Home · Pricing · Help · Terms · Privacy · Cookies · Acceptable use · Sign in
Privacy Policy
What Viaowl collects, why, and for how long. Scam checks run on our own servers in Norway, nothing is sold or shared for ads, and trackers are stripped.
Who we are and how to reach us
This Privacy Policy explains how Viaowl AS (“Viaowl”, “we”, “us” or “our”) processes personal data when you use the Viaowl email service, our applications and the viaowl.com website (together, the “Service”). Viaowl AS is a Norwegian private limited company with organisation number 923 456 789 and its registered address at Karl Johans gate 22, 0159 Oslo, Norway.
For accounts held by individuals, Viaowl AS is the controller of personal data within the meaning of the EU General Data Protection Regulation (“GDPR”), as incorporated into Norwegian law by the Personal Data Act (personopplysningsloven), and of the UK GDPR. On Parliament plans, where an organisation provides accounts to its members, the organisation is the controller of the mailbox data of those members, and we process that data as its processor under a data processing agreement. In that case, members should direct requests about their mailbox data to their organisation first.
You can reach our privacy team at privacy@viaowl.com and our Data Protection Officer at dpo@viaowl.com, or by post at the address above, marked for the attention of the Data Protection Officer.
What we collect
We process the following categories of personal data: (a) account data: your @viaowl.com address, display name, recovery address if you add one, password in hashed form, owl phrase, second-factor settings and plan; (b) mailbox content: the messages, attachments, contacts, folders and filters you send, receive, import or store, including personal data about the people you correspond with; (c) settings: quiet hours, notification preferences, trusted devices and other choices you make; (d) billing data: your name, country, billing address details required for tax purposes, plan and payment history, together with the card type, last four digits and expiry date provided by our payment processor; (e) support data: the content of messages you send to our support team; (f) technical data: IP addresses, device and browser type, sign-in times and security events recorded in our server logs; and (g) scam reports: the sender address and scam pattern of messages you report.
For Parliament plans, we also process the organisation’s name, its administrators’ details, its member list, its custom domains and its single sign-on configuration.
When you import mail from Gmail, Outlook or iCloud, we process the authorisation you give and the mail you choose to import, only for the purpose of copying it into your mailbox.
What we do not collect
We do not show advertising, and we never use your mail for advertising or to train models. We do not build profiles of you for marketing and we do not sell or share personal information.
We do not use analytics, advertising or social media trackers in the Service or on viaowl.com, and the viaowl.com marketing site sets no cookies at all. We do not use device fingerprinting. We do not collect your precise location; the only location information we hold is what can be inferred from the IP addresses in our server logs, which we use for security.
Our staff do not read your mail. Access to mailbox content by our staff takes place only with your explicit permission, where strictly necessary to investigate a serious security incident or a report of abuse, or where Norwegian law requires it, and every such access is limited, logged and reviewed.
How scam checks work
The night watch automatically checks each incoming message for signs of fraud: sender addresses that imitate trusted names, false urgency, links whose real destination differs from what they display, and patterns associated with known scams. All of this happens on Viaowl’s own servers in Norway. Your mail is never sent to any third party for scanning.
Messages that appear suspicious are placed in the owl’s nest, where they stay for 30 days unless you release them with one tap. The result of each check is stored with the message as a label, so that we can explain to you why a message was held. Link x-ray works in the same way, on our own servers, to show you where a link actually leads. Tracker blocking also runs on our servers, as described in Section 7.
Scam checks are automated, but they do not produce decisions with legal or similarly significant effects on you within the meaning of Article 22 GDPR: they only decide whether a message is shown in your inbox or held in the owl’s nest, and you can always review and release held messages yourself.
Legal bases for processing
We process personal data on the following legal bases under Article 6(1) GDPR and the UK GDPR: (a) performance of our contract with you (Article 6(1)(b)): to create and run your account, deliver and store your mail, run the night watch, the owl’s nest, link x-ray, quiet hours and tracker blocking, import mail at your request, process payments and provide support; (b) our legitimate interests (Article 6(1)(f)): to keep the Service and its users secure, to detect and prevent spam, fraud and abuse, to keep server logs, to share scam reports between users’ filters and to establish or defend legal claims; (c) compliance with legal obligations (Article 6(1)(c)): to keep billing records under the Norwegian Bookkeeping Act and to respond to binding legal orders; and (d) your consent (Article 6(1)(a)): for example, where you allow a member of our support team to view a specific message in order to help you.
The mail you receive contains personal data about its senders. We process that data to deliver mail to you under our contract with you and, for scam checks, on the basis of our and our users’ legitimate interest in protection against fraud, which we consider is not overridden by the interests of senders, since the checks are automated, confined to our own servers and used only for protection.
Where we rely on legitimate interests, you have the right to object, as described in Section 12. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
Scam reports
When you report a message as a scam, only two pieces of information are shared with other users’ filters: the sender address and the scam pattern that was identified. The content of the message, your identity, your address and the other recipients are never shared.
On Parliament plans, group scam alerts let members of the same organisation warn one another about a scam. These alerts are visible only within that organisation and contain the sender address, the scam pattern and a short description, but not the content of the reported message.
Sender addresses in scam reports may be personal data of the sender. If you believe your address has been reported in error, you can ask us to review it at privacy@viaowl.com, and we will remove it from the shared filters if the report was mistaken.
Trackers and tracker blocking
Many commercial emails contain spy pixels and tracking parameters that tell the sender when, where and on which device a message was opened or a link was clicked. Our tracker blocking removes known spy pixels and strips tracking parameters from links on our servers before the message reaches you.
We do not keep a record of which trackers were removed from which messages beyond what is needed to show you, within the message, that trackers were blocked.
We do not use trackers of our own. Account notices we send you contain no spy pixels and no tracking parameters.
Processors and sharing
We use a small number of processors, each bound by a data processing agreement under Article 28 GDPR, which permits them to process personal data only on our instructions: (a) colocation data centres in Norway, where our own hardware is housed and which provide space, power, cooling and physical security but have no access to data on our encrypted systems; (b) Stripe, our payment processor, which processes billing and card details; (c) a transactional email provider, which delivers account notices such as security alerts and receipts to your recovery address and receives only the recipient address and the notice itself, never your mailbox content; and (d) a support desk provider, which stores the messages you send to our support team. A current list of our processors is available from privacy@viaowl.com.
We may disclose personal data where required by Norwegian law or a binding order of a Norwegian court or authority, as described in Section 15, or where necessary to establish, exercise or defend legal claims. On Parliament plans, the organisation’s administrators can see and manage the accounts of their members, as set out in the organisation’s own policies.
If Viaowl is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, which will remain bound by this Privacy Policy. We will notify you in advance of any such transfer.
We do not sell personal information, we do not share it for cross-context behavioural advertising and we do not disclose it to advertisers or data brokers.
International transfers
Your mailbox, your mail and all scam checks remain on our own servers in Norway, which is part of the EEA. The GDPR applies in Norway in the same way as in the European Union, and the United Kingdom recognises the EEA as providing adequate protection for personal data.
Some of our processors, such as our payment processor, may process limited data, such as billing details or support messages, outside the EEA. Where they do, we ensure that the transfer is protected by an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it, or by the Standard Contractual Clauses adopted by the European Commission, together with any additional safeguards required. You can request a copy of the relevant safeguards from privacy@viaowl.com.
How long we keep data
We keep personal data for the following periods: (a) mail you delete: purged 30 days after you empty the trash; (b) messages held in the owl’s nest: 30 days, unless you release them; (c) backups: rotated and overwritten within 35 days; (d) server logs: 30 days; (e) billing records: five years, as required by the Norwegian Bookkeeping Act (bokføringsloven); (f) closed accounts: deleted within 30 days of closure; (g) support conversations: for as long as your account is open, and deleted with your account; (h) scam reports: the sender address and scam pattern are kept in the shared filters for as long as they remain useful for protection, and are removed if a report proves mistaken.
Where we must keep data longer to comply with a legal obligation or to establish, exercise or defend a legal claim, we keep only the data required, for only as long as required.
Security
Mailboxes are encrypted at rest, with the encryption keys held in a separate vault. Data is encrypted in transit using TLS. Our servers are our own hardware, housed in access-controlled data centres in Norway.
Access to production systems is limited to a small number of staff who need it for their work, protected by strong authentication, logged and reviewed. All staff are bound by confidentiality obligations. We test our systems regularly and fix weaknesses promptly. Features such as second factors and the owl phrase help you to protect your account against theft and phishing.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours of becoming aware of it and, where the risk is high, we will inform you without undue delay.
Your rights in the EEA and the United Kingdom
Under the GDPR and the UK GDPR, you have the right to: (a) access the personal data we hold about you and receive a copy; (b) have inaccurate data corrected; (c) have your data erased; (d) restrict our processing of your data; (e) receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller; (f) object to processing based on our legitimate interests; and (g) withdraw your consent at any time where we rely on it.
Many of these rights can be exercised directly in the Service, for example by exporting your mail, correcting your details or closing your account. For anything else, contact privacy@viaowl.com or dpo@viaowl.com. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you why. We may need to confirm your identity before acting on a request.
You have the right to lodge a complaint with a supervisory authority. In Norway, this is Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no). You may also complain to the authority in the EEA country where you live or work, or, in the United Kingdom, to the Information Commissioner’s Office (ico.org.uk).
Your rights in the United States
If you live in California, the CCPA/CPRA gives you the right to: (a) know the categories and specific pieces of personal information we collect, use and disclose; (b) delete personal information; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information; (e) limit the use of sensitive personal information; and (f) not be discriminated against for exercising these rights. Residents of other US states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Texas and Oregon, have similar rights, including the right to appeal a decision we make about their request.
In the past twelve months we have collected the following categories of personal information: identifiers, such as your email address and IP address; commercial information, such as your plan and payment history; internet or other electronic network activity, such as sign-in times and security events; and the content of your communications, including account credentials, which the CCPA treats as sensitive personal information. We collect these categories from you and from the people who send you mail, use them only for the purposes described in this Privacy Policy and disclose them only to the processors described in Section 8.
We do not sell or share personal information, as those terms are defined in the CCPA/CPRA, and we have not done so in the past twelve months. We use sensitive personal information only for purposes permitted by the CCPA/CPRA, such as providing the Service and keeping it secure. To exercise your rights, contact privacy@viaowl.com. You may use an authorised agent, in which case we may ask for proof of the agent’s authority. We will respond within 45 days, and if we decline your request, you may appeal by replying to our decision.
Children
The Service is not directed at children under 13, and you must be at least 13 to create an account. Where the law of your country sets a higher age for consenting to the processing of personal data, such as 16 in some countries of the EEA, you must meet that age or have the consent of a parent or guardian where the law permits it.
We do not knowingly collect personal data from children below these ages. If we learn that we have done so, we will close the account and delete the data. If you believe a child has created an account, please contact privacy@viaowl.com.
Law-enforcement requests and transparency
We disclose user data to authorities only when we are legally required to do so under Norwegian law, on the basis of a valid order from a Norwegian court or competent authority. Requests from authorities outside Norway must be made through the applicable international legal assistance procedures, and are then assessed under Norwegian law.
We review every request carefully, challenge requests that are unlawful or too broad, and disclose only the minimum data required. Because mailboxes are encrypted at rest and access to them is logged, any access to mailbox content under a legal order is recorded. We notify affected users of a request before disclosing their data, unless we are prohibited from doing so by law or by the order, in which case we notify them once the prohibition ends.
We publish a transparency report at viaowl.com at least once a year, stating the number and type of requests we have received and how we responded.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date at the top shows when it was last updated.
If we make a material change, we will notify you by email and in the Service at least 30 days before it takes effect. We will not use personal data already collected for a new purpose that is incompatible with the purposes described here without a lawful basis and, where required, your consent.
Contact and complaints
Viaowl AS, Karl Johans gate 22, 0159 Oslo, Norway, organisation number 923 456 789. Privacy questions and requests: privacy@viaowl.com. Data Protection Officer: dpo@viaowl.com. General support: help@viaowl.com.
If you are not satisfied with our response, you may complain to Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no, to the supervisory authority in the EEA country where you live or work, or, in the United Kingdom, to the Information Commissioner’s Office at ico.org.uk. We would, however, appreciate the chance to address your concern first.