Privacy policy
Last updated: November 2026
1. Controller
26LAB.IO, Christian Gudermann, Hasselbeckstr. 37, 40822 Mettmann, Deutschland / Germany. Email: hello@26lab.io, phone: +49 177 2262453. We have no data protection officer because the law does not require one for us (Art. 37 GDPR, § 38 BDSG).
2. Visiting this website
To deliver the page, the server processes your IP address, the time and the requested address. The server keeps the IP address in memory only, to limit sign-in attempts and submissions per sender. We never write it to disk, not even in access logs. The legal basis is our legitimate interest in running the service securely (Art. 6(1)(f) GDPR). There are no analytics tools, no trackers and no third-party content. Fonts come from our own server.
3. Cookies
We set one cookie: mailiy_session, when you sign in to the dashboard. Sign-in does not work without it (§ 25(2) no. 2 TDDDG). It expires after 30 days and is deleted when you sign out. That is why there is no cookie banner.
4. Account
For your account we store your email address, a scrypt hash of your password, an encrypted TOTP secret and hashed recovery codes if you set them up, your language, time zone and notification settings, your plan, monthly counters for deliveries and spam, and the date and version of the terms and data processing agreement you accepted. For each session we store the browser and operating system (for example “Firefox · Windows”), but no IP address. If an email to one of your addresses bounces for good, we store the date and error code of the bounce with that address. The legal basis is our contract with you (Art. 6(1)(b) GDPR); for the proof of consent it is our legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).
We check new passwords against a list from known data breaches (Pwned Passwords). The list is stored on our server, so your password never leaves it for this check.
5. Emails to you
We send you sign-in codes, links to confirm addresses and to reset your password, alerts about new sign-ins and about a nearly used-up quota. These are part of the contract. You only get the monthly report if you turn it on in the dashboard. We do not send advertising.
6. Form submissions
For submissions sent through our customers' forms, the customers are the controllers. We only process these submissions on their behalf (Art. 28 GDPR, see the data processing agreement). We deliver them by email, forward them by webhook to an address the customer chooses if they want that, and, depending on settings, store them encrypted with AES-256-GCM for up to 365 days. After that we delete them automatically. Submissions caught by the customer's spam filter are kept for 7 days at most. We do not store sender IP addresses. If the customer has blocked IP addresses, we compare yours with that list in memory only. If you have a question about a submission, ask the operator of the website where you sent the form.
7. Recipients
Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland, as our processor. Emails go out through our own mail server on the same machine. No data is transferred to countries outside the EU or EEA.
8. Retention
We keep account data for as long as the account exists. After you delete it, you can restore the account for 30 days; then we remove everything. We delete the mark on an undeliverable address after 90 days or as soon as you reset it in the dashboard. We keep the proof of accepted terms for as long as claims under the contract are possible (usually three years after the contract ends, § 195 BGB). For paid plans we keep invoice data for eight to ten years for tax reasons (§ 147 AO, § 257 HGB).
9. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR). You can export or delete your data yourself in the dashboard under “Account”; for everything else, email hello@26lab.io. You can also complain to a supervisory authority, for example the data protection commissioner of North Rhine-Westphalia (LDI NRW).