Privacy Policy
Last updated: October 18, 2026
This policy explains which personal data mxproxy (an email forwarder operated by Leettech — CASP SOLUÇÕES INFORMÁTICA LTDA, CNPJ 16.694.290/0001-50, Brazil, “we”) processes, why, for how long, who we share it with and how you exercise your rights. It covers the website mxproxy.dev, the dashboard app.mxproxy.dev, the API and the mail servers (mx.mxproxy.dev and smtp.mxproxy.dev).
1. Who decides about the data
- Your account data (name, email, team, billing): we are the controller.
- Email that goes through the service (what arrives at your addresses and what you send through our SMTP): you, the customer, are the controller and we are the processor. We handle that content only to deliver it as your domain is configured.
2. What we keep and for how long
| Data | Why | How long |
|---|---|---|
| The full message (headers, body and attachments) in the delivery queue | Deliver it to the destination and retry when the destination defers it | Until delivered (or given up on, after at most 5 days of retries) plus 30 days; then deleted automatically |
| Message log: sender, recipient, destination, subject, size, status (accepted, delivered, rejected, spam...) and the technical detail (e.g. the spam score or the destination server’s reply) | Show you what happened to each email, troubleshoot and investigate abuse | 30 days; then deleted automatically |
| Daily counts of forwarded and sent messages (numbers only) | Enforce the plan limits and show usage | While the team exists |
| Configuration: domains, forwarders and destinations, catch-all, spam filter level, DKIM keys (the private one encrypted), SMTP credentials (password hash only), channels (webhook URL and encrypted secret, Telegram chat, WhatsApp number) | Provide the service | Until you delete the item or the account |
| Account: name, email, password hash, two-factor secret (if enabled), teams, invitations sent, API tokens (hash only) | Sign-in, teams and invitations | Until the account is deleted |
| Dashboard session: IP address and browser | Keep you signed in and list your open sessions in your profile | Until the session expires or you sign out |
| Billing: Stripe customer id and subscription status | Charge for the plan | While the team exists and, for tax records, as long as the law requires |
| Server technical logs (errors, refused SMTP logins with the source IP) | Security and troubleshooting | For a limited time (14 days of dashboard logs) |
We do not read your email for any other purpose, we run no ads and we do not sell data. The dashboard uses no tracking cookies and no analytics: only the session cookie and the CSRF protection cookie. The website keeps in your browser (localStorage) only your theme choice and whether you dismissed the language suggestion.
3. Authentication checks and spam filtering
When an email arrives we check SPF, DKIM and DMARC and, if the domain uses the spam filter, we analyse the message with rspamd, which runs on our own servers. To do that, rspamd queries public DNS blocklists (such as Spamhaus) with the sender’s IP and domains and the domains of the links in the message. The content of the message is not sent to those lists.
4. Summaries sent to third-party channels
If you attach a channel to a forwarder or to the catch-all, every incoming email produces a summary: sender, recipients, subject, date, the beginning of the text (up to 3,500 characters), the name, type and size of the attachments (never their content) and the spam score. The summary goes where you chose:
- Webhook: the URL you entered, signed with the channel’s secret. What happens to the data after that is up to whoever runs that URL.
- Telegram: the linked chat or group, through the mxproxy bot. The summary goes through Telegram’s servers and is subject to its privacy policy.
- WhatsApp (beta): the confirmed number, sent by Zapmizer from a shared platform number; the message travels over WhatsApp, run by Meta, and is subject to those companies’ policies.
We do not keep the summary for later: the copy of the message in the channel’s queue follows the queue retention (until delivered plus 30 days). Turning the channel off or deleting it stops the deliveries.
5. Subprocessors
| Company | What it does | Where |
|---|---|---|
| Hetzner Online | The server that holds the database, the queue and the log, and that every email passes through | Finland (EU) |
| Cloudflare | DNS of our domains | Global |
| Amazon Web Services (SES) | Sending the dashboard’s own emails (account verification, invitations, password resets) | USA |
| Stripe | Billing and payment data (the card number goes straight to Stripe and never through us) | USA and Ireland |
| Telegram | Delivering the summaries of Telegram channels, only if you create one | Global |
| Zapmizer | Delivering the summaries of WhatsApp channels (beta), only if you create one, over WhatsApp (Meta) | Brazil; WhatsApp: global |
Forwarded email is delivered to the destination servers you configured (Gmail, Outlook and so on), which handle it under their own policies.
6. Legal bases and international transfers
We process data to perform our contract with you (LGPD art. 7, V; GDPR art. 6(1)(b)), to meet legal obligations such as tax rules (LGPD art. 7, II; GDPR art. 6(1)(c)), and for our legitimate interest in keeping the service secure and free of abuse, as with spam filtering and technical logs (LGPD art. 7, IX; GDPR art. 6(1)(f)). Some subprocessors are outside Brazil and the European Union; for those transfers we rely on the mechanisms of the LGPD (art. 33) and the GDPR (chapter V), such as those providers’ standard contractual clauses, or the transfer is needed to do what you asked for (a Telegram channel, for example).
7. Your rights
Under the LGPD (art. 18) and the GDPR (arts. 15 to 22) you can ask for: confirmation that we process your data and access to it; correction; anonymisation, blocking or deletion of what is unnecessary; portability; information on who we share it with; review of automated decisions; and you can object to processing or withdraw consent. You can also complain to Brazil’s ANPD or to the data protection authority of your EU country.
Much of this you can do in the dashboard yourself: edit your profile, delete domains, forwarders, credentials and channels. For anything else, including deleting your account, write to contato@mxproxy.dev, which is also the contact of our data protection officer. We reply within 15 days. If a request concerns third-party email that went through your domain, we handle it together with you, since you are the controller of that data.
8. Security
The dashboard and the API are served over HTTPS; outbound SMTP requires STARTTLS and authentication; inbound accepts STARTTLS. Passwords are stored only as hashes (argon2 for SMTP, bcrypt for the dashboard); DKIM keys and webhook secrets are encrypted in the database. Access to the servers is limited to the team that runs the service. If an incident affects your data, we notify you and the authorities within the legal deadlines.
9. Changes to this policy
When this policy changes, we update the date at the top and, if the change matters, we email the owner of each team before it takes effect.
10. Contact
Privacy and your rights: contato@mxproxy.dev. Abuse and spam coming from a domain that uses mxproxy: abuse@mxproxy.dev.