---
import Legal from '../layouts/Legal.astro';

const sections = [
  { id: 'who',          num: '01', title: 'Who we are' },
  { id: 'scope',        num: '02', title: 'Scope of this policy' },
  { id: 'data',         num: '03', title: 'Data we collect' },
  { id: 'use',          num: '04', title: 'How we use your data' },
  { id: 'legal-basis',  num: '05', title: 'Legal bases' },
  { id: 'encryption',   num: '06', title: 'Encryption and storage' },
  { id: 'sharing',      num: '07', title: 'Sharing with third parties' },
  { id: 'retention',    num: '08', title: 'Data retention' },
  { id: 'rights',       num: '09', title: 'Your rights' },
  { id: 'transfers',    num: '10', title: 'International transfers' },
  { id: 'children',     num: '11', title: 'Children' },
  { id: 'changes',      num: '12', title: 'Changes to this policy' },
  { id: 'contact',      num: '13', title: 'Contact' },
];
---
<Legal
  title="Privacy Policy | Warmbly"
  description="How Warmbly collects, uses, stores, and protects your personal data and mailbox information. Read our full privacy policy and the choices you have."
  effective="2026-05-27"
  updated="2026-05-27"
  sections={sections}
>

<section id="who" class="scroll-mt-24">
  <h2>01. Who we are</h2>
  <p>
    Warmbly is operated by Mindroot Ltd, a company registered in England and Wales with company number 16543299. Our registered office is at 71-75 Shelton Street, London, England, WC2H 9JQ. We are the data controller for the personal data we collect about you as a user of Warmbly.
  </p>
  <p>
    For your customers' data that you process through Warmbly, you are the controller and we act as a processor on your behalf, governed by the data processing terms we agree with you.
  </p>
</section>

<section id="scope" class="scroll-mt-24">
  <h2>02. Scope of this policy</h2>
  <p>
    This policy describes how Mindroot Ltd handles personal data through the Warmbly platform, including the marketing website, the web application, the APIs, the workers, and any related services. It does not cover third-party services that you connect to Warmbly, which are governed by their own privacy policies.
  </p>
</section>

<section id="data" class="scroll-mt-24">
  <h2>03. Data we collect</h2>
  <h3>Account data</h3>
  <ul>
    <li>Name and email address you sign up with.</li>
    <li>Workspace name and role assignments.</li>
    <li>Billing identifiers provided by our payment processor Stripe. We do not see or store full card numbers.</li>
  </ul>
  <h3>Mailbox data</h3>
  <ul>
    <li>OAuth refresh and access tokens, or encrypted IMAP and SMTP credentials, for mailboxes you connect.</li>
    <li>Mailbox metadata such as folder structure, authentication status, and sender identity.</li>
  </ul>
  <h3>Message data</h3>
  <ul>
    <li>Cold outreach messages, warmup messages, and replies that pass through Warmbly.</li>
    <li>Recipient addresses and contact records you upload or import.</li>
    <li>Tracking events such as opens, clicks, bounces, complaints, and unsubscribes.</li>
  </ul>
  <h3>Usage data</h3>
  <ul>
    <li>Logs, error reports, and session events generated by your use of the Service.</li>
    <li>Limited diagnostic information such as user agent, IP address, and request timing, retained for security and abuse prevention.</li>
  </ul>
</section>

<section id="use" class="scroll-mt-24">
  <h2>04. How we use your data</h2>
  <ul>
    <li>To operate, maintain, and improve the Service.</li>
    <li>To send mail and warmup traffic on your behalf through your connected mailboxes.</li>
    <li>To compute deliverability and mailbox health signals such as warmup spam scores, suppression lists, and per-mailbox health states.</li>
    <li>To prevent abuse, fraud, and breach of our acceptable use rules.</li>
    <li>To bill you and to keep accurate financial records.</li>
    <li>To respond to support requests and to communicate service updates.</li>
    <li>To comply with legal obligations.</li>
  </ul>
</section>

<section id="legal-basis" class="scroll-mt-24">
  <h2>05. Legal bases for processing</h2>
  <ul>
    <li><strong>Contract.</strong> Processing necessary to deliver the Service you have signed up for.</li>
    <li><strong>Legitimate interest.</strong> Processing necessary to keep the platform secure, to prevent abuse, and to improve our product.</li>
    <li><strong>Consent.</strong> Where required, for optional features such as product analytics or marketing emails.</li>
    <li><strong>Legal obligation.</strong> Processing required to comply with applicable law, including tax, accounting, and lawful requests from authorities.</li>
  </ul>
</section>

<section id="encryption" class="scroll-mt-24">
  <h2>06. Encryption and storage</h2>
  <p>
    Sensitive credentials and message payloads are protected using envelope encryption. AWS Key Management Service is the root of trust. Each user gets a 32-byte data encryption key (DEK), generated by KMS. The encrypted DEK ciphertext is stored in PostgreSQL. The plaintext DEK is held only in memory, cached briefly in Redis with a short time-to-live, and used to encrypt and decrypt fields at the application layer with AES-256-GCM.
  </p>
  <p>
    Control-plane state lives in PostgreSQL. Object storage uses S3. Workers do not hold a PostgreSQL connection and operate over Kafka, KMS, S3, and Redis only (reaching control-plane data such as encrypted DEKs over the backend's internal API). All traffic between you and Warmbly is protected in transit by TLS 1.2 or higher.
  </p>
</section>

<section id="sharing" class="scroll-mt-24">
  <h2>07. Sharing with third parties</h2>
  <p>
    We share personal data with infrastructure and operational providers that we depend on to run Warmbly. These include AWS for compute, storage, encryption, and queues, Cloudflare for edge security and bot protection, Stripe for billing, and the email providers you connect to Warmbly.
  </p>
  <p>
    We do not sell personal data. We do not share personal data with advertisers. We will disclose personal data when required by law, when we have your consent, or when necessary to investigate or stop abuse.
  </p>
</section>

<section id="retention" class="scroll-mt-24">
  <h2>08. Data retention</h2>
  <ul>
    <li>Account data is retained while your account is active and for a reasonable period after closure to allow recovery and to comply with our legal obligations.</li>
    <li>Mailbox credentials are deleted promptly when you disconnect a mailbox or close your account.</li>
    <li>Message and tracking data are deleted on a defined schedule after account closure, except where retention is required by law.</li>
    <li>Suppression lists are retained for as long as needed to honour unsubscribe and complaint requests on your behalf.</li>
    <li>Billing records are retained for the period required by applicable accounting and tax law.</li>
  </ul>
</section>

<section id="rights" class="scroll-mt-24">
  <h2>09. Your rights</h2>
  <p>
    Subject to applicable law, you have the right to access, rectify, delete, restrict, port, and object to processing of your personal data. You also have the right to withdraw consent where consent is the basis for processing, and the right to lodge a complaint with a supervisory authority.
  </p>
  <p>
    The UK supervisory authority is the Information Commissioner's Office. You can exercise your rights by emailing <a href="mailto:hello@warmbly.com">hello@warmbly.com</a>.
  </p>
</section>

<section id="transfers" class="scroll-mt-24">
  <h2>10. International transfers</h2>
  <p>
    Warmbly is operated from the United Kingdom and processes data through infrastructure providers that operate globally. Where personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or adequacy decisions where they apply.
  </p>
</section>

<section id="children" class="scroll-mt-24">
  <h2>11. Children</h2>
  <p>
    Warmbly is a business tool and is not intended for use by children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data to Warmbly, please contact us and we will remove it.
  </p>
</section>

<section id="changes" class="scroll-mt-24">
  <h2>12. Changes to this policy</h2>
  <p>
    We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. If we make material changes, we will notify you by email or through the Service before they take effect.
  </p>
</section>

<section id="contact" class="scroll-mt-24">
  <h2>13. Contact</h2>
  <p>
    For privacy questions, data subject requests, or any other matter arising under this policy, email <a href="mailto:hello@warmbly.com">hello@warmbly.com</a> or write to Mindroot Ltd, 71-75 Shelton Street, London, England, WC2H 9JQ.
  </p>
</section>

</Legal>
