Privacy Policy

Kerabie Mail ("Kerabie", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy describes what data we collect, how we use and store it, who we share it with, and the rights you have over your information.

By creating an account or using any Kerabie Mail service — including the web application, mobile apps, or API — you agree to the practices described in this policy.

1. Information We Collect

Account information

• Full name and email address provided at registration
• Username chosen for your @kerabie.email mailbox
• Phone number, collected and verified via OTP (Termii) during signup
• Country and currency preference (used to display localised pricing)
• Password — stored only as a bcrypt hash; we never store plain-text passwords

Email content and metadata

• Email messages you send and receive — stored to deliver the service
• Sender and recipient addresses, subject lines, timestamps, and attachment metadata
• IMAP folder structure and mailbox configuration
• Draft content saved automatically by the compose editor

Device and technical data

• IP address and approximate location (country / region) at login
• Browser type and version, or mobile OS and app version
• Device identifiers and Expo push token (mobile app, for push notifications)
• Session tokens and device IDs (stored server-side; HMAC-signed)
• HTTP request logs — retained for 30 days for security and debugging

Payment information

• Subscription plan, billing cycle, and payment status
• Invoice history and transaction references
• Card-type indicator and last 4 digits (returned by our payment processors — we never store full card numbers)
• Nigerian bank account references for Paystack bank-transfer payments

Referral and tracking cookies

• Referral source cookie (set when you arrive via a partner link) — 30-day TTL
• Partner code stored to attribute commissions accurately
• No third-party ad-tracking cookies are set on any Kerabie page

2. How We Use Your Information

Service delivery

• Creating and authenticating your account
• Sending, receiving, storing, and delivering email messages
• Powering features: labels, aliases, contacts, calendar, AI compose, scheduled send, forwarding rules, autoresponders
• Generating and validating Expo push tokens for new-email notifications (mobile)
• Authenticating IMAP and SMTP sessions for connected accounts

Security and fraud prevention

• Detecting and blocking spam, phishing, and malware in transit
• Verifying your phone number via OTP to prevent fake account creation
• Rate-limiting sending to enforce plan limits and prevent abuse
• Monitoring for unusual login activity and revoking compromised sessions
• Maintaining audit logs of account actions (Pro and Premium)

Billing and subscriptions

• Processing payments via Paystack (NGN) and Paddle (USD/international)
• Generating invoices and sending payment receipts via Brevo transactional email
• Enforcing plan limits (storage, mailboxes, aliases, AI requests)
• Sending renewal reminders and payment-failure notifications via push and email

Partner and referral tracking

• Attributing sign-ups to the correct partner for commission calculation
• Tracking trial activations and conversions linked to reseller accounts
• Reporting monthly commission summaries to hosting partners

Product improvement

• Aggregated, anonymised usage statistics (feature adoption, session length)
• Error and crash reporting to diagnose bugs (no email content included)
• Performance monitoring to improve server response times

Billing reference — plan pricing

The following pricing determines what payment data we process and store. USD payments are handled by Paddle; NGN payments by Paystack. We store transaction references and amounts but never full card numbers.

2-year (30% off) and 3-year (40% off) billing periods are also available. Add-ons: extra 10 GB storage at $1 / ₦800 per month; extra mailbox at $2 / ₦1,500 per month. Full pricing at kerabie.email/pricing.

3. Storage and Security

Encryption at rest

• All email data is stored encrypted with AES-256 on the mail server (Mailu / Dovecot)
• IMAP and SMTP credentials for connected external accounts are encrypted with AES-256 before being written to the database; the master wrapping key is stored separately from the data
• Passwords are hashed with bcrypt (cost factor 12) — never stored in recoverable form
• Session tokens are HMAC-SHA256 signed; refresh tokens are stored as hashed values

Encryption in transit

• All web traffic is served over TLS 1.2 / 1.3 (HTTPS enforced, HSTS enabled)
• IMAP connections require SSL/TLS on port 993; SMTP requires STARTTLS on port 587 or SSL on port 465
• Internal service-to-service traffic (API ↔ Redis ↔ database) is within an isolated private network

Infrastructure and access controls

• Mail server and API hosted on dedicated VPS with firewall rules; non-essential ports blocked
• Database access restricted to application service accounts; no direct public access
• Redis (session and cache store) is network-isolated and password-protected
• Employee access to production systems requires SSH key authentication and VPN; access is logged
• Automated backups run daily; backups are encrypted and retained for 30 days

4. Email Content Privacy

Automated spam and virus filtering is performed by Mailu's built-in Rspamd and ClamAV engines at the SMTP layer — the same way all professional mail servers work. This is a technical necessity to protect recipients from malware. No human at Kerabie reads the output of these filters beyond aggregate spam statistics.

We will never:

• Read, index, or analyse your email content for advertising
• Use the content of your emails to train AI models
• Share the content of your emails with third parties except as required by law (see Section 5)
• Target ads to you based on keywords in your emails

AI Compose (Pro and Premium plans) sends only the prompt you type — not your existing emails — to Google Gemini. Prompts are not stored by us beyond the request-response cycle and are not used to train any model.

5. Sharing Your Information

We do not sell your data. We share information only in the following limited circumstances:

Service providers (sub-processors)

All sub-processors are bound by data processing agreements and may only use your data for the specified purpose.

Legal process

We may disclose information if required by a valid court order, subpoena, or applicable law. Where legally permitted, we will notify affected users before disclosure. We will never provide access to email content in bulk or in response to informal law-enforcement requests.

Business transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred. We will provide 30 days' advance notice via email and this page before any such transfer occurs.

6. Email Open Tracking

Kerabie Mail offers email open tracking as a Premium plan feature. When tracking is enabled for a specific message, a small 1×1 pixel image is embedded in the email. When the recipient opens the email, the pixel load is recorded and we notify you that the email was opened.

What is recorded

• Timestamp of the open event
• Approximate location (country) derived from the recipient's IP
• Email client / device type (from user-agent string)

How to identify tracked emails

Tracked emails display a tracking indicator in the compose window before sending. Recipients can identify tracking pixels by inspecting the raw message source for a link to track.kerabie.email.

How to disable tracking

• As a sender: disable tracking per-message in the compose window, or disable it globally in Settings → Tracking
• As a recipient: load emails in a client that blocks remote images by default (most modern clients do this)

7. Advertising — Free Accounts

Free plan accounts are supported by advertising displayed in the webmail interface and mobile app.

• Ads are served by Google Mobile Ads (AdMob) in the mobile app and a partner ad network in the webmail
• Ads are <strong>not</strong> targeted based on your email content
• Ads may be contextually matched to the page you are viewing (e.g. a generic email interface ad)
• Standard device advertising identifiers (IDFA on iOS, GAID on Android) may be used by the ad SDK subject to your device-level ad tracking preference
• Upgrading to Pro or Premium removes all advertising permanently

8. Your Rights

Regardless of your location, you have the following rights over your personal data:

To exercise any right, contact us at privacy@kerabie.email. We will respond within 30 days. Account deletion requests submitted through the app are processed immediately.

Data retention after deletion

• Account and profile data: deleted immediately on account deletion
• Email content: deleted from mail servers within 7 days of account deletion
• Encrypted backups: purged within 90 days
• Payment records: retained for 7 years as required by Nigerian tax law
• Server logs: deleted after 30 days

9. Cookie Policy

Essential cookies are required for the service to function and cannot be disabled. Analytics cookies require your explicit opt-in. You can manage cookie preferences at any time via Settings → Privacy, or by clearing cookies in your browser.

10. Changes to This Policy

We will provide at least 30 days' advance notice before any material change to this Privacy Policy takes effect. Notice will be given by:

• Email to the address associated with your account
• An in-app banner in the webmail and mobile app
• An update to the "Last updated" date at the top of this page

For non-material changes (corrections, clarifications), we may update the policy without prior notice. Continued use of Kerabie Mail after a material change takes effect constitutes acceptance of the updated policy.