Privacy Policy
This policy explains how personal data is processed in the BulutMail email service, webmail (webmail.bulutmail.com), the BulutMail mobile app (iOS and Android) and the bulutmail.com website. It also serves as the information notice required by Turkish Personal Data Protection Law No. 6698 ("KVKK").
Last updated: 7 October 2026 · Türkçe (the Turkish version prevails in case of conflict)
In short: We do not use your email for advertising, profiling or sale. The mobile app contains no ads, analytics or tracking tools. Your data is processed in Turkey, in our own data center. The only exception is push notifications, which are delivered through Apple and Google notification servers (see Section 4).
1. Data Controller
BulutMail is a service of Alastyr Telekomünikasyon A.Ş. The data controller for your personal data is:
| Company | Alastyr Telekomünikasyon A.Ş. |
|---|---|
| Address | 5747 Sokak No:84 Bornova / İzmir / Türkiye |
| Tax office / no | Ege V.D. · 048 057 38 20 |
| Phone | +90 (850) 850 46 78 |
| info@alastyr.com | |
| Registered email (KEP) | alastyr@hs03.kep.tr |
Your email account is usually created and managed by the organization that owns your domain name (for example, your employer). That organization is also a data controller for the accounts of its own staff or members. We provide the service on its behalf, under our agreement with it.
2. Personal Data We Process
2.1. Account information
- Email address and display name
- Password. It is stored on the mail server in a non-reversible (hashed) form. For the mobile app, see Section 4.
- Your webmail settings, signatures and address book
2.2. Email content
- Messages you send and receive, their attachments and headers
Messages are kept in your mailbox until you delete them or the account is closed. Content is processed automatically only to provide the service and for security (spam and malware scanning). It is never used for advertising, profiling or marketing, and never sold.
2.3. Email traffic and security logs
- Sender and recipient address, subject, date and time, IP address of the sending server
- Delivery status (delivered, deferred, bounced) and bounce reason
- Spam and virus scan result, quarantine record
- Daily number of messages sent per account (to prevent abuse)
2.4. Technical data
- IP address, access date and time, browser or device type
- Webmail session cookies (see the Cookie Policy, in Turkish)
2.5. Support correspondence
Information you provide when you contact support, and the history of that conversation.
3. Purposes and Legal Grounds
| Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|
| Providing the email service, webmail and mobile app; delivering messages | Performance of a contract (c) |
| Detecting spam, viruses, phishing and compromised accounts; account security | Legitimate interest (f) |
| Sending limits, abuse prevention and service continuity | Legitimate interest (f) |
| Telling you why a message could not be delivered | Performance of a contract (c) |
| Technical support | Performance of a contract (c) |
| Requests from competent authorities and legal retention duties | Legal obligation (ç) |
| Sending the push token and notification text to Apple / Google (abroad) for push notifications | Explicit consent (KVKK Art. 9): given when you turn notifications on, withdrawn when you turn them off |
| Protecting our rights in disputes | Establishment, exercise or protection of a right (e) |
Automated spam and security checks may quarantine a message or temporarily stop an account from sending. To object to such a decision, contact support; a member of our staff will review it.
4. BulutMail Mobile App
The BulutMail app works only with domain names hosted on Alastyr infrastructure. The app connects to your mail server through our mobile server (mapi.bulutmail.com, located in Turkey). Data kept and processed on that server:
| Data | Why | How long |
|---|---|---|
| Email address, mail server name, display name | To connect to your account | Deleted immediately when you remove the account from the app. Deleted automatically if your device does not connect for 90 days. |
| Your password (encrypted with AES-256-GCM) | To fetch and send mail, notify you of new mail and send scheduled messages | |
| Device record: random device ID, platform (iOS/Android), push token, app language, notification preview setting, last connection time | To recognize your session and send notifications | Deleted when you remove the last account from the app, or after 90 days of inactivity |
| Scheduled messages and follow-up reminders (encrypted) | To send a message at the time you choose, or remind you | Content is deleted as soon as it is sent; the record itself is deleted after 30 days |
| Your spam / not spam reports: your address, sender, subject, message ID | To improve spam filters | 1 year |
| Technical log: IP address, time, request type and path | Security and troubleshooting | 14 days. Search terms and message content are not written to this log. |
4.1. Email content
Your messages are fetched from your mail server and passed directly to your device. They are not stored on our mobile server. The only exception is scheduled messages, described above.
4.2. Push notifications
If you turn notifications on, your device is notified when new mail arrives. Notifications are delivered through Apple Push Notification service (iPhone) and Google Firebase Cloud Messaging (Android), whose servers are located outside Turkey. These providers receive your device's push token and the notification text:
- With previews on, the text includes the sender's name and the subject.
- With previews off, only your own email address (the account that received the mail) and the text "New email" are sent; sender and subject are not.
- The message body and attachments are never sent in a notification.
Notifications are optional. This transfer abroad is based on the explicit consent you give by turning notifications on. You can withdraw it at any time by turning notifications or previews off in the app or in your device settings. If you do not use notifications, the transfer does not happen at all.
4.3. Stored on your device
- Session key, in the device's secure storage (iOS Keychain, Android Keystore)
- App settings and your signatures
- Attachments you open, only temporarily for viewing or sharing; the app cleans them up
4.4. Permissions
The app only asks for these permissions, both optional:
- Notifications: to tell you about new mail
- Face ID / fingerprint: if you turn on app lock. The operating system performs the check; your biometric data never reaches the app or us.
The app does not ask for location, contacts, camera, microphone or photo library access. When you attach a file, you pick it yourself with the device's own file picker.
4.5. Advertising and tracking
The app contains no advertising, analytics or tracking tools (SDKs). We do not track you across other apps or websites, and we do not sell your data or share it for advertising.
4.6. Account settings
Auto-reply, forwarding and password changes are made directly on your mail server, using your own password. The app does not keep a separate copy of these settings.
5. Sharing and Transfers
- The organization that manages your account can manage it through its own hosting panel (password, quota, closing the account).
- Competent public authorities, only where required by law and upon a proper request.
- Recipients' mail servers: by the nature of email, messages you send are delivered to the recipient's mail server, in Turkey or abroad.
- Apple and Google (abroad), only for push notifications and with your consent, as described in Section 4.2.
- App stores: when you download the app from the App Store or Google Play, those stores process data under their own privacy policies. That processing is not under our control.
The email service, webmail and mobile server run in Alastyr's own data center in Bornova, İzmir. No data is transferred to another hosting company for these services.
6. Retention
| Data | Period |
|---|---|
| Messages in your mailbox | Until you delete them or the account is closed |
| Email traffic and delivery logs | About 31 days |
| Quarantined messages | Deleted automatically when the quarantine period ends |
| Per-account sending counts (no message content or recipients) | For the duration of the service |
| Mobile app data | See the table in Section 4 |
| Support correspondence | For the duration of the service relationship and statutory periods |
Longer retention required by law takes precedence. Expired data is deleted, destroyed or anonymized.
7. Security
- TLS encryption on all connections
- Passwords kept for the mobile app are encrypted with AES-256-GCM; session keys are stored on the server only as hashes
- The mobile server connects only to mail servers on Alastyr's network
- Spam, virus and phishing scanning; automatic detection of compromised accounts
- Role-based staff access, firewalls and continuous monitoring
- ISO/IEC 27001 information security management system
8. Your Rights
Under Article 11 of KVKK you may:
- Learn whether your personal data is processed and request information about it
- Learn the purpose of processing and whether data is used accordingly
- Know the third parties, in Turkey or abroad, to whom data is transferred
- Ask for incomplete or inaccurate data to be corrected
- Ask for your data to be deleted or destroyed under the conditions of Article 7
- Ask for corrections and deletions to be notified to third parties who received the data
- Object to a result against you arising solely from automated analysis
- Claim compensation for damage caused by unlawful processing
How to apply: send your request, with information that verifies your identity, by registered email (KEP) to alastyr@hs03.kep.tr, by signed letter to the address above, or from the email address registered with us to info@alastyr.com. We respond free of charge within 30 days. If you are not satisfied, you may complain to the Turkish Personal Data Protection Board.
9. Account and Data Deletion
Removing an account from the mobile app immediately deletes the information we keep for it on our server. To close the email account itself and delete all of its data, follow the steps on the Account and Data Deletion page.
10. Children
BulutMail is a business email service and is not designed for people under 18. We do not knowingly collect data from children; if we become aware of it, we delete the data.
11. Changes
We may update this policy. For significant changes we will post a notice on the website and, where appropriate, in the app. The current version is always on this page, with the date at the top.
12. Contact
Privacy: info@alastyr.com · KEP: alastyr@hs03.kep.tr
Technical support (24/7): destek@alastyr.com · +90 (850) 850 46 78
Support page: bulutmail.com/support.html