Privacy Policy

This Privacy Policy explains how KAVELA LTD ("we", "us") collects and uses personal data when you use newmail.click (the "Service"). KAVELA LTD is a company registered in England and Wales, company number 17051996, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of personal data processed through the Service.

1. What we collect

• Account data — when you sign in with Google we receive your name, email address, profile picture and Google account ID.
• Signature content — the fields you enter into the builder (name, role, company, phone, links, photo).
• Tracking data (Pro) — if you enable click and open tracking on a signature, we record the time of the event, the destination URL, a hashed visitor identifier, coarse user agent and country.
• Billing data — for paid plans, Stripe processes your payment. We store only the Stripe customer ID, subscription status and plan tier. We never see your card number.
• Newsletter consent — when you request a test signature you may opt in to occasional product updates. We store your email, the consent text version, IP and timestamp for audit purposes (UK GDPR Art. 7). Unsubscribe at any time via the link in any email.
• Technical data — standard server logs (IP address, request path, timestamp) kept for up to 30 days for security and debugging.

2. Why we use it

• To provide the signature builder and your account dashboard.
• To deliver click and open analytics to Pro subscribers.
• To process payments and manage subscriptions (via Stripe).
• To detect abuse and keep the Service running.
• To respond to support enquiries.

3. Legal basis

We process personal data on the basis of (a) performance of a contract with you, (b) our legitimate interest in operating and securing the Service, and (c) your consent where required by law.

4. Sharing

We share data only with processors that help us run the Service: Google (sign-in), Stripe (billing), Cloudflare (DNS, email routing, edge network), and our hosting provider. We do not sell personal data and we do not share it for advertising.

5. Tracking pixels and links

Pro signatures can wrap outbound links with a redirect (/r/...) and embed a 1x1 tracking pixel (/p/....png). When a recipient of an email signed with a Pro signature clicks the link or opens the email, we record the event as described above. Recipients can opt out by blocking remote images in their mail client. Pro subscribers are responsible for disclosing tracking to their recipients where local law requires it.

6. Cookies

We use a session cookie to keep you signed in and a CSRF token cookie for security. We do not use advertising or analytics cookies. See our Cookie Policy for details.

7. Retention

Account and signature data are kept while your account is active and for up to 30 days after deletion. Tracking events are retained for 13 months. Billing records are kept for 7 years to satisfy UK accounting obligations.

8. Your rights

If you are in the UK, EEA or UK, you have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing. Email [email protected] and we will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

9. International transfers

Our hosting and processors operate servers in the EU and the United States. Where data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum and Standard Contractual Clauses.

10. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

11. Changes

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated by email or in-app notice.

12. Contact

Data protection enquiries: [email protected].