1. Definitions
In this policy:
- “personal information” means information about an identifiable individual, directly or indirectly;
- “customer” means the organization or person that uses MailX or enters into a service relationship with Dataryx;
- “recipient” means the person to whom a customer sends a secure link, verification code, or document;
- “encrypted content” means documents, attachments, messages, or replies protected by encryption mechanisms supported by MailX.
2. Scope and roles
This policy applies to the website, MailX portal, recipient secure links, and related support services (collectively, “MailX”). MailX is operated by Dataryx (“we”, “us”, or “our”).
For account, billing, security, and support data, Dataryx generally acts as the organization responsible for processing. For documents, messages, recipients, and files submitted by a customer organization, that organization remains responsible for its data; Dataryx processes it only to provide the service and under the customer’s instructions.
3. Information we process
We limit collection to information needed to operate, secure, and improve MailX. Depending on your use, this may include:
- account data: name, organization name, email address, role, language preferences, and protected sign-in credentials;
- send data: recipient email address or phone number, subject, file metadata, expiry dates, verification choices, and message settings;
- security and audit data: IP address, device or browser information, timestamps, OTP requests and verification, opens, downloads, revocations, and security events;
- content submitted by customers: documents, attachments, messages, and secure replies;
- communications with us: support requests, feedback, and correspondence with Dataryx.
4. Purposes of processing
- create and administer your account and organization;
- deliver secure links, verify recipients, and provide access to documents;
- maintain security, prevent fraud, enforce plan limits, and keep an audit trail;
- respond to support requests and communicate important service information;
- meet legal, regulatory, contractual, and security obligations.
5. Encryption and security
MailX uses technical and organizational measures appropriate to the sensitivity of the information processed. These include encryption in transit, role-based access controls, security-event logging, temporary links, OTP verification where configured, and expiry and revocation mechanisms.
By default, files are AES-256 encrypted in the browser before transfer, with a key specific to each send; that key is protected by the customer organization’s Azure Key Vault in Canada, and Dataryx has no access to it. Where the organization enables end-to-end encryption, decryption keys are not retained by MailX services. No system is infallible; we review our measures as risks, technology, and the service evolve.
6. Hosting and service providers
We use specialist providers to operate MailX, including Microsoft Azure for hosting, storage, databases, logging, and certain communication services. We may also use email, SMS, automated abuse-prevention, and, when payments are enabled, payment-processing providers.
We seek to host production data in Canada where the service permits it. Certain providers or communication components may process limited information in other jurisdictions. We require our providers to protect information processed on our behalf and not to use it for their own purposes.
7. Retention and deletion
Documents, files, and secure messages are retained for the period selected by the customer, up to 30 days for standard sends, unless a legal obligation or justified security need requires otherwise. When that period expires, active content data is removed through MailX cleanup processes.
Audit logs and history are retained under the applicable plan: 3 months, 6 months, or 12 months. Account data is retained during the business relationship and then deleted or anonymized within a reasonable time, subject to legal, tax, fraud-prevention, and backup obligations.
8. Sharing and disclosure
We do not sell personal information or use it for behavioural advertising. We disclose it only to authorized Dataryx personnel, service providers acting on our behalf, your organization when needed to administer the service, or where required or permitted by law.
A sender who elects to send a document to a recipient is responsible for obtaining the permissions necessary to use that recipient’s contact details in MailX.
9. Your rights and choices
Subject to applicable law, you may request access to personal information we hold about you, correction, deletion where permitted, or information about its use and disclosure. You may also withdraw consent where processing relies on it; this may prevent certain MailX functions from working.
Send your request to info@dataryx.ca. We may need to verify your identity before responding. You may also contact the relevant privacy authority in your province, territory, or jurisdiction.
10. Cookies and local storage
MailX uses technologies strictly necessary for portal operation, session security, language selection, and abuse prevention. We do not use advertising cookies or behavioural tracking to build advertising profiles.
11. Privacy incidents
If we identify or suspect a privacy incident, we assess it promptly, take reasonable measures to limit its effects, preserve the information needed for analysis, and implement corrective measures to reduce the risk of recurrence.
Where required by applicable law, we notify affected individuals, customer organizations, and competent authorities within the required timelines. We work with customers when an incident concerns data under their control.
12. Changes to this policy
We may update this policy to reflect changes to MailX, our practices, or applicable law. We will revise the last-updated date and, where a change is material, provide appropriate notice.