MailPier Inbox Privacy Policy

Solutions Group Unlimited, LLC · Last updated 2026-11-11

This policy explains what information Solutions Group Unlimited, LLC ("SGU", "we", "us") collects when you use MailPier Inbox at app.mailpier.io and api.mailpier.io, what we use it for, and who else sees it. We do not sell personal information. SGU's website and desktop software are covered by the SGU privacy policy.

MailPier Inbox gives teams ("workspaces") email addresses that receive the test mail their own systems send. It is meant for test data only (see the Terms of Service).

Mail sent to MailPier Inbox addresses

Mail sent to a workspace's addresses is received by MailPier, SGU's own mail receiver, on SGU's servers; it is not passed to another mail provider. For each message we store:

the whole message as it arrived: headers, sender and recipient addresses, subject, text, HTML and attachments;
the sending server's IP address and the time it arrived;
the results of our own checks of the message: whether it passes SPF, DKIM and DMARC, and a spam score.

When you open a message, we also pick out its links and one-time codes so you can use them in your tests; these are worked out from the stored message and not kept separately.

Messages are deleted for good 12 hours after they arrived. A workspace can choose a shorter retention time, which hides older messages from it at once; they are then deleted at the 12-hour mark. Workspace members can delete messages sooner in the web inbox or through the API. Mail to an address no workspace owns, or to a workspace over its monthly quota, is refused and not stored.

For this mail we act on behalf of the workspace: the workspace decides what its systems send to its addresses. The mail domains are shared by all workspaces and run by SGU, so our staff can see this mail while running, securing and supporting the service and when looking into abuse. Only the workspace's own members and API keys can read it through MailPier Inbox; there are no public inboxes.

What we store about workspaces and their users

Workspaces: name and short name (used in the addresses), plan, status, monthly quota, retention time, enabled mail domains, when it was created and the email address of the person who created it.
Members: email address, role (owner or member), when you were added and when you last signed in. Workspace owners add members by their email address.
Sign-in codes: we email you a one-time code that expires after 15 minutes. We store only a salted hash of it (never the code itself), with your email address, the number of tries and the IP address that asked for it. These records are deleted about a day after they expire.
API keys: the key's name, its first 12 characters and a SHA-256 hash of the whole key (never the key itself), who created it and when, when it was last used and when it was revoked.
Usage: the number of messages each workspace received per month, to apply its quota.
Audit log: sign-ins and changes made in a workspace (for example adding a member, saving settings, creating or revoking a key), with the email address of the person who made them. Keys appear in it only by their first characters.

This information and the mail above are kept in SQL Server databases on servers that SGU operates in its own data centers in the United States.

Email we send

We send sign-in codes through Microsoft Azure Communication Services. We send only email about your sign-in; we do not send marketing email from MailPier Inbox.

Cookies

MailPier Inbox uses only the cookies it needs to work:

mpp_session keeps you signed in to the web inbox. It is encrypted.
lb_mailpierportal keeps your visit on the same server.
A security cookie protects forms against cross-site requests.

We do not use analytics or advertising cookies, and our pages load nothing from other websites. Remote images in a test message are blocked unless you choose to load them for that message; if you do, your browser contacts the servers named in the message, which can see your IP address and that the message was opened.

Server logs

Our servers record technical details of requests and errors, such as IP addresses and the pages and API calls requested. The mail receiver records, for each delivery attempt, the sending server's IP address, the recipient addresses, the size of the message and whether it was accepted or refused. Sign-in codes and API keys are never written to the logs. These logs are kept on our servers for up to 31 days.

Who we share information with

Your workspace: the members of a workspace see its mail, its members' email addresses, its API key names and its audit log.
Microsoft delivers our sign-in emails (Azure Communication Services), so it receives your email address and the email's content. Microsoft Azure Traffic Manager and Cloudflare answer the DNS lookups for our domains; they see those lookups, not your mail or your use of the service.
Stripe will process payments once paid plans start, through Solutions Group Unlimited's billing service. Card details will go straight to Stripe and are never seen or stored by us. There are no payments during the private beta.

These providers may use the information only to provide their services. We may also disclose information if the law requires it, or to deal with abuse of the service.

How long we keep it

Mail, sign-in code records and logs are deleted as described above. Workspace, member, API key, usage and audit records are kept while the workspace exists. When a workspace is closed we delete its records, except what we must keep for legal, tax, accounting or security reasons.

Your choices

Workspace owners can remove members, revoke API keys and delete mail at any time.
You can ask us to see, correct or delete your information. If you are not a workspace member but your information is in mail a workspace received, you can ask the company that runs that workspace, or us.
To close a workspace, or for any other request about your information, email us at the address below.

MailPier Inbox is a business service and is not directed at children under 13.

Security

Connections to MailPier Inbox use HTTPS. Sign-in codes and API keys are stored only as hashes, one workspace cannot read another workspace's mail, and message HTML is cleaned and shown in a locked-down frame that cannot run scripts.

Changes

If we change this policy we will update the date at the top of this page.

Contact

Solutions Group Unlimited, LLC
Email: support@solutionsgroupunlimited.com