1. Who We Are

Zedmail is a Canadian email infrastructure service operated under the trade name Zedmail at zedmail.io by Ozonagram Ltd, Suite M162, 110 Didsbury Road, Ottawa, Ontario K2T 0C2, Canada.

All data is stored on servers located in Canada.

For any questions about this policy, contact us at hello@zedmail.io.

2. Data We Collect

Category	Data	Purpose
Account information	Email address, name, language, billing currency, timezone	Creating and managing your account; contacting you about the service
Sending data	Sender and recipient email addresses, subject, message body, timestamp, delivery status	Email delivery, audit logs, bounce and complaint processing
Technical data	IP address (hashed for rate limiting), user agent, API requests	Security, abuse prevention, rate limiting
Billing data	Usage counters, Paddle customer ID (no card data stored by us)	Monthly invoicing and usage reporting
Tracking events	Open and click events (if enabled) — no IP address or device fingerprint stored	Deliverability statistics (opt-in per account)
Browsing statistics	Pages visited, referrer, device type — aggregated, cookieless, no personal identifier	Understanding site usage to improve our service (self-hosted Matomo, cookieless)

We do not collect browsing data for advertising purposes, use advertising trackers, or profile our users for commercial ends.

3. How We Use Your Data

• Providing and improving the email sending service
• Authenticating logins and API calls
• Detecting and preventing abuse, spam, and fraudulent activity
• Generating monthly invoices and usage reports
• Sending you important service notifications (terms changes, security alerts)
• Measuring aggregate site usage to improve our offering
• Complying with our legal obligations

We do not use your data for targeted advertising or to build profiles for purposes unrelated to the service.

4. Data Residency — Canada Only

All account and message data is stored exclusively on servers in Canada (OVH Canada, Montréal). We do not use US-based hosting services and are not subject to the US Cloud Act. Your data cannot be compelled by a US court order.

Our site analytics tool (Matomo) is self-hosted on our own OVH Canada infrastructure — no data is transmitted to any third party.

Our payment processor, Paddle (paddle.com), is a UK platform. Payment data (card numbers, etc.) is handled directly by Paddle and never passes through our servers.

5. Subprocessors

We do not sell your personal data. We engage the following subprocessors:

• OVH Canada (Montréal, Canada) — server hosting. All data remains in Canada.
• Paddle (London, UK) — payment processing. Paddle receives your email address and account ID to associate payments with your account. Paddle acts as Merchant of Record.
• Matomo Analytics — self-hosted on our own OVH Canada infrastructure. Cookies are disabled; no personal data is collected or transmitted outside our servers.
• Legal authorities — only where required by applicable Canadian law and to the extent permitted under Canadian law.

No sharing with advertising partners, data brokers, or non-essential third parties.

6. Data Retention

• Message logs: retained for 90 days (headers and status), then deleted. Message bodies are never stored after delivery.
• Account data: retained for the duration of your active account, plus 90 days following termination.
• Billing records: retained for 7 years in accordance with Canadian accounting requirements.
• Security logs (login attempts, API activity): retained for 30 days.
• Aggregate browsing statistics: retained for 13 months, then automatically deleted (Matomo retention policy).

7. Your Rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data from the Account page in your dashboard
• Delete your account and all associated data
• Export your account data in a common format (on request)
• Object to or request restriction of certain processing

To exercise these rights, write to hello@zedmail.io. We will respond within 30 days.

8. Security

We protect your data through:

• TLS encryption for all API and SMTP communications
• Passwords hashed with bcrypt (never stored in plaintext)
• Single-use API keys, stored as hashes
• Administrative access restricted to authorised personnel
• HTTP security headers (CSP, HSTS, X-Frame-Options)

No system is perfect. If you discover a security vulnerability, please report it responsibly to hello@zedmail.io.

9. Cookies and Analytics

We use a single functional session cookie to maintain your login. We do not use tracking cookies or advertising cookies.

We use Matomo Analytics, self-hosted on our own Canadian infrastructure, to understand aggregate usage of our website. Matomo is configured with cookies disabled — it does not set any cookies in your browser and does not collect personal data. No cookie consent banner is required.

10. Changes

We may update this policy from time to time. For material changes, we will notify you by email and by an in-dashboard notice. The date of the latest update is always shown at the top of this page.

11. Contact

For questions about this policy or your personal data:

Ozonagram Ltd
Suite M162, 110 Didsbury Road
Ottawa, Ontario K2T 0C2
Canada
hello@zedmail.io