Privacy Policy
Effective: August 1, 2026
Arslaan Ltd (company number 16667689), trading as MailOn.Cloud, is responsible for the MailOn.Cloud website, customer platform and native applications. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Privacy questions may be sent to [email protected].
Scope and roles
This policy covers visitors, prospective customers, account administrators and users of MailOn.Cloud services and applications. For business mailbox content, the customer organisation normally decides why its users process email, contacts and calendar information. In that context, the customer is generally the controller and Arslaan Ltd processes the information to provide the contracted service. Arslaan Ltd is controller for account administration, billing, security, support, abuse prevention and its own business operations.
Information we process
Depending on how you use MailOn.Cloud, we process account and contact details, domain and mailbox configuration, authentication and session records, subscription and billing references, support communications, security and diagnostic logs, device and application information, and information needed to prevent fraud or abuse.
Providing email services requires processing message content, headers, participants, attachments and delivery metadata. The native application may also process MailOn.Cloud contacts and calendar records, encrypted offline copies, queued mailbox actions, drafts, attachment metadata and notification preferences.
How the native application works
The application connects only to controlled MailOn.Cloud services. Mailbox passwords are used to establish a server session and are not persisted by the application. Offline mailbox, draft, contact, calendar and attachment data is stored in an account-scoped SQLCipher database. Database keys and session records use operating-system secure storage.
Notifications are off until a user enables them. Privacy-minimal notifications show a generic count unless the user separately enables sender and subject previews. Message bodies are not used in notification previews.
Remote sender images are blocked by default. A user may explicitly request them through the MailOn.Cloud image proxy. The proxy can conceal the device network address from the sender-controlled host, but fetching an image may still indicate that the message was viewed. Attachment download, opening, saving and sharing occur only after explicit user action.
Purposes and lawful bases
We use information to provide and secure contracted services, authenticate users, synchronize and deliver mail, process requested mailbox actions, support customers, administer subscriptions, detect abuse, maintain reliability and comply with legal obligations. We rely principally on performance of a contract, compliance with legal obligations and legitimate interests in operating a secure and dependable business email service. Where a feature requires consent, such as optional notification previews or another optional disclosure, consent can be withdrawn through the relevant application or account setting.
Sharing and processors
Information may be handled by infrastructure, data-centre, security, malware-scanning, payment, support and communications providers where needed to deliver the service. They are restricted by contract and may use information only for the services they provide to us. We may disclose information where required by law, to protect users or systems, or in connection with a corporate transaction subject to appropriate protections. We do not sell personal information or use native mailbox content for advertising.
International transfers
Some service providers or support operations may involve access from outside the United Kingdom. Where UK transfer rules apply, we use an available lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and apply appropriate technical and organisational controls. You may request information about the safeguards relevant to your data.
Retention
Mailbox content is retained according to the customer's service and deletion choices. Account, billing, security and support records are kept only for as long as needed to provide services, protect systems, resolve disputes and meet legal or accounting requirements. Encrypted offline data remains on a device until the user clears it, removes the account or uninstalls the application, subject to operating-system behaviour. Temporary exported files are removed on a best-effort basis, while user-selected saved or shared copies remain under the user's control.
Security
We use encryption in transit, encrypted offline storage, operating-system secure credential facilities, account isolation, bounded access, malware scanning and other technical and organisational controls. No system is completely secure, and customers must protect account and device credentials and report suspected compromise promptly.
Your choices and rights
Depending on applicable law and our role, you may request access, correction, deletion, restriction, objection or portability. You may withdraw consent where processing relies on consent. Business mailbox users should normally contact their organisation's administrator first because the organisation may control the mailbox data. Requests to Arslaan Ltd may be sent to [email protected]. We may need to verify identity and may retain information where law or overriding security obligations require it.
You may complain to the UK Information Commissioner's Office or another competent supervisory authority. We encourage you to contact us first so we can investigate.
Children
MailOn.Cloud is a business email service and is not directed to children. Organisations that provide accounts to children are responsible for ensuring an appropriate lawful basis, notices, permissions and safeguards.
Changes
We may update this policy when services, providers or legal requirements change. The effective date above identifies the current version. Material changes will be communicated where required.