scripts. Infrastructure providers still process requests for delivery and security. The dashboard stores sign-in/session information and appearance preferences in your browser. Clearing browser storage can sign you out.

Customers can configure optional email open/click tracking. When enabled, delivery events can include interaction timestamps and technical information such as IP address and user agent. Customers must provide appropriate notice and obtain any required permissions. Tracking is not a reliable measure that a person read a message.

Access, correction, deletion and complaints

Contact al@halyard.studio to request access, correction, deletion, a copy of this policy in another accessible format, or to make a privacy complaint. Describe the request and the relevant account or message. We may need proportionate identity or authority verification; do not email identity documents unless we arrange a suitable method.

We aim to acknowledge requests within five business days and respond within 30 days, or explain the reason and expected timing if more time is needed. Where we cannot fulfil a request, we will explain why and available options. If a complaint remains unresolved, you can contact the Office of the Australian Information Commissioner, which can explain its jurisdiction and complaint process.

Policy changes

We will update the date on this page when practices change and notify affected account holders of material changes. This policy is not a request for blanket consent to unrelated uses of personal information.