legal · last updated August 2026

Privacy policy

This explains what happens with personal data on alohamail.co and in the Aloha Mail service. It is written to be read.

Controller: Mario Berger, Am Mühlkamp 28, 3492 Walkersdorf, Austria. Email: mario@alohamail.co

1. Visiting the website

This website is hosted on Cloudflare Pages (Cloudflare, Inc., US). The application at app.alohamail.co runs on our own server in Austria and is reachable through a Cloudflare tunnel. When you visit, the server processes your IP address, browser type, and the pages you open, in server logs, to deliver the site and keep it secure. Legal basis: legitimate interest (Art 6(1)(f) GDPR). Logs are deleted after 7 days.

Analytics: this site uses Cloudflare Web Analytics. It counts page views and referrers and reports them in aggregate. It sets no cookies, builds no profile, and does not follow you to other sites; your IP address is processed transiently to filter bots and is not stored against your visit. Legal basis: legitimate interest (Art 6(1)(f) GDPR). There are no advertising trackers on this site.

Cookies: the site sets one cookie, `am_access`, after checkout. It is technically necessary, holds no tracking information, and expires after seven days. Nothing else is stored on your device.

2. Signing up for the service

During checkout and onboarding, the following is processed: your name, email address, business details, brand and shop information you provide, and your payment details. Purpose: providing the service you signed up for. Legal basis: performance of a contract (Art 6(1)(b) GDPR).

Payment details go directly to the payment processor Stripe Payments Europe, Ltd. (Ireland) and are not stored by Aloha Mail. Stripe's own privacy policy applies to that processing.

3. Providing the service

To plan and write your emails, Aloha Mail processes data from your shop and your Klaviyo account: product information, past campaigns, campaign results, segment names and sizes. This can include personal data of your customers contained in that account. For that data, you remain the controller and Aloha Mail acts as your processor; a data processing agreement is available on request.

Service providers involved:

•Klaviyo, Inc. (US) — your email platform

•Stripe Payments Europe, Ltd. (Ireland) — payments

•Anthropic PBC (US), OpenAI, L.L.C. (US), Moonshot AI (Singapore), MiniMax (Singapore), and self-hosted models on our own hardware in Austria — text generation. Inputs are limited to what is needed for drafting: your brand information, your products, and your own past emails. Your customer lists are never sent to an AI provider.

•Cloudflare, Inc. (US) — website hosting and network

•Resend (US) — transactional email

•Our own server in Austria — application and database

Where providers are outside the EU/EEA (notably the US), transfers rely on adequacy decisions (EU-US Data Privacy Framework) or standard contractual clauses.

4. Email from Aloha Mail

If you are a customer, you receive transactional emails about your plans and drafts (contract performance). A newsletter, if any, is sent only with consent, which you can withdraw with one click in any issue.

5. Retention

Contract and billing data are kept for the legally required periods (in Austria generally 7 years, § 132 BAO). Onboarding materials and drafts are deleted 6 months after your subscription ends, unless you ask for earlier deletion of what the law does not require keeping.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and objection (Art 15 to 21 GDPR), and the right to withdraw consent at any time with effect for the future. Contact: mario@alohamail.co. You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at) or your local supervisory authority.

Questions about any of this go to mario@alohamail.co and get answered by the person who wrote it.