Mailopoly

GDPR overview

There is no mention of the GDPR anywhere on this site — not in the privacy policy, not in the terms, not on the security page. The words GDPR, Article 27 and data protection officer return nothing across every page collected. No EU representative is designated, no customer data processing agreement is published or offered, and no hosting country or region is declared. The publisher is Australian and the agreement is governed by New South Wales law, with no reference to European law at all. Mechanisms that would matter under the GDPR do exist, but they are never framed that way: access, correction and deletion on request, withdrawal of consent to AI processing, deletion of email data within 30 days of closing an account, and encryption in transit and at rest. The CASA Tier 2 assessment cited is a security validation, not a privacy compliance one.

Who owns the data?

Nothing in the terms transfers ownership of your mail to Mailopoly. The company accesses email content, metadata and attachments only to deliver the service, and the privacy policy states it neither sells your data nor uses it for advertising. Site content itself stays Mailopoly's and may not be copied or reproduced. Sharing is narrower than it first reads: the terms let Mailopoly disclose personal information to government authorities as the privacy policy permits, and note it may share personal information with clients and their employees without further notice, but otherwise commits not to disclose to third parties unless you were told beforehand or the law requires it. The agreement is governed by New South Wales law and may be assigned if the business is sold.

Reuse rights

You keep full practical control of your own material. Mailopoly connects to accounts you already own, so nothing is migrated and your existing addresses keep working exactly as before; the mail stays in the provider mailboxes it arrived in. You can request access to, correction of, or deletion of your personal data through the platform, and the mobile applications must offer data deletion and export. Consent to AI-powered processing can be withdrawn at any time in account settings. No clause restricts what you do with the contents of your own correspondence. The one explicit limit points the other way: you may not use automated tools to monitor or copy Mailopoly's own web pages without written permission.

Data retention & training

Hosting summary

The site declares no hosting country and no hosting region. Neither the privacy policy, the terms nor the security page names a jurisdiction where user data is stored, so data residency cannot be confirmed from published material. What can be said is narrower. The publisher is Mailopoly Pty Limited of Sydney, and the terms are governed by New South Wales law with exclusive jurisdiction in NSW courts. Technical signals point the same way without being a vendor statement: the domain resolves to an Australian IP address in Sydney on Amazon Web Services, and the application subdomains carry an AWS naming pattern. Named third parties that process user data are disclosed — Google, Anthropic, OpenAI and xAI — under commercial data processing agreements. Stated protections are encryption in transit and at rest, strict access controls, regular reviews, and a CASA Tier 2 assessment by TAC Security. Messages between two @mly.life addresses are said never to leave Mailopoly's own encrypted network.