Privacy Policy
Last Updated: September 19, 2026 • Effective Date: September 19, 2026
AES-256-GCM Vault
Your SMTP passwords and ESP API keys are encrypted at rest with military-grade authenticated encryption.
Zero Inbox Storage
We never access, read, scan, or store your private incoming inbox emails. Outgoing dispatches stream directly to your mail server.
BYOK Architecture
You own your communication pipeline. Messages dispatch directly through your connected Gmail, Resend, or SES account.
1. Introduction
Cold Mailer ("we," "our," or "us"), operated at coldmailer.matchwize.com and developed by Merajul Haque (merajulhaque.com), provides a Bring Your Own Key (BYOK) cold email dispatcher and curated technology company directory.
We are committed to transparent data practices and compliance with global privacy regulations, including the Digital Personal Data Protection (DPDP) Act, 2023 (India), the General Data Protection Regulation (GDPR) (EU/UK), and the CAN-SPAM Act (United States).
2. Information We Collect
- Account Credentials: Name, email address, salted PBKDF2 password hashes (we never store plain passwords).
- BYOK Email Credentials: SMTP host, port, username, and encrypted passwords/API keys for services like Gmail, Resend, Amazon SES, Brevo, or SendGrid.
- Outbound Dispatch Logs: Recipient address, timestamp, subject line, and delivery status solely for your audit log and analytics view in the dashboard.
- Resume & Profile Documents: Uploaded resume files (PDF/DOCX) stored securely via encrypted cloud object storage strictly for email attachment purposes.
3. How We Protect Your Sensitive Credentials
All external email credentials (such as Google 16-character App Passwords or Amazon SES keys) are encrypted using AES-256-GCM authenticated envelope encryption before storage in the database. Decryption occurs strictly in-memory during real-time dispatch handshakes.
4. Company Directory Data & Right to Erasure
Our public technology company directory indexes publicly accessible corporate websites, official domain records, and public contact points.
If your company or contact point is listed in our directory and you wish to update or permanently remove it, please see our dedicated Directory & Removal Policy or email haquedot@gmail.com. We process all suppression and takedown requests within 48 business hours.
5. User Rights & Data Portability
Under GDPR and DPDP Act provisions, you have the right to:
- Access all dispatch logs and profile information associated with your account.
- Delete your account and all associated encrypted SMTP keys instantly via Profile Settings.
- Export your outreach history in structured format.
6. Contact Information
For privacy inquiries, data deletion requests, or compliance questions, please contact our Data Protection Officer at:
Portfolio & Developer Inquiries: https://merajulhaque.com