Privacy Policy — Mail RP
Oct 23, 2026 · @Xelyos
This policy explains what personal data Mail RP processes, why, for how long and with whom, as well as your rights. It applies to Visitors, Administrators and Users, and supplements the Terms of Use and the Terms of Sale. Capitalized terms have the meaning given in the Terms of Use.
1. Data controller
The data controller is Thomas Vandewattyne (Xelyos) EI, 32 chaussée Brunehaut, 59161 Naves, France. For any question about your data: contact@xelyos.fr.
Role of the Administrator. A Server's Administrator can view the Messages exchanged on their Server and create User Accounts. They are responsible for how they use this information, which must be limited to running and moderating their Server (Article 5 of the Terms of Use). A Domain Manager has the same access, limited to the RP Mailboxes of their domain.
2. Data collected
Mail RP collects only the data needed for the Service. Card details are entered directly with Stripe and never pass through our servers.
| Category | Data | Provided by |
|---|---|---|
| Account | Last name, first name, email address, password (stored in hashed form), two-factor authentication settings | You |
| Server | Server name, domains and subdomains, configuration, API keys | The Administrator |
| Role-play | RP Mailboxes, character names, Messages, attachments and media | Administrators and Users |
| Subscription | Plan, payment history, invoices, Stripe customer ID, billing address | The Administrator and Stripe |
| Technical | IP address, login dates, browser, error and security logs | Generated automatically |
| Support | Exchanges by email or on Discord | You |
Messages are fictional. Do not include any real information about yourself or others.
3. Purposes and legal bases
Each processing operation relies on a legal basis under Article 6 of the GDPR. No data is sold, used for advertising, or passed to third parties for analysis or for training artificial intelligence models.
| Purpose | Legal basis |
|---|---|
| Create and manage Accounts, Servers and RP Mailboxes; deliver Messages | Performance of the contract (Terms of Use) |
| Manage subscriptions, payments and invoices | Performance of the contract (Terms of Sale) and legal accounting obligation |
| Send service emails (confirmation, security, recovery code, notices to Administrators) | Performance of the contract |
| Secure the Service, prevent fraud and abuse | Publisher's legitimate interest |
| Handle reports and apply moderation measures | Legal obligation (EU Digital Services Act) and legitimate interest |
| Retain connection data and respond to authorities | Legal obligation |
| Respond to support requests | Legitimate interest |
4. Retention periods
Data is kept for as long as the Account is active, then as set out in the table below.
| Data | Period |
|---|---|
| Administrator Account deleted at its holder's request | Last name, first name and email anonymized upon request; Account deactivated and recoverable for 30 days with the recovery code |
| Content of the Server of a deleted Administrator Account (RP Mailboxes, Messages, media) | Inaccessible from deletion |
| Content of a deleted User Account (RP Mailboxes, Messages, media) | Inaccessible from deletion |
| Invoices and accounting records | 10 years (accounting obligation) |
| Connection data (IP, dates) | 1 year (legal obligation for hosting providers) |
| Reports and moderation decisions | 1 year after the decision |
Note on recovery. During the 30 days in which the Administrator Account remains recoverable, the data needed to restore it is kept separately and securely. It is permanently erased at the end of that period.
5. Recipients and processors
Your data is accessible only to the following persons and providers, each within its own scope.
| Recipient | Role | Data concerned |
|---|---|---|
| OVH SAS (Roubaix, France) | Processor: hosting of servers and databases | Service data other than images and media, without accessing or using it |
| Amazon Web Services (AWS); eu-west-3 Paris region | Processor: storage of images and media | Images and media published through the Service, without accessing or using them |
| Stripe | Payment provider; processor for payment collection, controller for its own obligations (fraud prevention and anti-money laundering) | Administrators' subscription and payment data |
| Discord Inc. | Chat platform used for support, if you choose this channel | Support exchanges on Discord |
| Server Administrator and Domain Managers | Access to the Server's Messages and RP Mailboxes, or to the domain only for a Domain Manager | Role-play data within that scope |
| Judicial or administrative authorities | Upon legal request only | As requested |
Each processor is bound by a contract compliant with Article 28 of the GDPR.
6. Transfers outside the European Union
Service data is hosted in France (OVH; AWS, eu-west-3 Paris region). AWS and Stripe belong to US groups: access from the United States remains possible, in particular for support or at the request of an authority. Payment data may also be transferred by Stripe to the United States, and support exchanges on Discord are processed by Discord Inc. in the United States. These transfers are covered by the safeguards provided for by the GDPR (adequacy decision or European Commission standard contractual clauses), described in these providers' privacy policies.
7. Cookies
Mail RP uses only cookies strictly necessary for the Service to operate: no advertising, audience measurement or tracking cookies. These cookies are exempt from consent, which is why no banner is shown to you.
You can block these cookies in your browser settings, but login and payment will no longer work.
8. Security
The Publisher protects your data with appropriate measures: encrypted connections (HTTPS), passwords stored in hashed form, two-factor authentication available, restricted server access, regular backups. In the event of a data breach posing a risk to your rights, the Publisher notifies the CNIL (the French data protection authority) within 72 hours and informs you if the risk is high.
9. Your rights
You have the following rights over your data: access, rectification, erasure, restriction, objection (for processing based on legitimate interest), portability, and the right to give instructions on what happens to your data after your death.
- From your account area: update your information and delete your Account.
- By email to contact@xelyos.fr for any other request. Proof of identity may be requested in case of reasonable doubt.
The Publisher responds within one month, which may be extended by two months for a complex request.
For a request concerning a Server's Messages, you may also contact its Administrator.
If you believe your rights are not being respected, you may lodge a complaint with the CNIL (cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).
10. Minors and changes to this policy
Minors. The Service is open to all ages. A minor may exercise their data rights alone; their legal guardian may also exercise them on their behalf, in particular to request deletion of their Account, at contact@xelyos.fr. No processing relies on consent, and no data is used for profiling or advertising.
Changes. This policy may be updated. Its date appears at the top of the document; in the event of a significant change, a notification is displayed at your next login.