Privacy Policy — ITViet Mail

1. Introduction

VELUMO s.r.o. (IČO: 23424559), operating under the ITViet.cz brand, provides the ITViet Mail email service: webmail and the ITViet Mail app for iOS and Android. We are committed to protecting your privacy and personal data in compliance with GDPR (EU Regulation 2016/679) and Czech law.

If your mailbox was set up by your organization (e.g. a company email), that organization is the data controller and we process data on its behalf.

2. Data We Collect

We only collect data needed to provide the email service:

• Account: email address and display name. Your password is used only for authentication; the app does not store it on your phone.
• Mailbox content: messages, attachments, contacts, calendar, signature and settings — stored on our mail server to provide the service.
• Device info (mobile app): device name, platform, the device public key, push notification token, time and IP address of last use.
• Security logs: IP address, browser or app information, sign-in time.
• Read receipts (only if you turn them on when sending): when and how many times the recipient opened the message.

3. Purpose

• Providing and operating the email service per contract
• Delivering new-mail notifications to your devices
• Protecting your account: device authentication, detecting unauthorized sign-ins, preventing password guessing
• Technical support and customer care
• Legal compliance (accounting, tax, etc.)

We do not use your data for advertising.

4. Data Sharing

We do not sell your personal data or share it with third parties for marketing. Data is shared only:

• When necessary to provide the service: Cloudflare (carries HTTPS connections to our server), Apple Push Notification service and Google Firebase Cloud Messaging (deliver push notifications). The sender and subject inside a notification are end-to-end encrypted with a key unique to each device; Apple and Google only see encrypted data and a generic alert without any message content.
• When required by law or by competent authorities
• With your explicit written consent

The app contains no advertising, analytics or third-party tracking.

5. Data on Your Device

• The app caches messages, drafts and attachments in the app's private storage for fast access.
• Sign-in tokens are kept in the Keychain (iOS) or encrypted with the Android Keystore.
• Face ID and fingerprint are handled by the operating system; the app never receives biometric data.
• Photos and files are accessed only when you pick them as attachments.
• Signing out deletes sign-in data and cached mail from the device.

6. Retention

• Mailbox content: until you delete it or the mailbox is closed.
• Devices: until you sign out. A device unused for more than 60 days is revoked automatically and deleted 30 days later.
• Read receipts: 180 days.
• Security logs: as long as needed to protect the system.

How to delete your account and data: https://webmail.itviet.eu/delete-account

7. Your Rights (GDPR)

• Access — Request to see data we hold about you
• Rectification — Request correction of inaccurate info
• Erasure — Request deletion (within legal limits)
• Restriction — Request to pause processing
• Portability — Receive data in machine-readable format
• Object — Object to processing for specific purposes

Contact: [email protected]

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

8. Security

• TLS encryption for all connections
• Each device authenticates with its own key; access tokens are short-lived
• Two-factor authentication support
• Firewall and intrusion monitoring
• Data stored on servers in the Czech Republic (EU)
• Administrative access only via VPN

9. Cookies

Webmail uses only the cookies needed to keep you signed in; no analytics or advertising cookies.

10. Contact

VELUMO s.r.o. (ITViet.cz)

IČO: 23424559

Email: [email protected]

Tel: +420 730 828 999

Web: itviet.cz