Privacy

Privacy at GKD Mail

What the service collects, why, and who else is involved.

Draft of 30 October 2026

Your account

  • Company name, your name, email address and language.
  • Your password, stored only as a one-way hash.
  • Two-factor secret (encrypted), recovery codes (hashed) and the public keys of your passkeys.
  • Your active sessions, which you can sign out from the Security page.

Billing

  • Invoices, receipts and the billing address and phone number you enter when paying.
  • Card payments happen on SADAD's payment page. Card details are entered there and never reach GKD.
  • Bank transfers are confirmed by the GKD team against the invoice.

Your mail

  • Messages are stored on GKD's mail server so your team can read them over webmail, IMAP and SMTP.
  • When you import from another provider, the old and new passwords are stored encrypted only until the import ends, then deleted. They are never shown or logged.
  • The audit trail records actions (who did what and when, with the IP address), not message content.

Services we rely on

  • Cloudflare: DNS and the network in front of the website and dashboard, and the Turnstile check on the sign-up page.
  • SADAD: card payments.
  • If you choose automatic DNS setup, your Cloudflare token is kept encrypted until the records are added, then wiped.

Cookies

  • This website sets one cookie, gkd_site_lang, to remember your language. There are no analytics or advertising cookies.
  • The dashboard uses a session cookie, gkd_session, to keep you signed in. It cannot be read by scripts on the page.

Emails we send

  • Account emails from [email protected]: email confirmation, password reset, invoices and receipts.

Deleting data

  • Company owners can delete mailboxes and domains from the dashboard. Deletion is permanent: the mailbox and every message in it are removed.