Home · Pricing · Help centre · Terms · Privacy · Cookies · Acceptable use · Sign in
Privacy Policy
What Emwing collects, why, and how long we keep it. No ads, no selling data, tracking pixels blocked, end-to-end encryption between Emwing users, and mail stored in Germany.
Who we are
This Privacy Policy is provided by Emwing GmbH, Torstraße 140, 10119 Berlin, Germany, registered with the Amtsgericht Charlottenburg under HRB 245120 B (“Emwing”, “we”, “us” or “our”). We are the controller of the personal data described in this policy for the purposes of Regulation (EU) 2016/679 (the “GDPR”) and the German Federal Data Protection Act (BDSG).
This policy applies to the Emwing email service, including the web app, our desktop and mobile apps and the website emwing.com (together, the “Service”). It explains what personal data we process, why we process it, how long we keep it, who we share it with and the rights you have.
You can contact our data protection officer at dpo@emwing.com, or write to Emwing GmbH, Data Protection Officer, Torstraße 140, 10119 Berlin, Germany. For all other privacy questions, write to privacy@emwing.com.
Information you give us
When you create an account, we collect your first name, the @emwing.com address you choose, your password (stored only as a salted hash), and a recovery email address or phone number. If you register a passkey, we store its public key; the private key never leaves your device.
When you subscribe to a paid plan, we collect your billing name, billing address, country and VAT number where applicable. Card and payment details are collected and processed directly by our payment provider. We receive only a token, the card type, the last four digits and the expiry date.
When you contact support, we collect the information you give us, such as your name, email address and the content of your message, and keep a record of our conversation so we can help you.
If you connect a custom domain, we store the domain name and the DNS records needed to confirm ownership and route mail for it.
Your mail and contacts
To provide the Service we store and process the messages, attachments, contacts, labels, notes, snippets and settings in your account (“Your Content”), together with the delivery metadata needed to route mail, such as sender and recipient addresses, timestamps, message size and delivery status.
We process Your Content only to deliver, store, index, sync, back up and protect it for you. Automated checks run on incoming mail to filter spam and malware and to block tracking pixels. These checks are fully automated; no person reads your mail as part of them.
Our staff do not access Your Content unless you ask us to for support, it is strictly necessary to investigate a security incident or a serious breach of our Acceptable Use Policy, or we are legally required to do so. Every such access is logged and limited to what is necessary.
When you hand an email to a teammate through Wingman, or use a shared inbox, the people you share with can see the message, its attachments and your note. When you import mail from another provider, we access that provider only with the permission you give, only for the import you requested, and remove that access afterwards.
On your device
To make search instant and to let you work offline, the Service keeps a local cache of your mailbox on each device on which you use Emwing. In the browser, this cache is kept in IndexedDB and local storage; in our apps, it is kept in the app’s private storage.
The local cache is encrypted with a key tied to your device and your account. It is not accessible to other websites or apps. Mail you send while offline is held in an encrypted queue on your device until it can be sent.
You can clear the local cache at any time in Settings → Devices, by signing out, or by uninstalling the app or clearing your browser’s site data. If you sign a device out remotely, its cache is deleted the next time it connects.
Information collected automatically
When you use the Service, our servers record technical information such as your IP address, the time of the request, the device and app version, the browser type and error reports. We use this information to operate the Service, detect and prevent abuse, and fix problems.
We keep a list of the devices signed in to your account, with the approximate location derived from the IP address at sign-in, so you can review and sign out devices in Settings → Security.
We do not use third-party analytics, advertising or social media trackers on emwing.com or in the Service. We measure the performance of the Service using aggregated, anonymised figures that do not identify you.
Encryption
Mail between two Emwing addresses uses end-to-end encryption: it is encrypted on the sender’s device and can only be decrypted on the recipient’s device. We cannot read its contents.
Other mail is encrypted in transit using TLS wherever the other mail server supports it, and all mail stored on our servers is encrypted at rest. Connections to emwing.com and our apps are always encrypted.
How we use your data and why
We process personal data only where we have a legal basis under Article 6 GDPR, as follows.
To provide the Service under our contract with you (Article 6(1)(b) GDPR): creating and managing your account, delivering, storing, indexing and syncing your mail, providing offline mode, Wingman and shared inboxes, processing imports, and giving you support.
To take payment and keep accounts (Article 6(1)(b) and (c) GDPR): processing payments, issuing invoices, and keeping billing records as required by German commercial and tax law.
To keep the Service secure (Article 6(1)(f) GDPR, based on our legitimate interests and those of our users in a safe, reliable service): detecting and preventing spam, fraud, account takeover and abuse, filtering malware, and maintaining technical logs.
To meet legal obligations (Article 6(1)(c) GDPR): responding to lawful requests from authorities and complying with our obligations under tax, commercial and telecommunications law.
To send you service messages (Article 6(1)(b) GDPR): security alerts, billing notices, renewal reminders and notices of changes to our terms. We only send product news or tips with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time with one click.
What we never do
We never show advertising in Emwing, and we never use Your Content or your personal data for advertising, profiling or marketing by third parties.
We never sell or rent personal data, and we never share it with data brokers.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
Who we share it with
We use a small number of service providers who process personal data on our behalf as a processor under data processing agreements that meet the requirements of Article 28 GDPR. They may only use the data to provide their services to us.
These providers fall into the following categories: (a) data centre and hosting providers in Germany, which host our servers and backups; (b) our payment provider, which processes card and other payments; (c) a transactional email provider, which delivers account and billing notifications to your recovery address; and (d) a support ticketing provider, which helps us answer your messages.
When you send mail, it is delivered to the recipient’s mail provider, which processes it under its own privacy policy. When you use Wingman or shared inboxes, the content you share is visible to the teammates you choose.
We may disclose personal data where we are legally required to do so, for example in response to a binding order of a German court or authority. We review every request carefully, push back on requests that are unlawful or too broad, and, where the law permits, tell you before disclosing your data.
If Emwing is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, which will be bound by this policy. We will tell you in advance.
Where your data lives
Your account data and Your Content are stored in data centres located in Frankfurt and Nuremberg, Germany, operated under contracts that meet the requirements of the GDPR.
We do not routinely transfer personal data outside the European Economic Area. Where a service provider needs to access personal data from outside the EEA, for example to provide round-the-clock support, we ensure an adequate level of protection through an adequacy decision of the European Commission or through standard contractual clauses, together with additional safeguards where needed. You can request a copy of these safeguards from privacy@emwing.com.
How long we keep it
Account data and Your Content are kept for as long as your account exists. When you close your account, it enters a 30-day grace period during which you can reopen it; after that, your data is permanently deleted from our live systems.
Mail you delete is removed from your account when you empty the bin, or automatically after 30 days in the bin. Deleted data is purged from our encrypted backups within 30 days.
Billing records, including invoices, are kept for 10 years as required by German commercial and tax law (section 147 of the German Fiscal Code, AO, and section 257 of the German Commercial Code, HGB).
Server logs are kept for 7 days, unless a specific entry is needed for longer to investigate a security incident. Support conversations are kept for 2 years after they are closed.
How we protect it
We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, end-to-end encryption between Emwing addresses, device-bound encryption of the local cache, passkey support, strict role-based access for our staff, logging of all administrative access, and regular security testing.
Our staff are bound by confidentiality obligations and receive regular training on data protection and security.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and inform you without undue delay where the risk is high.
Your rights
Under the GDPR you have the right to: (a) access the personal data we hold about you (Article 15); (b) have inaccurate data corrected (Article 16); (c) have your data erased (Article 17); (d) restrict processing (Article 18); (e) receive your data in a structured, commonly used, machine-readable format and have it transmitted to another provider (Article 20); and (f) object to processing based on legitimate interests (Article 21).
Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
You can exercise most of these rights yourself in Settings: update your details under Account, export your mail and contacts under Export, and close your account under Account → Close account. For anything else, write to privacy@emwing.com. We respond within one month, which may be extended by two further months for complex requests, in which case we will tell you why.
We may need to confirm your identity before acting on a request, to make sure we do not disclose data to the wrong person. Exercising your rights is free of charge.
California residents
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”) gives you the right to know what personal information we collect, use and disclose; to request deletion of your personal information; to correct inaccurate personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
In the past 12 months we have collected the following categories of personal information: identifiers (such as your name, email address and IP address); commercial information (such as your plan and payment history); internet or other electronic network activity (such as technical logs); and the content of your communications, which we process solely to provide the Service. We collect this information from you and from your use of the Service, and we use it for the business purposes described in this policy.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the past 12 months. We use sensitive personal information, such as account credentials and the contents of your mail, only to provide the Service.
To exercise your rights, write to privacy@emwing.com. You may use an authorised agent. We will confirm the request comes from you using information associated with your account and respond within 45 days.
Children
The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under that age. If we learn that we have collected personal data from a child under 16, we will delete it promptly. If you believe a child has given us personal data, please contact privacy@emwing.com.
How to complain
If you have a concern about how we handle your data, please contact our data protection officer at dpo@emwing.com. We take every concern seriously and will respond promptly.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place. Our lead supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.
Changes to this policy
We may update this Privacy Policy to reflect changes in the Service or in the law. The date at the top shows when it was last updated. If we make material changes, we will notify you by email and within the Service before they take effect. Previous versions are available on request from privacy@emwing.com.
Contact us
Emwing GmbH, Torstraße 140, 10119 Berlin, Germany. Privacy questions: privacy@emwing.com. Data protection officer: dpo@emwing.com. Support: support@emwing.com.