Legal
The data controller for personal data processed about you (account holder) is LIMERION GmbH, Liechtenstein (contact details in the Imprint). For data you send through the Service, including your end-users' email addresses, message bodies, and form submissions, we act as a processor on your behalf under our DPA.
When a visitor submits one of your mailnix Forms (on a hosted page at forms.mailnix.ch or through an embed on your site), we process the submission on your behalf. The submitter's IP address is processed transiently for rate limiting and spam scoring. Uploaded files are scanned for malware before they are made available to you. We never use submitter data for our own purposes, and the Service sends no automatic email to the person who filled in a form: emails to a submitter are sent only when you explicitly trigger them, and each such send is recorded in an audit log.
As the publisher of a form, you are the controller for the data it collects. You configure a retention window per form; expired submissions and their files are deleted automatically. You can also delete every submission for a given submitter email in one action.
To keep accounts secure, investigate abuse, and support you effectively, we record how your account uses the dashboard and the APIs: the name of the page or screen you navigate to, the name of the operation or API endpoint you call, the name of the AI-tool action you invoke, together with a session identifier, your IP address, your browser's user-agent string, and a timestamp. We record names only. We never record page contents, the values you type into forms or fields, query parameters, or request bodies.
You can see everything this produces about you, in full, under Settings, Sessions & Activity in the dashboard: your signed-in sessions per device and your own activity trail. The same page lets you sign out any individual session. When our staff view an individual account's activity, that access itself requires elevated authentication and is written to an access log naming the staff member, which we keep for 365 days.
Activity records are kept for 90 days and then deleted automatically; live-session records expire 24 hours after a session goes quiet. Account erasure (section 9) deletes your activity and session records immediately; entries in the staff access log are retained with your identifier replaced by an irreversible pseudonym, so the record that an access took place survives without identifying you. The legal basis is our legitimate interest in securing the Service (Art. 6(1)(f) GDPR); we do not use these records for marketing or profiling, and we do not share them.
We process account data to operate your account (contract performance), usage data and account activity records to operate and secure the Service (legitimate interest), and customer content, including form submissions, strictly to perform the Service for you (processor role under your instructions).
We measure Google Ads conversions server-side: no Google script ever loads on this site or in the dashboard, and Google sets no cookies on our domain. When you arrive through a Google ad, the ad-click identifier from the URL (gclid, gbraid, or wbraid) is stored in a first-party cookie (mx_ad_click) on mailnix.ch for up to 90 days, together with the landing time and your consent state. That cookie stays with us. Nothing is sent to Google unless you choose "Allow" in the consent notice on this site; if you decline, we store that choice in a single cookie (mx_ads_consent) so we do not ask again, the click identifier is never transmitted anywhere, and nothing else happens.
If you allow it and later create an account (or upgrade to a paid plan), our servers report that one conversion event to the Google Ads API: the stored click identifier, the event time, for upgrades the plan price, a pseudonymous order reference, and your consent state. No name, email address, IP address, or browser data is included. Google Ireland Ltd. processes this data as an independent controller; see Google's own privacy policy for details. The legal basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time by deleting the mx_ads_consent cookie for mailnix.ch in your browser; consent is re-checked before every upload, so after withdrawal no further events are reported. The stored attribution is erased with your account through the standard erasure cascade. We run no analytics product, we do not use this data for profiling beyond ad attribution, and the dashboard shows no ads.
Form submissions follow the per-form retention window you configure; expired submissions and uploaded files are purged automatically. Account activity records are kept for 90 days and live-session records for 24 hours, as described in section 4. Traces, message metadata, and usage records are retained while your account is active and are deleted through the erasure cascade when you delete your account or invoke the DSAR endpoint. Account and billing data is kept for the lifetime of the account plus 90 days after closure for billing and audit, then erased, except where statutory retention obligations require longer.
Under GDPR you have rights of access, rectification, erasure, restriction, portability, and objection. Most are self-serve from the dashboard; the DELETE /v1/account/data endpoint runs the full erasure cascade across every user-attributed row. If you are the visitor of a site using mailnix Forms, please contact the site operator first; they control the data and we assist them in fulfilling your request.
Privacy questions: privacy@mailnix.ch. Security disclosures: security@mailnix.ch.