1. Data controller
The MailTrack service (Chrome extension, API and web portal at mailtraceiq.com) is operated by Kandrian LLC.
Legal entity: Kandrian LLC
Representative: Alejandro Carvallo
Address: 2201 Menaul Blvd NE, Ste A, Albuquerque, NM 87107, United States
Phone: +1 505 300 2798
Privacy contact:
[email protected]
2. Scope
This policy applies to users who register with MailTrack (senders who track emails) and describes how we process data from use of the service. Recipients of emails do not create a MailTrack account, but may generate technical data when opening a message or clicking a tracked link (see section 8).
3. Data we collect
3.1 Registered users (senders)
- Email address.
- API key hash (we do not store the key in plain text).
- Message metadata for tracked sends: subject, date, optional Gmail identifiers (message/thread), recipient list (up to 50), link URLs included when tracking is enabled.
- Aggregated open and click counts per message.
- Notification preferences in the extension (stored locally in the browser).
3.2 Tracking events (generated by recipients)
- Event type (open or click).
- Timestamp.
- IP address (may be truncated or anonymized per server configuration).
- User-Agent and derived device category (e.g. mobile, desktop).
- Referer host header (without path or query parameters).
- Client preferred language (truncated Accept-Language header).
- Automated estimate of human vs. mail-client prefetch or security scanner activity (not a guarantee).
- Country and network organization inferred from IP via local GeoIP (
geoip-lite), without sending the IP to third parties for this lookup. - On tracked link clicks: a brief intermediate page that runs JavaScript before logging the click and redirecting.
- Invisible honeypot element: automated requests are logged as likely automated activity.
- Technical token linking the event to the message (does not identify the recipient by name).
3.3 Data we do not intentionally collect
- Full email body content (except metadata and links the sender submits to the API when enabling tracking).
- Gmail passwords (the extension does not replace Google sign-in).
- Recipients' inboxes.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide tracking requested by the sender | Contract / pre-contractual steps (Art. 6(1)(b)) |
| Security, fraud prevention, rate limiting | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Product improvement (aggregated statistics) | Legitimate interest with minimization (Art. 6(1)(f)) |
5. How tracking works
When a sender emails with MailTrack enabled, an invisible pixel may be inserted and
links may route through our domain (mailtraceiq.com) to log opens and clicks.
Many email clients block images by default. Services like Apple Mail Privacy Protection may produce open signals
not attributable to a real read.
6. Who receives the data
- Authorized Kandrian LLC personnel / service operators.
- Infrastructure providers (hosting, database, proxy) under contract and security measures.
- We do not sell personal data to third parties.
7. International transfers
Servers may be located outside your country. When required by law (e.g. EEA), we apply appropriate safeguards (standard contractual clauses, adequacy decisions, or other measures).
8. Information for email recipients
If you receive an email sent with MailTrack, the sender may be using read and click tracking. To limit tracking you can:
- Configure your email client to not load images automatically.
- Avoid clicking links if you do not trust the sender.
- Use privacy filters or extensions that block tracking pixels.
To exercise rights regarding data that identifies you, email [email protected] with the message subject and approximate date.
9. Retention
We retain data while the account is active and, after closure or prolonged inactivity, up to 24 months unless a longer legal retention period applies.
10. Your rights
As a registered user you may request:
- Access, rectification, erasure, restriction or objection to processing.
- Data portability for data you provided.
- Withdraw consent where processing is consent-based.
- Lodge a complaint with a supervisory authority.
Send requests to [email protected] from your registered email or with proof of identity. We aim to respond within 30 days.
11. Security
We use HTTPS, API key hashing, firewall, rate limiting and restricted database access. No system is 100% secure; we will notify serious incidents when required by law.
12. Minors
The service is not directed at children under 16.
13. Changes
We may update this policy. The new version will be published at this URL with an effective date. Continued use after material changes may require renewed acceptance in the extension.
14. Contact
Privacy: [email protected]
Terms of use: mailtraceiq.com/terms