Version 2026-10-13 · Effective 2026-10-13
XMail by Xdigitex provides transactional email sending and separately reviewed mailbox hosting. Contact privacy@xdigitex.com for privacy requests, or support@xdigitex.com for service questions. These requests are reviewed by our team; this policy does not claim any certification or regulator registration.
We process your account name, email, hashed password, sign-in and security records, sending domains, DNS-verification records, API-key hashes, subscription details, payment references, recipient addresses, sender identities, message subjects and message content needed to queue and deliver email. Optional Google sign-in processes identity information supplied with your authorization. Mailbox hosting processes incoming and outgoing messages, folders and attachments when that separate service is enabled.
We use data to operate the service you request, authenticate users, verify sender ownership, deliver mail, calculate recipient usage, reconcile payments, provide support and prevent fraud, spam and abuse. Customers remain responsible for having a lawful basis and necessary notices for their recipients. We do not use a customer recipient list as permission to send our marketing.
Infrastructure hosting, destination email servers, Google when selected for sign-in, DNS providers when you authorize configuration, and Xdigitex Pay and its selected mobile-money or card providers process data as needed for their roles. We do not store full card credentials in the XMail billing database. Recipient mail systems and infrastructure providers may process information outside your country. Ask us for the current processor and transfer details before sending data with special geographic requirements.
Account and delivery records are retained while needed to provide the account, support delivery, maintain billing records and investigate security or abuse. This deployment does not promise a fixed automatic purge interval. Request account or message deletion through the privacy contact; we review identity, legal obligations, shared operational dependencies and backup handling before confirming completion. Removing an API key revokes access; it does not erase previously delivered messages from recipient systems.
We use protected service credentials, HTTPS, authenticated SMTP submission, hashed API secrets, sender verification and tenant authorization. No system can guarantee absolute security. Do not submit unnecessary sensitive personal information. You may request access, correction, deletion, restriction or objection where applicable, and raise concerns with your applicable regulator, including Kenya’s Office of the Data Protection Commissioner. We review rights requests according to applicable law.
Material changes are published with a new version. Registration acceptance is recorded with a version and timestamp. Contact us if you need an agreement covering processing roles or additional privacy requirements before using the service.
Questions? Contact support@xdigitex.com.