Trust and data protection

1. Who we are

Faivelo is operated by Louis & Schwartz Group, LLC, a Delaware limited liability company. We are the data controller for your account data and a processor for the mail and recipient data you host or send through the Service. We have no advertising business: you pay us to host email, and that is the whole relationship.

2. What is in place

• Data Processing Addendum that applies to every customer automatically, incorporating the EU Standard Contractual Clauses (Module 2) and the UK Addendum. See /dpa.
• Published subprocessor list with locations and purposes (Section 3 below), and advance notice before any new subprocessor touches customer content.
• Encryption: TLS in transit, AES-256 at rest for message and file storage, AES-256-GCM for identifiers and credentials, bcrypt for account passwords.
• Self-service rights: delete your account from Settings at any time, and copy your mail out over IMAP or JMAP with any mail client. A copy of your account data is available on request. Deletion cascades through the mail server, file storage, billing, and our database.
• Documented retention for every category of data, with automated pruning of audit logs (IP addresses removed at 90 days, rows deleted at one year).
• Cookie consent on the marketing site. No analytics or advertising cookies are set until you accept them, and Global Privacy Control signals are honoured.
• Records of processing (GDPR Article 30), a breach response runbook with the 72-hour supervisory-authority clock, and a data protection impact assessment for the AI-assisted features. These are internal documents, available to customers on request under NDA.
• No AI training on your mail, no data sales, no data brokers. Every subprocessor is contractually barred from the same.

3. Subprocessors

These are the suppliers that process personal data on our behalf. Marketing-site analytics vendors are listed separately in Section 12 of the Privacy Policy.

4. Where your data lives

Mailbox content is stored on our mail server in the United States and in encrypted object storage on AWS. Account data is stored in a database in the United States. Outbound mail is relayed through Amazon SES in the United States. For customers in the EU, UK, and Switzerland, these transfers rest on the Standard Contractual Clauses incorporated in the DPA, the UK Addendum, and the Data Privacy Framework where the supplier is certified. We do not currently offer hosting in a region of your choice; if you need it, tell us at support@faivelo.com.

5. AI and your mail

We use AI models in a few narrow places, and none of them reads your mailbox as a whole. The webmail phishing screen sends the sender, subject, and up to the first 2,000 characters of a message to Anthropic only when our rule-based checks cannot decide whether it is a scam. The abuse screens look at a new domain name, or at the content of an outbound campaign, before we let it send. The support assistant sees the conversation you have with it. AI agent mailboxes, which you create deliberately, process the messages sent to that agent. Verdicts are cached, excerpts are used for nothing else, and Anthropic does not train on them.

Two webmail helpers run only when you ask and can be switched off per account and per mailbox. Writing help (suggested replies, “Help me write”, proofreading) sends the message you are answering or the text you are writing. “Ask about your mail” turns your question into ordinary keyword searches on our side, then sends the sender, subject, date and a 160-character snippet of at most 30 matches so the model can pick the relevant ones. No whole bodies or attachments go to the model, and it never reads your mailbox as a whole. Only the question is kept, in a history you can delete.

To find words inside messages and attachments, we keep a text index of each mailbox on our own servers in its data region, alongside the mail server’s own search index. It is read only by your searches, never shared or sent to a model, and deleted with the mailbox. Webmail Settings lets you leave attachments out of it or clear it.

6. Your rights

Access, rectification, erasure, restriction, portability, and objection all apply. Deletion is self-service in Settings and takes effect immediately, and your mail can be copied out at any time over IMAP or JMAP. Requests for a copy of your account data, everything else, or anything on behalf of someone whose data you believe we hold, goes to support@faivelo.com. We answer within one month, as the GDPR requires, and usually much sooner. If you are a recipient of email sent by a Faivelo customer, Section 5 of the Privacy Policy explains what we hold and how to opt out.

7. If something goes wrong

We have a written incident response runbook. If a breach affects your personal data, we notify you and the relevant authorities without undue delay, including the 72-hour notification to supervisory authorities under GDPR Article 33 where it applies. Security researchers can report vulnerabilities to support@faivelo.com; we do not pursue good-faith research.

8. What is still in progress

We would rather say this here than have you find it. We are a US company with customers in the EU and UK, and GDPR Article 27 asks us to appoint a representative in each. Those mandates are being signed and the representatives will be named in the Privacy Policy and DPA as soon as they are. Until then, EU and UK data subjects and supervisory authorities can write to us directly at the address in the Privacy Policy, and we respond within the statutory timeframes regardless. We have not sought a third-party GDPR certification and do not claim one.

9. Documents

• Privacy Policy
• Data Processing Addendum, with SCCs and UK Addendum
• Terms of Service
• Sending Policy
• Records of processing, incident response runbook, and the AI features impact assessment: on request under NDA

10. Contact

Data protection questions, DPA countersignature, or vendor questionnaires: support@faivelo.com. Post: Louis & Schwartz Group, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA.