Privacy note

This note covers Seleya Address: address.seleya.ai, and the addresses on seleya.email, seleya.me and companies’ own domains. Seleya Labs Inc. runs it (contact at the end). Seleya’s website has its own note at seleya.ai/privacy.

Who decides what

• For a company’s addresses, the company controls its mail, and we process it on the company’s behalf under the data processing agreement. Questions about that mail go first to the company.
• For a person’s own address, the person controls their mail, and we process it to provide the service.
• We are responsible ourselves for owners’ accounts, billing, security, abuse prevention, sanctions screening, and the service’s own observations described below.

If you write to an address on Seleya Address

• We receive your message for the address’s owner: its headers, text and attachments, and the results of the checks your mail provider’s records allow (SPF, DKIM and DMARC).
• We judge who sent it, from those checks and from whether the owner already corresponds with you. The owner’s screening then decides whether it reaches their agent, waits for the owner, or is refused. No model reads it on our side.
• The owner’s agent may answer you. Its messages say an agent wrote them.
• To stop an agent writing to you, reply “stop” to any of its messages. The service then stops that owner’s addresses writing to you.
• Mail to an address that doesn’t exist, and mail we refuse, is deleted during processing. A one-day S3 expiry rule is a backstop for interrupted deletion; AWS applies that expiry asynchronously.

What we keep

What	Why	How long
Your account: email, name, country, passkeys and sign-in records	To run your account and keep it secure	While the account exists
A company’s legal name, country, domains and proof of control	To authorise the company	While the company is an owner
Mail: raw messages, stored encrypted, and an index of headers, parts, conversations and verdicts	To deliver it and show it	Until the owner asks us to delete it. When an account ends, 30 days to ask for an export; deletion then runs automatically. Another owner’s copy of a shared message remains theirs
Contacts built from correspondence, and each address’s rules (allowed and blocked senders, stops)	To judge senders and honour stops	While the address exists
Connected apps, keys and links (keys, tokens and links stored only as hashes)	To let agents act for their owner	Until disconnected, deleted or expired
Billing: Stripe’s customer and subscription records, the card’s country and Stripe’s fingerprint of the card, never its number	To bill, and to limit the accounts one card can open	As tax and accounting law requires, generally 5 to 7 years
Sanctions screening results	To meet sanctions law	As that law requires
Delivery events and verdicts	To run the service and improve it	While the address exists
Service logs	To fix faults and investigate abuse	30 days
Mail to abuse@ and postmaster@	To handle reports	1 year
Database backups	To recover from failure	35 days

To request an export or end your account, contact support@seleya.ai. We verify that you administer the account. Ending an account stops its addresses and subscription; disconnecting an app does neither. An existing charge is not automatically refunded by account closure.

Deletion covers mail content and the owner’s mailbox records, contacts, rules and credentials. We keep the billing and sanctions records listed above, minimal deletion records, and retired address and mail-domain names so they cannot be assigned to somebody else. A person’s sign-in profile remains if they still use another account or have an open company setup.

Backups expire on their existing schedule. Before using a restored database, we replay account-end records held separately from it, block ended accounts and queue any deletion that is due. Restoring a backup does not restore access to an ended account.

What we learn from

The service keeps what it observes itself (delivery events, verdicts and deliverability outcomes) with where and when each came from. With names, addresses and other identifiers removed, Seleya uses them to improve the service and pools them with its other data. Message content is never pooled, and is used only to deliver it. A company can stop future pooling by writing to support@seleya.ai.

Why we may use it

• To perform our contract with owners: their accounts, their mail and their billing.
• Our legitimate interest in keeping the service secure and free of abuse, and in improving it.
• Legal obligations, such as sanctions, tax and accounting law.
• Under South Africa’s POPIA, these are the grounds in section 11.

Where it is

• Mail and the database are in the EU, in AWS’s Frankfurt region.
• Cloudflare runs our DNS and website, and traffic to our API and MCP server passes through its global network. Cloudflare Web Analytics counts visits to our public pages without cookies and without identifying you.
• Stripe processes payments in the US and the EU.
• Seleya Labs is a US company and its team works in South Africa, so data may be reached from both. For transfers out of South Africa we rely on binding agreements under POPIA section 72(1)(a); where the GDPR applies, on an approved mechanism such as the EU Standard Contractual Clauses.
• The data processing agreement lists who processes data for us.

Your rights

You may ask to see, correct, export or delete your data, or object to or restrict how we use it. Write to support@seleya.ai. We may check who you are first; it costs nothing; and we answer within one month. If your request concerns a company’s mail, we pass it to that company or help it answer.

You may also complain to South Africa’s Information Regulator (inforegulator.org.za), a data protection authority in the EU or the EEA, or the UK’s Information Commissioner’s Office.

Children

Seleya Address is for adults: owners must be 18 or older.

Changes

We tell owners by email about material changes to this note before they take effect.

Contact

Seleya Labs Inc., 1111B S Governors Ave STE 56751, Dover, DE 19904, USA. Privacy contact: Louis-Neil Korsten, support@seleya.ai.