1. Who we are
MailToucan (“we”, “us”) provides a WiFi marketing and email marketing platform. This policy explains how we handle personal data. We act in two roles:
- Controller for information about our customers and website visitors (account, billing, support and usage data).
- Processor / service provider for personal data of our customers’ guests and contacts (for example people who log in to a customer’s guest WiFi). Our customers decide why and how that data is used. See the Data Processing Agreement. If you are a guest of one of our customers, please read that business’s privacy notice and contact them first.
2. Data we collect about our customers and visitors
- Account data: name, business name, email, phone, role, country.
- Billing data: plan, invoices and transaction records. Card details are handled by our payment provider (Lemon Squeezy); we do not store full card numbers.
- Usage and device data: features used, emails sent, login activity, IP address, browser and device type, and approximate location.
- Support and communications: messages you send us and your marketing preferences.
- Cookies and similar technologies, as described in our Cookie Policy.
3. Data we process for our customers (guests and contacts)
Depending on how our customers configure their portal, this can include name, email address, birthday, phone number, survey and game responses, preferences, device identifiers (such as a MAC address for network authentication), visit times and frequency, and marketing consent records. We process it only on our customers’ instructions, to run the Services. We do not sell it, use it for our own marketing, or share it with other customers.
4. How we use personal data and our legal bases
| Purpose | Examples | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Provide the Services | Create accounts, authenticate, deliver emails, power the CRM and Tou-can | Contract |
| Billing and fraud prevention | Payments, tax records, abuse detection | Contract; legal obligation; legitimate interests |
| Security and deliverability | Monitoring, blocking abuse, protecting email reputation | Legitimate interests |
| Support and communication | Responding to enquiries, service notices | Contract; legitimate interests |
| Product improvement and analytics | Aggregated usage analysis | Legitimate interests; consent where required |
| Marketing to our own customers and prospects | Product news and offers | Consent or legitimate interests; you can opt out any time |
| Legal compliance | Responding to lawful requests | Legal obligation |
6. International transfers
MailToucan serves customers worldwide, so data may be processed in countries other than your own. Where required, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, and we require sub-processors to protect data to equivalent standards.
7. Retention
- Account and Customer Data: for the life of the subscription plus 30 days after termination, then deleted.
- Payment and tax records: up to 7 years, as required by law.
- Email send logs: about 90 days for deliverability and compliance.
- Backups roll off on a rolling schedule after deletion.
8. Security
We use encryption in transit (TLS) and at rest, access controls, network protection and monitoring, and we review our security regularly. See Data and Security. If a personal-data breach affects you we will notify affected customers without undue delay and, where required, within 72 hours of becoming aware.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. To exercise a right, email hello@mailtoucan.com. We respond within the time required by law (generally within 30 days). You may also complain to your local data-protection authority. We will not discriminate against you for exercising your rights.
10. Region-specific information
- European Economic Area and United Kingdom: the rights and legal bases above apply.
- California and other US states (CCPA/CPRA and similar): in the last 12 months we collected the categories of personal information listed in Section 2 for the business purposes in Section 4. We do not sell or share personal information for advertising. You may request to know, access, correct or delete your information and may use an authorised agent.
- Canada (PIPEDA/CASL), Australia (Privacy Act, Spam Act), Brazil (LGPD) and other jurisdictions: we apply equivalent protections and honour the rights applicable to you.
11. Children
The Services are not directed at children. Customers must not collect personal data from children under 13 (or the higher age set by local law) through the platform. If you believe a child’s data has been collected, contact hello@mailtoucan.com.
12. Changes
We may update this policy and will notify customers of material changes by email at least 14 days before they take effect. The current version is always at www.mailtoucan.com/privacy.html.
13. Contact
Privacy questions and requests: hello@mailtoucan.com. General enquiries: hello@mailtoucan.com
Questions? Contact hello@mailtoucan.com. See all legal documents.