Privacy Policy

Last updated: 15 November 2026

This page explains what data WorksMail collects, why, and what happens to it. If something is unclear, email [email protected] and we will clarify.

1. What we collect

• Account data: your name, email address, and phone number (if you provide it) when you order.
• Order data: the plan you bought, your domain, the amount paid, the reference, and the dates.
• Payment data: we do not store card details. Payments go through Paystack and, where enabled, Cryptomus. They handle the sensitive data.
• Service data: mailbox names, login timestamps, and support tickets you open.
• Email content: stored on EmailArray's infrastructure on our behalf. We do not access it except to fix issues you report.

2. Why we collect it

• To provision and maintain your email service
• To send you invoices, receipts, expiry reminders, and support replies
• To comply with Nigerian tax and business records requirements
• To investigate abuse if you report spam or security issues

3. Who we share it with

• EmailArray: our upstream email provider. They host the mailboxes and store the messages.
• Paystack and Cryptomus: payment processing.
• Cloudflare: DNS and DDoS protection for our website.
• Backblaze: encrypted backups of our database and site files.
• NIRA: if you buy a .ng domain through us, your registration details are shared with the registry as required by Nigerian domain rules.

We do not sell your data. We do not use it to train AI models. We do not share it with advertising networks.

4. How long we keep it

• Order and invoice records: 7 years, for tax purposes.
• Support tickets: 2 years after last reply.
• Account data: 30 days after you close your account, then deleted.
• Mailbox content: for the duration of your plan plus 30 days after expiry, then deleted.

5. Your rights

• Request a copy of your data at any time
• Request corrections to inaccurate data
• Request deletion of your account, subject to what we must keep for tax
• Export your mailbox content using IMAP before closing your account

To exercise any of these, email [email protected]. We respond within 30 days.

6. Security

Traffic to our website is encrypted with TLS. Our database and site files are backed up daily to encrypted cloud storage. Access to internal systems requires strong passwords and two-factor authentication.

7. Cookies

Our website uses one session cookie after you sign in. No advertising cookies. No third-party trackers on this site beyond Cloudflare's DDoS protection, which is necessary for the site to function.

8. Changes to this policy

If we change this policy, we update the date at the top. Material changes are emailed to active customers 30 days before taking effect.

9. Contact

Privacy questions: [email protected]