Privacy Policy
Last updated 15 July 2026
Amelu is a product of Ordnary ("Ordnary", "we", "us"), a company registered in the Netherlands (KVK 95732888, D-U-N-S 965740890). This policy explains what personal data we collect when you use Amelu, why we collect it, and what rights you have under the GDPR and other applicable data protection law.
What we collect
To create and run your account, we collect:
- Account details: your name, email address, organization name and a hashed password (or, if you sign in with an Ordnary account, the profile information that login returns).
- Billing details: handled directly by Stripe, our payment processor. We store your Stripe customer reference and subscription status, not your full card number.
- Domain and mailbox configuration: the domains, mailboxes, aliases, forwarding rules and DNS records you set up.
- Activity logs: sign-ins, domain verification events and administrative actions on your account, kept for security and support purposes.
- Support communications: anything you send us at support@amelu.org or hello@amelu.org.
What we don't do with your mail
Your email content is yours. We don't read your mail, scan it for advertising, or sell any data to third parties. Incoming mail is automatically processed for spam filtering, which necessarily involves inspecting message headers and content by software, not by a person, purely to decide whether to deliver, flag or reject a message.
Where your data lives
Amelu's mail infrastructure and primary database run on our own servers located in the EU. We use the following processors, each bound by a data processing agreement where required:
- Stripe, for billing and payment processing.
- Resend, for transactional account emails (password resets, verification codes).
- Cloudflare, for DNS, our public website and edge network, and EU-jurisdiction object storage for exports and backups.
We don't transfer personal data outside the EU except where one of the processors above requires it under their own, GDPR-compliant safeguards.
Why we process your data
We process account and billing data to perform our contract with you (running the service you signed up for), activity logs and abuse-prevention data under our legitimate interest in keeping Amelu secure and reliable, and marketing communications only where you've opted in.
How long we keep it
Account and mailbox configuration data is kept for as long as your account is active. If you close your account, we delete your configuration data and mail within 30 days, except where we're required to keep billing records for longer under Dutch tax law (currently 7 years).
Your rights
Under the GDPR you can ask us to access, correct, export or delete your personal data, or object to or restrict certain processing. Most of this you can already do yourself from the dashboard; for anything else, email hello@amelu.org. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Cookies
Our dashboard uses a single essential session cookie to keep you signed in. It's required for the service to function and isn't used for tracking or advertising, so it doesn't need separate consent under EU cookie rules. This marketing site doesn't set any analytics or advertising cookies.
Changes to this policy
If we make material changes to this policy, we'll update the date above and, where the change is significant, let you know by email.
Contact
Ordnary is the data controller for Amelu. Questions about this policy or your data: hello@amelu.org.