Legal
Privacy Policy
What we collect when you use Chebu, why we need it, how we treat your mail, and the choices you have.
Last updated
Who we are
Chebu is an email hosting service. In this policy, “Chebu”, “we”, and “us” mean Chebu. You can reach us about privacy at privacy@chebu.io.
This policy covers the website at chebu.io, the web app at mail.chebu.io, our mail servers (IMAP and SMTP), the API at api.chebu.io, and the SMTP relay. Together we call these the services.
When a business uses Chebu for its own domain, that business decides who gets a mailbox and what its apps send. For that mail we act on the business's behalf and follow its instructions. If you have a mailbox from a business, or you received email sent through Chebu by a business, contact that business first about your data.
What we collect
- Account details. Your name, username, Chebu address, recovery email, and sign-in settings such as two-step verification and passkeys. We store your password only as a one-way hash.
- Workspace details. Workspace names, members and their roles, invitations, domains and their DNS settings, API keys, and webhook endpoints. We show an API key once and then keep only a fingerprint of it.
- Mailbox contents. The messages you send and receive, their attachments, and your folders, labels, and flags.
- Message metadata. Senders, recipients, subjects, dates, sizes, headers, authentication results, and spam checks.
- Delivery events. Whether a message was sent, delivered, delayed, bounced, or marked as spam by a recipient. If a workspace turns on open and click tracking for its domain, we also record opens and clicks of that domain's emails.
- Search index. An index built from your mail so you can search it.
- Imports. If you move mail from another provider, the server and login you give us. We store that password encrypted and use it only for the import.
- Billing records. Plan, currency, invoices, payment status, and the brand and last four digits of your card. Our payment processors handle full card details. We never see or store them.
- Usage. Storage used, emails sent, and the number of mailboxes and domains in a workspace.
- Logs and security data. IP addresses, browser and device details sent with requests, sign-in times, and records of requests and errors.
- Messages to us. What you send when you write to support, privacy, or abuse.
Why we use it
We only use personal information when we have a lawful basis for it under the Nigeria Data Protection Act 2023 and other laws that apply. In plain terms:
| Purpose | Legal basis |
|---|---|
| Create your account, then deliver, store, sync, and search your mail | Needed to provide the service you signed up for |
| Bill paid plans and keep invoices | Needed to provide the service, and required by tax and accounting law |
| Filter spam, detect abuse, enforce limits, and track bounces and complaints | Our legitimate interest in a safe service that other mail providers trust |
| Send service messages such as sign-in codes, password resets, invitations, and billing notices | Needed to provide the service |
| Keep the services reliable, using logs and overall usage numbers | Our legitimate interest in running a working service |
| Respond to lawful requests and meet our legal duties | Required by law |
If we ever ask for your consent for something else, you can withdraw it at any time.
How we handle your mail
- Our systems process your mail automatically to deliver it, store it, filter spam and abuse, and index it for your own search.
- People at Chebu do not read your mail. The exceptions are investigating an abuse report or a security problem, helping you when you ask us to and give permission, and when the law requires it.
- We do not use your mail for advertising, we do not build advertising profiles, and we do not sell your mail or any other personal information.
- We do not use your mail or any other data to train AI models, and we do not allow anyone else to.
- Only people with access to a mailbox see its mail. In a workspace, a shared address is visible to the people assigned to it.
Who we share it with
- Service providers. We use cloud infrastructure, email delivery, and payment processing providers to run the services. They may process personal information only on our instructions and must protect it.
- Your workspace. Owners and admins see the workspace's members, mailboxes, domains, and billing. Owners, admins, and developers see the log of email sent through the API and SMTP relay.
- The people you email. Mail you send goes to its recipients and their mail providers.
- Legal requests. We disclose information when the law or a valid legal order requires it, or when needed to protect people from serious harm. Where we are allowed to, we tell you first.
- Business changes. If Chebu is merged or sold, personal information may move to the new owner under this policy. We will tell you before that happens.
International transfers
Our service providers may store or process data in countries other than yours. When personal information moves between countries, we use the safeguards the law requires, such as standard contractual clauses.
How long we keep it
- Mail stays until you delete it or close your account. Deleted mail leaves our backups when those backups expire.
- Account and workspace details stay while the account or workspace is open.
- Suppressed addresses stay on a workspace's suppression list while the workspace exists, so we keep honouring bounces and complaints.
- Billing records are kept for as long as tax and accounting law requires.
- Logs and security data are kept for a limited time, and longer only when needed to investigate abuse or a security incident.
How we protect it
Connections to our servers are encrypted. Passwords are stored as one-way hashes. Sending keys, import passwords, and webhook secrets are encrypted at rest. Only staff who need access to run the services have it. You can add a passkey and two-step verification to your account. Read more on our security page.
No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of the personal information we hold about you
- correct information that is wrong
- delete your information or close your account
- export your data in a portable format
- stop or limit some uses, or object to them
You can change most account details in the app, and you can copy all your mail with any IMAP mail app. For anything else, email privacy@chebu.io from your Chebu address or recovery email. We may ask you to confirm your identity, and we respond within the time the law allows. If your mailbox belongs to a business workspace, we may pass your request to that business.
You can also complain to the data protection authority where you live.
Children
An account used by a child is the responsibility of the parent or guardian who creates or manages it.
Cookies and local storage
- Session cookie. Keeps you signed in to the web app. The app cannot work without it.
- Preference cookies. One remembers your light or dark theme across chebu.io and mail.chebu.io. Another remembers the last folder you opened in the app.
- Local storage. This website saves your preferred currency and code language in your browser.
We do not use analytics, advertising, or third-party tracking cookies, and we do not load third-party trackers on our website or app.
Changes to this policy
We will update the date at the top of this page when we change this policy. If a change is significant, we will tell you by email or in the app before it takes effect.
Contact
Questions or requests about privacy: privacy@chebu.io. To report abuse: abuse@chebu.io.