Legal and privacy
Privacy Policy
This policy separates short-lived mailbox content from operational records so the 15-minute product promise is not mistaken for a claim that no metadata exists.
Reviewed by Dynamic Foundries · 10 September 2026
Mailbox access lasts 15 minutes and expired mailboxes are removed by scheduled cleanup. Dynamic Foundries also processes and retains source IP, generated-address, timing, access-log, usage, and support data for operation, security, and reporting.
Last updated: 14 October 2026.
1. Data controller
SASU Dynamic Foundries, 15 Boulevard Saint-Marcel, 75013 Paris, France, SIREN 102 801 206, operates MyraMail and is the data controller. Contact: contact@dynamic-foundries.com.
2. Data processed to provide the inbox
- Disposable address and internal credentials: random values used to create and access the temporary mailbox.
- Message content: sender details, headers, subject, body, and any material delivered to the mailbox. The web interface does not provide attachment downloads.
- Session token: a signed token stored in an HttpOnly, Secure, SameSite cookie for up to 15 minutes.
- Source IP and timestamps: used for rate limiting, security, abuse prevention, and operational reporting.
- Generation record: generated address, source IP, creation/update timestamps, generated internal credential fields, and final received-message count.
3. Mailbox and message lifecycle
A browser session expires 15 minutes after mailbox creation. A scheduled cleanup process identifies mailboxes older than 15 minutes and requests their deletion from the self-managed mail system. Physical deletion can therefore occur shortly after the timer rather than at the exact expiry second. The product offers no mailbox recovery after expiry.
The application database keeps a generation record after the Mailcow mailbox and its message content are removed. There is currently no automatic deletion period configured for those generation records. This data supports abuse investigation and internal usage reporting. We do not represent MyraMail as anonymous or “no trace.”
4. Web logs and support
Reverse-proxy and application access logs can include IP address, timestamp, requested path, response status, user agent, and referrer. The declared operational retention for web access logs is up to 12 months for security and legal purposes. Support and data-protection correspondence can be retained for up to three years after resolution when needed to document the request and response.
5. Purposes and legal bases
| Purpose | Legal basis under GDPR Article 6 |
|---|---|
| Provide the requested temporary inbox and receive its messages | Legitimate interests, Art. 6(1)(f) |
| Rate limiting, security, misuse prevention, service reliability, and usage reporting | Legitimate interests, Art. 6(1)(f) |
| Respond to legal obligations and valid authority requests | Legal obligation, Art. 6(1)(c), where applicable |
| Optional Google Analytics | Consent, Art. 6(1)(a) |
| Respond to support and privacy requests | Legitimate interests or legal obligation, depending on the request |
6. Cookies and analytics
The essential token cookie is set only when you generate a mailbox. It gives the current browser access to that inbox, is unavailable to page JavaScript, and expires within 15 minutes. It is necessary to provide the requested service.
Google Analytics is optional and does not load unless you select “Accept analytics.” Your accept/refuse choice is stored locally in your browser. If accepted, Google can set analytics cookies and process device, usage, and network information under its own terms. Refusing does not prevent mailbox use. Use “Cookie settings” in the footer at any time to change or withdraw consent; withdrawal disables analytics and removes available Google Analytics cookies.
7. Recipients and hosting
- OVH SAS, France: application, database, network, and mail-system infrastructure.
- Google LLC: optional analytics only after consent; processing can involve transfers outside the European Economic Area under applicable safeguards.
- Authorities: only when disclosure is legally required.
MyraMail does not sell mailbox content or generation records. Application and mail infrastructure is hosted in France, but the sender's own email provider and network are outside our control.
8. Security
Controls include HTTPS, TLS-configured mail transport, short-lived signed sessions, same-site cookie protections, rate limiting, restricted message rendering, and scheduled mailbox cleanup. No internet service or email transport can guarantee absolute security. Do not use MyraMail for confidential or high-impact content.
9. Your rights
Subject to GDPR conditions and exceptions, you may request access, rectification, erasure, restriction, portability, or objection, and may withdraw analytics consent. Email contact@dynamic-foundries.com with enough information to locate the relevant record. We may need to verify the request without collecting more data than necessary.
You may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
10. Children and changes
The service is not directed to children under 15. We may update this notice when product behavior, service providers, or legal requirements change; the date above identifies the current version.