ViestiLast updated 18 September 2026.
This policy covers the data Viesti processes to operate the relay.
What we collect
- Account — sign-in identity from GitHub or Google: provider ID, email address, display name.
- Sending setup — domain names, DKIM keys, verification tokens, API key hashes, credential labels.
- Message data — sender, recipients, subject, size, status, delivery events, and the raw message body while it is retained.
- Suppressions — addresses you or feedback-loop reports block, with reasons.
- Billing — plan, subscription and checkout identifiers, per-message usage counts. Card details are held by Polar, never by Viesti.
- Technical — client IP for rate limiting, and a signed session cookie. No analytics or tracking cookies.
How it is used
To authenticate you, verify domains, relay and report on your mail, screen for spam and abuse, enforce quotas, and bill paid plans. We do not sell personal data and do not use message content for advertising.
Who receives it
- Recipient mail servers — your message, to deliver it.
- Content classifier — decoded message text of sampled mail, for spam, phishing, and purpose scoring. New workspaces and domains are screened on every message; established ones are cryptographically sampled.
- Polar — subscription and checkout data when you pay.
- GitHub / Google — only when you choose them to sign in.
Retention
Raw message bodies are deleted 30 days after a message reaches a terminal state. Delivery events are kept 180 days and inbound abuse reports 90 days. Message metadata, screening results, suppression history, and billing records are kept indefinitely as the abuse and financial record.
Your recipients' data
You are the controller of your recipients' data. Send only with a lawful basis, honor opt-outs, and use suppressions to stop mail to anyone who asks.
Security and contact
Transport is TLS, API keys are stored as hashes, and sessions are signed cookies. For access, correction, or deletion requests, contact [email protected].