Privacy Policy

Last updated: 19 June 2026

ConexusMail is a service operated by Bensen LLC ("Bensen LLC", "we", "us") that imports email threads from a mailbox you connect and renders them as an instant-message-style conversation. This policy explains what we collect, why, and how you can delete it.

What we collect

1. Account data

When you create an account we store your email address, a one-way bcrypt hash of your password, an optional display name, and the timestamp at which you signed up. We never store your password in plain text.

2. Mailbox credentials

When you connect an IMAP/SMTP mailbox we store the host, port, username, and password (or app-specific password). Passwords are encrypted at rest using AES-GCM with a key derived from a deployment-level secret. They are decrypted only at poll time and never logged.

3. Email content

We import message headers (subject, sender, recipients, dates, the Message-ID / In-Reply-To / References threading chain), body text and HTML, and attachments. This data is used only to render your conversation view inside the product. We never read it for advertising and never sell it to third parties.

4. Billing data

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your card number or CVV — only a Stripe customer ID, subscription ID, and the plan, status, and trial-end timestamps returned by Stripe webhooks. Stripe's own privacy practices are at stripe.com/privacy.

5. Cookies

We set a session cookie when you sign in (JSESSIONID) and, if you tick "Stay signed in for 30 days", a long-lived remember-me cookie. We do not use advertising cookies, third-party trackers, or analytics that profile you across sites.

How we use it

Account and mailbox data is used to authenticate you, fetch and render your email, and process subscription payments. Billing data is used to grant access to the plan you paid for. We do not use any of it for marketing without your explicit consent.

How long we keep it

Account, mailbox, and email data are retained until you delete the mailbox or account. When you remove a mailbox we delete its stored credentials and stop syncing it; conversations already imported remain in your inbox until you delete your account. When you delete your account we purge all of the above — account data, mailbox credentials, imported messages and attachments — including billing metadata after Stripe's required retention window (typically 7 years for tax records on the invoice side, held by Stripe — not us).

Your rights

You can export or delete your data at any time by emailing privacy@conexusmail.com from the address on your account. EU/UK residents have additional rights under GDPR (access, rectification, erasure, portability, restriction, objection); California residents have additional rights under CCPA. We honor every applicable request within 30 days.

Contact

Questions about this policy go to privacy@conexusmail.com.

This page is shipped as starting boilerplate. If you are reading this in production, the operator has not yet replaced it with a jurisdiction-reviewed policy.