Privacy Policy

Last updated: October 2026

This Privacy Policy explains what personal data HalixonMail collects, why we collect it, how we use and protect it, and the rights you have over it. It applies to your use of the HalixonMail email service and account portal. Please read it alongside our Terms and Conditions and Security Policy.

Data Controller

The data controller responsible for your personal data is:

  • Registered company name: [To be provided]
  • Company registration number: [To be provided] (registered in [jurisdiction])
  • Registered office address: [To be provided]
  • Data-protection registration reference: [To be provided]
  • Privacy / data-protection contact: privacy@halixonmail.com
  • General support contact: support@halixonmail.com
1. Data We Collect
1.1Account data. When you register we collect your name, your external contact email address, your mobile telephone number, and the credentials used to secure your account. Passwords are never stored in plain text — they are hashed using Argon2id with a server-side pepper and per-user salts.
1.2Two-factor authentication data. If you enable two-factor authentication, we store your TOTP secret in encrypted form (AES-256-GCM). We do not store your one-time codes.
1.3Service configuration. We store the email addresses and domains associated with your subscription, your forwarding destination(s), and related mail-handling settings.
1.4Billing data. We record your subscription status, plan, and billing history. Payment card details are handled entirely by our payment processor — we never see, store, or process your card number.
1.5Security & audit data. We log registration and sign-in activity, including outcome, timestamp, and originating IP address, and we temporarily track IP addresses for abuse and DDoS mitigation. This information is used to protect accounts and our infrastructure.
1.6Support data. If you contact support, we retain the correspondence and any information you provide so we can respond and keep a record of the request.
2. How We Use Your Data
2.1To create and administer your account and provide the email service, including routing and forwarding your mail.
2.2To authenticate you, secure your account, and detect, prevent, and investigate abuse, fraud, and security incidents.
2.3To process payments, manage subscriptions, and send service and billing communications.
2.4To send verification messages, such as confirming a new contact address or a new forwarding destination.
2.5To comply with our legal obligations and enforce our Terms.
2.6We do not sell or share your personal data with third parties for their own marketing purposes.
3. Lawful Bases
3.1Performance of a contract. We process account, configuration, and billing data because it is necessary to provide the service you have signed up for.
3.2Legitimate interests. We process security, audit, and abuse-prevention data to keep the service and our users safe. We balance this against your rights and interests.
3.3Legal obligation. We process certain data where required to comply with applicable law.
3.4Consent. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
4. Email Content & Forwarding
4.1HalixonMail operates primarily as a forwarding service. We transmit your mail to your chosen external destination; we do not read the content of your messages for advertising or profiling.
4.2Messages pass through our mail infrastructure to be delivered and may be processed transiently as part of normal routing, spam filtering, and reputation checks. Inbound and outbound mail may be filtered or rejected on spam or reputation grounds.
4.3Technical metadata (such as sender, recipient, timestamps, and size) may be logged for delivery, troubleshooting, rate-limiting, and anti-abuse purposes.
4.4Your forwarding destination is an external address you control. Once mail is delivered there, it is subject to that provider's own privacy practices, which are outside our control.
5. Cookies & Sessions
5.1We use a strictly necessary session cookie to keep you signed in. Your browser holds only an opaque session identifier; your session data is stored server-side.
5.2The session cookie is set with the HttpOnly, Secure, and SameSite=Lax attributes, and anti-forgery (CSRF) tokens are used on state-changing requests.
5.3Human-verification (Cloudflare Turnstile) is used on login, account creation, and password-reset requests to prevent automated abuse. This may set cookies necessary for that check to function.
5.4We do not use advertising or cross-site tracking cookies.
6. Third-Party Processors
6.1Stripe processes payments on our behalf. Your card details are provided directly to Stripe and are governed by Stripe's privacy policy.
6.2Cloudflare provides DDoS protection, web application firewall, and bot mitigation in front of the portal, and provides the Turnstile human-verification challenge. In doing so it processes connection data such as IP addresses.
6.3We use these processors only to the extent necessary to provide the service, and we require them to protect your data appropriately.
7. Data Retention
7.1We keep account and configuration data for as long as your account is active.
7.2Unverified accounts. If you register but do not verify your account, we will delete it and its associated data within 10 days of creation.
7.3On termination or expiry, your data is handled in accordance with our deletion grace period. Email addresses may be retained on an out-of-subscription basis as described in our Terms, after which they are unassigned.
7.4Security and audit logs, and billing records, are retained for the period necessary to meet security, operational, and legal requirements, and are then deleted or anonymised.
7.5Abuse-mitigation data, such as temporarily tracked IP addresses, is retained only for as long as needed for that purpose.
8. International Transfers
8.1Your personal data is stored in data centres located in the United Kingdom.
8.2Some of our processors may handle data outside the UK or EEA. Where that happens, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) to protect your data.
8.3Email you send and receive is, by its nature, transmitted across the internet and may transit or be delivered to servers in other countries outside our control.
9. How We Protect Your Data
9.1We apply technical and organisational security measures across our platform, including encryption in transit (TLS 1.2 or higher) and the protections described in our Security Policy.
9.2Passwords and SMTP authentication secrets are hashed with Argon2id; two-factor secrets are encrypted at rest; and sensitive information such as encryption keys, API secrets, and passwords is never logged.
9.3We follow the principle of least privilege, granting internal accounts and services only the access they need.
10. Your Rights
10.1Under UK GDPR you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and the right to data portability.
10.2Access & portability. You can request a full export of your personal data from your profile at any time.
10.3Erasure. You can request account deletion by submitting a support ticket; such requests are processed by our team, subject to any retention we are legally required to apply.
10.4Rectification. You can update your contact details and configuration from within your account. Important: your mobile telephone number and your contact email address are the only ways we can verify your identity to recover your account, so you must keep both of them accurate and up to date. If both become unreachable, we may be unable to restore access to your account.
10.5To exercise any of these rights, contact us at privacy@halixonmail.com. We will respond within the timeframe required by law.
10.6You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO).
11. Changes & Contact
11.1We may update this Privacy Policy from time to time. We will notify you of material changes, and the "Last updated" date above reflects the current version.
11.2For any questions about this policy or how we handle your personal data, contact us at privacy@halixonmail.com.

Our terms of service are set out separately in our Terms and Conditions, and the technical measures we use to protect your data are described in our Security Policy.