Privacy Policy and Personal Data Processing

Mawlio processes the minimum data needed to give you temporary email addresses, prevent abuse of the service, and, if you create an account, keep your addresses across devices. We don't sell your data or use it for advertising. This policy complies with Colombia's Law 1581 of 2012 (Ley 1581 de 2012) and Decree 1377 of 2013 (Decreto 1377 de 2013).

Data controller

Name: Mawlio
Address: Calle 94 # 11-46, Bogotá, Colombia
Email: support@mawlio.com
Phone: +57 333 750 9955

What data we process and why

Data	When	Why
Email and encrypted password (hash)	If you create an account	To identify you and sign you in. We never store your password in plain text.
Google email and name	If you sign in with Google	To create or open your account without a password.
IP address	Always	Security, usage limits, sessions without an account, and abuse prevention.
Device identifier and technical browser fingerprint	When you request addresses	To enforce the limit of free addresses per device. From the fingerprint we only store an encrypted summary (hash), not your device's data.
Temporary addresses and their labels	When you use the service	To show you your addresses and when they expire.
Emails you receive at your addresses	When you use the service	To show them in your inbox, highlight codes, and let you reply or forward.
Credits and transactions	If you have an account	To keep track of your balance.

How long we keep data

Addresses and messages: when an address expires, it and its messages are no longer available in your inbox. If the address is later assigned to someone else, that person starts with an empty inbox and can't see your messages.
Free no-account allowance records: the device identifier and the fingerprint summary are kept indefinitely, because the free allowance is one per device. The associated IP address is deleted after 24 hours. You can ask us to delete them by emailing us.
Account: for as long as it's active. You can ask us to delete it at any time.

We use providers that process data on our behalf (processors): cloud hosting, email receiving and storage, sending verification emails, and Google sign-in. Some of these servers are outside Colombia, mainly in the United States. By using Mawlio you authorize that transfer, which is made to providers that offer adequate levels of protection. We only hand over data to authorities when a law or a court order requires it.

Your rights

As the data subject, you can:

Know, update, and correct your data.
Request proof of the authorization you gave us.
Find out how we use your data.
Request deletion of your data or revoke your authorization, when there is no legal or contractual duty to keep it.
File complaints with Colombia's Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC).
Access your data free of charge.

How to exercise your rights

Email support@mawlio.com from your account's email address, with the subject "Datos personales" (Personal data) and what you need.

Inquiries: we respond within a maximum of 10 business days.
Claims (correction, deletion, or revocation): we respond within a maximum of 15 business days.

If we can't respond within that time, we'll let you know the reason and the new date, as the law allows. Before going to the SIC, you must file your claim with us.

Minors

Mawlio is not intended for anyone under 18, and we don't knowingly process their data. If you believe a minor has given us their data, email us and we'll delete it.

Security

Passwords are stored using a key derivation algorithm (scrypt). Sessions use signed cookies, and the connection is always encrypted (HTTPS). We also limit sign-in attempts. No system is foolproof: if we detect an incident affecting your data, we'll notify you.

Cookies

We only use cookies that are necessary for the service to work. The details are in the cookie policy.

Changes to this policy

If we change this policy, we'll publish the new version here with its date. If the change is significant, we'll notify registered accounts by email.