Legal

Privacy Policy

Effective date: October 23, 2026

Operated by Junghard Software AB (org. nr. 559217-6753), Jans väg 5, Göteborg, Sweden.

Overview

Molted Mail ("we", "us", "our") is a managed mailbox service for AI agents, operated by Junghard Software AB (org. nr. 559217-6753) at molted.email. This policy explains what data we collect, why we collect it, who we share it with, and what rights you have over it.

We built Molted Mail for developers. This privacy policy is written the same way — clearly, with specifics, and without unnecessary legalese.

What We Collect

Account data

When you sign up, we collect your email address and password. Your password is salted and hashed — we never store it in plaintext. On signup we also generate a tenant identifier, a default mailbox, and API credentials tied to your account.

When you sign in to the dashboard, we also store a session record with the IP address and browser user agent the sign-in came from. We use it to keep you signed in, to show and end your sessions, and to detect abuse and protect your account. A session stays valid for up to seven days, renewed while you use it, and is deleted when you sign out and when your account is deleted.

Email sending data

When your agent sends email through our API, we process:

• Sender and recipient addresses
• Subject lines and message body content
• Headers and attachments included in the request

We store the messages your mailboxes send and receive, including their subject lines, bodies, and the original inbound message data, in conversation threads. This is how your account and your agents can read them, and it is not optional. We also keep metadata for each message (sender, recipient, timestamps, delivery status, provider used) for analytics and debugging. Message bodies, subjects and metadata stay until you delete them or your account is deleted. Retention is covered in the Data Retention section below.

Attachments

Files attached to messages you send or receive are stored in S3-compatible object storage (Cloudflare R2), so you and your agents can download them. Each plan deletes attachments automatically after a set number of days; see Data Retention below.

Delivery events

We track delivery lifecycle events — sent, delivered, opened, clicked, bounced, and complained — as reported by our underlying email providers. These events power your analytics dashboard and feed into policy enforcement (e.g., automatic suppression after bounces or complaints).

Business outcome data

If you use outcome attribution, we store the outcome events you report (e.g., "user signed up", "meeting booked") linked to the originating email. This data is yours and is used solely to power your outcome analytics.

API usage data and error logs

We count usage against your plan for rate limiting and billing, and our servers keep ordinary operational logs. When an API request fails (a 4xx or 5xx response), we also record an error entry with the route template, status, error code, your workspace ID, a one-way hash of your user ID, and a label for the client (for example browser, CLI or iOS app). It never contains request or response bodies, query strings, or email addresses. We use it for abuse prevention and to diagnose failures, and keep it for 30 days.

Waitlist and sign-up interest

If you leave your email address on a waitlist or sign-up interest form, we store the address, the use case you describe (optional), and which page or campaign you came from. We use it to send you one confirmation email and to tell you when sign-ups open. We rely on your consent for this. We keep the entry until you ask us to remove it: email privacy@molted.email.

Billing data

Payments for paid plans are processed by Stripe through its Managed Payments service, in which Link (Sold through Link, LLC) acts as the reseller and merchant of record. Stripe collects your payment details, billing address, and any tax information at checkout and handles that order data as the merchant, under the Stripe privacy policy. We store your subscription plan and usage counts. We do not store credit card numbers or full payment details on our servers.

Mobile app (Molted for iPhone)

The Molted iPhone app lets you decide, glance and stop sending when your agents need you. You sign in with your existing Molted account in the system browser; the app has no password field and cannot create accounts. When you use it, we collect and store:

• Device details: the name you gave the iPhone (for example "Anna's iPhone"), its platform (iOS), and the app version, so you can see and sign out your devices
• Push notification token: the token Apple issues to this app on this phone, and whether notifications are allowed, so we can tell the phone when something needs you
• Your decisions and requests: what you decide on a card (approve, reject, release, hand back, pause), and any search you type in Activity, sent to our servers to act on or answer it
• Your account details: your account email address and user ID, as for the web app

Sign-in tokens are kept in the iOS Keychain on the phone, only on that phone, and are removed when you sign out. If you turn on the app lock in the app's settings, Face ID or your passcode runs on the device and nothing from it ever leaves the phone. The app contains no analytics, advertising or crash-reporting software, and does not track you across other companies' apps or websites. Signing out removes the push token and the device's sign-in.

Cookies and Analytics

We use session cookies for authentication in the portal dashboard. These are strictly necessary: without them, you cannot stay logged in. They are HTTP-only and scoped to our domain.

We also set one functional cookie, molted_tid, that remembers which workspace you last picked in the dashboard (it lasts up to a year). The dashboard keeps small items in your browser's local and session storage for interface state, such as whether you have seen the first-run tour, a pending claim link, and your place in sign-up flows. These are strictly functional, are never used for tracking, and stay in your browser.

For website analytics, we run our own Plausible instance (plausible.chunky.dev). It sets no cookies and does not track individual users. It receives the page address only, without the query string or fragment, and is switched off on pages whose address carries a secret. We do not use Google Analytics, Facebook pixels, or any advertising trackers.

How We Use Your Data

• Service delivery — routing your emails through the best available provider, enforcing sending policies, managing suppression lists
• Authentication and authorization — verifying your identity via sessions (dashboard) and Bearer tokens (API)
• Policy enforcement — rate limiting, consent validation, jurisdiction checks, and abuse prevention
• Analytics — showing you deliverability metrics, outcome attribution, and usage dashboards
• Billing — tracking usage against your plan limits and processing subscription payments
• Service communications — sending you transactional emails about your account, and responding to support requests
• Reliability and debugging — monitoring service health, investigating delivery failures, and improving the platform

AI Processing

Molted Mail offers an optional AI-powered email humanization feature, which rewrites outgoing emails before they are sent. When humanization is turned on, we send the content of the emails it rewrites to a third-party AI provider for processing:

• Anthropic (Claude): for humanization

Important details about AI processing:

• Content sent to AI providers is processed in real time and is not used to train their models. We use API access with data processing agreements that prohibit training on customer data.
• Humanization is opt-in: it is off by default and runs only when you turn it on for your workspace or for an agent. Security classification is not opt-in: it runs on every email, as described in the Security Classification section below.
• You can stop humanization at any time by turning it off in your workspace settings or for the agent.

Security Classification

Molted Mail checks every email sent or received through the service for security threats, including phishing, malware, impersonation, prompt injection, and related signals. Some of these checks run on our own servers. In addition, we send the content of every inbound and outbound email to TypeSafe, whose Jev model classifies it automatically.

• What is sent: for an inbound email, the subject, the body, and a summary of the sender: the From address and display name, the Reply-To address, and the SPF, DKIM and DMARC results. For an outbound email, the subject and body, and only the recipient's domain, not the full recipient address. We also send a mailbox's display name to be screened when you set it on the shared domain.
• What the answers are used for: the model's answer about prompt injection is combined with our own checks and can change how an inbound message is handled, for example by holding it for review. The model's other security answers (phishing, malware, impersonation and similar), its answers on outbound mail and the display-name screening are recorded for evaluation and do not change what happens to a message. We also ask whether an inbound message is an unsubscribe request, an out-of-office reply, or which kind of message it is. Those answers are only logged, are not used to act on the message, and are kept for 30 days.
• Not opt-in: security classification runs on every email as part of the service's security protections. It is separate from humanization, which stays opt-in.
• Rollout: for accounts created on or after October 10, 2026, security classification applies from signup. For accounts created before that date, it applies starting November 9, 2026.
• Zero data retention: TypeSafe deletes the request content once it has returned its output. It retains only operational telemetry (billing and usage data).
• No training: TypeSafe does not train models on customer data.
• Location and safeguards: TypeSafe processes this data in the United States under its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.

Third-Party Services

We share data only with the service providers required to operate Molted Mail. Here is exactly who and why:

• Apple: delivers the Molted iPhone app's push notifications through the Apple Push Notification service (APNs). Apple receives the phone's push token and the notification we send. That payload carries opaque ids, the kind of notification, a generic line such as "Needs you now" or "Your agent archived a mailbox", and the address of the agent mailbox it concerns. It never carries the subject, sender or body of any email, or a card's title or summary.
• Resend, Postmark, Amazon SES — email delivery providers. They receive sender address, recipient address, subject, headers, and message body to deliver your emails. Each provider has their own privacy policy and DPA.
• Anthropic: AI processing provider for humanization (only when humanization is turned on). It receives email content for real-time processing. See the AI Processing section above.
• TypeSafe: security classification provider. It receives the content of every inbound and outbound email for automated security classification, in the United States, with zero data retention. See the Security Classification section above.
• Stripe (including Link) — processes subscription payments and stores payment methods. For paid plans, Link acts as the reseller and merchant of record (see Billing data above).
• Cloudflare: network security, DDoS protection, and traffic routing, and object storage (R2) for attachments. All traffic to our API, mailbox, and MCP endpoints (api.molted.email, mailbox.molted.email, and mcp.molted.email) passes through Cloudflare, which terminates TLS at its edge. Cloudflare therefore processes the content of these requests and their responses in transit, including the content of emails sent, received, or read through these endpoints. Cloudflare operates a global network and processes this data under its standard Data Processing Addendum. Cloudflare R2 also stores the attachments of your messages (see Attachments above).
• Vercel: hosts our website and dashboard (molted.email), our documentation site, and our internal admin site. It receives request data, including IP addresses, cookies, and form submissions such as sign-up and waitlist forms. Dashboard requests to our API also pass through Vercel, including the email content you view or send in the dashboard. Vercel processes this data in the United States under its Data Processing Addendum.
• Infrastructure providers — hosting, database, and CDN services that run the platform.
• Plausible Analytics: cookie-free website analytics that we host ourselves (plausible.chunky.dev). It is our own service, not a third-party provider, and receives the page address only.

We do not sell your data. We do not share data with advertisers. We do not monetize your data in any way beyond providing the service you pay for.

Data Retention

• Account data: kept while your account exists. When you request deletion, there is a 7-day grace period in which you can cancel; after that your workspace data and your account are erased. If your account is terminated, our Terms give you 30 days to ask for an export before we delete your data, and backups may keep it for up to 90 days longer, as the Terms describe.
• Sessions: valid for up to seven days from your last activity, and deleted when you sign out or your account is deleted.
• Message content (subjects, bodies, original inbound message data and the content of sends): kept until you delete it, or until your account is deleted. You can delete a conversation, delete a mailbox (it can be restored for 14 days, then it is purged), delete the content of all your messages at once, or erase everything about one contact (signed-in account owners can use these tools, see our GDPR documentation). A workspace can also have an automatic content-retention period that clears bodies and raw message data older than it; none of our standard plans sets one.
• Email metadata (sender, recipient, timestamps, delivery status, threads): kept while your account exists and deleted with it. We do not delete it on a schedule.
• Attachments: deleted automatically after a number of days that depends on your plan: 7 days during the initial trial before a plan is activated, 14 days on Free, 30 days on Solo, 90 days on Team, and 365 days on Enterprise. Plans that ended keep the period they had, plus 30 days.
• Delivery events: deleted after 90 days, except bounce and complaint records, which we keep for 1,095 days (three years) to meet anti-spam law requirements.
• Outcome data (the outcome events you report and their attribution to emails): kept while your account exists and deleted with it.
• Error logs: 30 days (see API usage data and error logs above).
• Waitlist entries: kept until you ask us to remove them.
• Billing records: retained as required by tax and financial regulations
• Deleted accounts: when an account is deleted, we keep only a keyed hash (HMAC) of its email address, never the address itself, so that a returning address does not get a second free trial. This is fraud and abuse prevention, on the basis of our legitimate interest. The same address can always sign up again.

Security

We take security seriously. Here is what we do:

• All data in transit is encrypted via TLS
• Passwords are salted and hashed using modern algorithms
• API keys are hashed at rest — we cannot read them after creation
• Data access is tenant-isolated — your data is logically separated from other customers at the database level
• Sessions use HTTP-only, secure cookies with short expiration windows

For more on how we handle AI-specific security concerns, see our Security Knowledge Base.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Access — request a copy of all personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request that we limit processing of your data
• Portability — request your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

Our legal bases for processing are: performance of our contract with you (service delivery, billing), legitimate interest (security, including automated security classification of email content, abuse prevention, service improvement), and consent (optional AI features such as humanization, waitlist sign-ups, marketing communications where applicable).

To exercise any of these rights, email privacy@molted.email. We will respond within 30 days.

Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act gives you the following rights:

• Right to know — request what personal information we collect, use, and disclose
• Right to delete — request deletion of your personal information
• Right to opt out of sale — we do not sell your personal information, so there is nothing to opt out of
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise these rights, email privacy@molted.email. We will verify your identity and respond within 45 days as required by law.

International Data Transfers

Molted Mail is operated by Junghard Software AB from Sweden. Our infrastructure and third-party email delivery providers may process data in various regions, including the United States, depending on their infrastructure. We ensure appropriate safeguards are in place for international transfers through standard contractual clauses and data processing agreements with our providers, in accordance with GDPR requirements.

Our security classification provider, TypeSafe, processes email content in the United States under its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.

Children

Molted Mail is a developer tool, not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to This Policy

We may update this policy as our service evolves. For material changes, we will notify you via email or a notice in the dashboard at least 30 days before the changes take effect. The "effective date" at the top of this page always reflects the latest version.

Contact

Data controller: Junghard Software AB (org. nr. 559217-6753), Jans väg 5, Göteborg, Sweden.

For privacy-related questions or to exercise your data rights:

• Email: privacy@molted.email
• General inquiries: hello@molted.email