Privacy Policy
The short version
- We collect only what we need to run business email: your account details, the mail in your mailboxes, and technical and security logs.
- Mail, account data and backups are stored in India (Mumbai) and encrypted at rest.
- We do not sell personal data or show ads. We do not use your mail for advertising or to train AI models. We use no tracking or analytics cookies.
- For the mail in a business's mailboxes, that business decides how it is used, and we process it on its behalf.
- You can ask to see, correct or erase your data, and you can complain to our Grievance Officer.
- Who we are and our role
- What we collect
- How we use it
- Who we share it with
- Where it is stored
- How long we keep it
- Security
- Your rights
- Cookies
- Children
- Changes to this policy
- Grievance Officer and contact
1. Who we are and our role
Patra is provided by Aspirence Worldwide Private Limited, a company incorporated in India (we, us). Our registered office address and corporate identity number (CIN) are available on request from hello@trypatra.com. This policy explains how we handle personal data under India's Digital Personal Data Protection Act, 2023 and other applicable law.
- We decide how and why we process the data of our customers' admins and contacts, people who sign up, visitors to trypatra.com, and people who write to us. For this data, we are the Data Fiduciary.
- Our customer decides how and why the content of its mailboxes is processed: messages, attachments, contacts and calendars, and the mailbox details of its users. For this content, the customer is the Data Fiduciary, and we are its Data Processor. We process it only on the customer's behalf, to provide the service. If you have a mailbox from a business that uses Patra, please send privacy requests about it to that business's admin. We will help them respond.
2. What we collect
| What | Examples |
|---|---|
| Signup and account details | Business name, contact name, email address, phone number (optional), domain, chosen plan and number of users. Admin passwords are stored only as one-way hashes. |
| Mailbox details | Each user's name, address, aliases and storage used. Mailbox passwords are stored only as one-way hashes. |
| Mailbox content | Messages and attachments, contacts, calendars and anything else stored in a mailbox. |
| Mail transaction data | Sender, recipients, time, size, delivery and bounce status, the address of the connecting server, and authentication and spam-filter results (SPF, DKIM, DMARC). |
| Technical and security data | IP address, browser type, sign-in times and failed sign-ins, and a record of admin actions (audit log). |
| Domain information | Your domain's public DNS records (nameservers, MX, SPF, DKIM, DMARC), which we check to verify and monitor the domain. |
| Bot protection | On the signup form, Cloudflare Turnstile processes signals about your browser and connection to tell people from automated abuse. |
| Messages to us | What you write to hello@, abuse@ or grievance@trypatra.com, and our replies. |
3. How we use it
- To provide the service. This covers creating mailboxes, storing and delivering mail, verifying and monitoring domains, and running the admin console. This is necessary to provide what you signed up for.
- To keep the service safe. This covers reviewing new accounts, enforcing sending limits, filtering spam and malware, and detecting compromised accounts. It also covers investigating abuse reports and complying with the Acceptable Use Policy.
- To send service email. This includes email confirmation, password resets, setup links, domain status and DNS alerts, account review results and important notices. We do not send marketing email. If we ever do, we will ask for your consent first.
- To bill you once billing starts, and to meet our tax and accounting obligations.
- To comply with the law, including valid requests from authorities.
- To keep the service reliable, using aggregated measurements such as counts and error rates, never the content of your mail.
Mailbox content is processed by automated systems: to deliver it, filter spam and malware, and build your mailbox's search index. People at Aspirence do not read it, except where necessary to investigate abuse or a security incident affecting the service, where the customer asks us to for support, or where the law requires it.
4. Who we share it with
- Amazon Web Services (AWS). Our servers, storage and backups, and outbound mail delivery (Amazon SES), all in the Asia Pacific (Mumbai) region.
- Cloudflare. DNS and hosting for trypatra.com, the secure connection to the admin console, and bot protection on signup.
- Your recipients' mail providers. Mail you send goes to its recipients, which is how email works.
- Authorities. When the law requires it, we disclose only what is required and, where allowed, tell the affected customer.
- A successor business. If our business is reorganised or sold, data may pass to the new owner. It stays protected as described here, and we will tell you in advance.
AWS and Cloudflare act on our instructions and are bound to protect the data. We do not sell personal data.
5. Where it is stored
Mailbox content, account data and backups are stored in India, in the AWS Asia Pacific (Mumbai) region. Some processing happens outside India:
- Traffic to trypatra.com and panel.trypatra.com passes through Cloudflare's global network.
- Mail you send to recipients abroad necessarily leaves India.
We transfer personal data outside India only as permitted by Indian law.
6. How long we keep it
| Data | How long |
|---|---|
| Mailbox content | Until you or your users delete it. Trash and Junk are emptied automatically after 30 days. |
| Deleted mailboxes | Restorable for 30 days, then deleted. Backup copies are removed within a further 35 days. |
| Closed accounts | Mailboxes as above. Account details are deleted within 90 days of closure, except records we must keep by law, such as invoices (kept as long as tax law requires). |
| Backups | Taken every 6 hours and kept for 35 days. |
| Server, mail transaction and security logs | Generally up to 30 days. |
| Signup attempts (anti-abuse) | 30 days. |
| Audit log of admin actions | While the account exists and for up to 3 years after closure, for security and legal purposes. |
7. Security
Our safeguards include:
- encrypted connections for webmail, mail apps and the admin console, and encrypted delivery to other mail providers when the receiving server supports it;
- encryption of stored mail, backups and our servers' disks;
- passwords stored only as one-way hashes, and access to our systems limited to the people who run them;
- separate administrative access, and monitoring and alerts on the health and safety of the service.
If a personal data breach occurs, we will notify affected customers, the Data Protection Board of India and other authorities as the law requires.
8. Your rights
Subject to the law, you can ask us to:
- give you a summary of the personal data we process about you, how we process it and who we share it with;
- correct, complete or update your personal data;
- erase your personal data when it is no longer needed. We may keep what the law requires, and erasing account data may mean we can no longer provide the service;
- withdraw consent you have given, for the future;
- let a person you nominate exercise these rights if you die or become unable to.
Write to privacy@trypatra.com. We may need to verify your identity, and we respond within the time the law requires. If you are not satisfied, contact our Grievance Officer (below). After using our grievance process, you may complain to the Data Protection Board of India.
If your mailbox comes from a business that uses Patra, that business handles requests about your mailbox content, so please contact its admin first.
9. Cookies
The admin console uses strictly necessary cookies to keep you signed in. trypatra.com sets no cookies of its own. We do not use tracking, analytics or advertising cookies. Cloudflare, which protects our websites, may set strictly necessary security cookies.
10. Children
Patra is a service for businesses and is not directed at children. Account holders must be at least 18. Customers are responsible for any mailboxes they create for their users.
11. Changes to this policy
We may update this policy. For significant changes, we will email customers' contact addresses before the changes take effect. The version and effective date are shown at the top of this page.
12. Grievance Officer and contact
You can reach our Grievance Officer by email at grievance@trypatra.com.
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. For privacy requests, write to privacy@trypatra.com. For anything else, write to hello@trypatra.com.