Privacy notice for Lumitra Mail
Last changed on 2026-10-28.
Lumitra Mail sends email for the organisations that use it. This notice says what the service processes, in which role, where, for how long, and what you can do about it. It covers mail.lumitra.co, app.mail.lumitra.co and every email sent through the service. The general notice at lumitra.co/datenschutz covers the website; this one covers the product.
Who is responsible
The organisation that set up a workspace and sends you email (the operator) decides why and how your data is processed and is the controller. Lumitra processes that data on the operator's behalf, as a processor, under a processing agreement with the operator.
Questions about an email you received go to its sender first: the operator's name and address stand in every email and on its unsubscribe page.
Lumitra Mail is run by Marlin Jai Pohl, Grumbkowstr. 6, 13156 Berlin, Germany. For the data the service processes for its own purposes (operator accounts, billing, the logs named below), he is the controller.
What is processed for recipients
Your email address, your name and the properties the operator recorded about you (for example a language or a customer number), the topics you are subscribed to, whether and why email to you is blocked (an unsubscribe, a bounce, a complaint), the emails sent to you as they were sent, and the message id the delivering mail server assigned.
Opening and click tracking is off unless the operator turns it on for their workspace. When it is on, an open or a click of a link in an email is recorded against your address.
What is processed for operators
The account you sign in with at auth.lumitra.co (email address, name, company), the workspace's settings, the people you invite, the API keys you create, and an audit log of what was changed and by whom.
For a paid plan: the plan, its period and add-ons, which version of the terms of service and processing agreement was accepted, when and by whom, and the billing details you enter at checkout (name, billing address, payment method, invoices). Payment is handled by Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. in the United States as its processor; Lumitra Mail keeps only Stripe's customer and subscription identifiers, never card numbers. Lumitra is the controller of this data and keeps invoices for as long as tax law requires.
For a domain bought in Lumitra Mail: the holder details you enter (name, organisation, email address, phone number, postal address), which Lumitra passes to its registrar, Cloudflare, Inc. (United States), and through it to the registry of the domain's ending, because a domain can only be registered with its holder. Public WHOIS data is redacted where the registry allows it. Lumitra keeps the holder details with the order while the workspace exists.
Where
The service, its database and the archive of sent mail run on servers of Hetzner Online GmbH in Germany. Images that operators upload for their emails are stored through Storage Brain, which runs on Cloudflare Workers and keeps them on Cloudflare R2.
Emails leave through the mail provider the operator connected (their own mail server, or Resend), which receives your address and the message in order to deliver it.
When the operator sends through Lumitra Mail from its own domain, Lumitra engages Resend, Inc., a company in the United States, as a processor for delivery; mail is sent from Resend's EU region in Ireland. Resend receives your address and the message only to deliver it. Contacts and the archive of sent mail stay on the servers in Germany.
How long
The operator keeps sent mail and subscription data as long as their workspace exists and they have not deleted them. Blocks stay until the operator removes them, so that an unsubscribe is honoured.
When an operator erases a contact, the contact, the recipient records and the archived emails for that person are deleted; a block on the address stays, so that the erased person is not mailed again. When an operator's company is deleted at Lumitra, every workspace of that company is erased with it.
Your rights
Under the General Data Protection Regulation (GDPR) you can ask the controller for access, rectification, erasure, restriction and portability, and object to processing. For an email you received, that is the operator named in the email. Where Lumitra itself is the controller (your operator account, this website), write to the address in the imprint.
You can complain to a data protection authority; for Lumitra that is the Berlin Commissioner for Data Protection and Freedom of Information.
Cookies and scripts
The hosted pages for recipients (unsubscribe, preferences, sign-up forms) run no scripts and set no cookies. The dashboard for operators sets a session cookie for the signed-in account and nothing else.
Changes
This notice changes when the service does; the date at the top says when it last did.