Privacy Policy
Last updated: August 12, 2026
Introduction
Apifon S.A. ("Apifon", "we", "us") operates a messaging automation platform enabling businesses to communicate with customers through SMS, Viber, Email, and chat applications. We emphasize data protection, maintaining servers within the European Union and implementing a comprehensive Data Protection Program.
This Privacy Policy describes how we collect, use, and share your personal information when you use our services, visit our websites, or interact with us.
Controller and Processor Roles
Apifon functions as either a Controller (determining purposes and means of data processing) or Processor (handling data per Controller instructions) depending on the business relationship. When you use wemail to send emails to your customers, we act as a Processor on your behalf.
Data We Collect
Personal information is collected when you:
- Browse our website via cookies and tracking technologies
- Contact our sales or support teams
- Request newsletters or product information
- Create an account and use our services
- Purchase credits or subscribe to plans
- Send email campaigns or transactional messages
Collected data may include: name, contact details, account credentials, financial data, usage data, and location data.
How We Use Your Data
Data processing supports: relationship management, marketing communications per user preferences, service provision, inquiry responses, product improvement, fraud detection and prevention, and core business operations.
Cookies & Similar Technologies
We keep tracking to a minimum. Non-essential cookies are off by default and are only set after you consent via the cookie banner. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer — withdrawing is as easy as consenting. If you reject, no analytics scripts are loaded and no analytics cookies are set. Your consent choice expires after 12 months, after which we ask again.
| Cookie | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| _ga, _ga_* | Google Analytics 4 | Analytics (consent required) | Distinguishes visitors to measure aggregate site usage. Loaded only after you accept analytics cookies; rejecting means these are never set. | Up to 13 months |
| apifon_ref | wemail (first-party) | Referral attribution | Set only when you follow a referral link, so the referrer can be credited if you sign up. HttpOnly; not used for cross-site tracking. | 90 days |
| wm_attr | wemail (first-party, .wemail.io) | Marketing attribution (consent required) | Remembers the campaign that first brought you to wemail (e.g. a newsletter or ad link, and its click identifier) so it can be credited if you sign up later. Written only after you accept analytics or marketing cookies; declining removes it. | 90 days |
| wemail_cookie_consent | wemail (first-party, local storage) | Strictly necessary | Records your cookie-consent choice so we do not ask on every visit and can honor it on every page load. | 12 months |
We also use browser local storage (not cookies) for strictly necessary and functional purposes: keeping you signed in, remembering your theme, language, and timezone preferences, remembering dismissed notices, and storing your cookie-consent choice itself. This storage is not used for tracking and is not shared with third parties. It persists until you sign out or clear your browser data.
Signing in with Google or Microsoft
wemail offers "Sign in with Google" and "Sign in with Microsoft" as authentication options. If you choose one, the provider shares with us a limited set of profile information — your name, email address, profile picture, and a unique account identifier — which we use solely to create and secure your wemail account and to sign you in. We do not use this information for advertising, do not sell it, and do not share it with third parties except as described in this policy or as required by law.
wemail's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Microsoft is handled in accordance with this policy.
You can revoke wemail's access at any time from your Google Account's "Third-party apps & services" settings or your Microsoft account's "Apps and services that can access your data" settings.
Automatic DNS setup with Entri
If you choose automatic domain setup, wemail opens Entri's secure DNS-configuration flow. Entri independently identifies your DNS provider and, if you choose to continue, handles the provider sign-in and creates or updates the DNS records needed to configure your sending domain.
wemail does not receive, store, or have access to your DNS-provider password. We provide Entri with only the domain and DNS records required for the setup. Entri processes information under its own Privacy Policy. You can instead choose manual setup and publish the records directly with your DNS provider.
Data Sharing
Apifon shares information with: telecom operators for message routing, third-party service providers (hosting, support, CRM), Apifon international branches, and law enforcement when legally required. We do not sell your personal data.
Data Retention
Data retention follows your plan: message history, delivery events and activity logs are kept for 30 days on the Free plan and 12 months on paid plans, after which they are automatically deleted. Suppression and unsubscribe records are kept for as long as needed to keep honoring them. Account data is retained for the duration of the contract plus any legally mandated retention period, and nothing is kept longer than applicable law permits or requires.
Document Verification Service
When you use our public Proof-of-Sending verification page to check a document, the file itself never leaves your device — only its SHA-256 fingerprint, and for a sealed document its embedded electronic seal (signature and public certificates, no email content), are transmitted to us. For fraud prevention and to maintain an audit trail of verifications, we record each check together with its outcome, the date and time, the originating IP address, and the browser user-agent. If you request a downloadable verification receipt, the name or email you optionally enter is recorded and printed on that receipt. These verification-audit records are retained for up to 12 months and then automatically deleted.
To support Proof of Sending, when an email is handed to the recipient's mail server we record a fingerprint of the exact message sent and the recipient server's reply. These send-time evidence records do not contain email addresses in readable form — recipients are stored only as one-way SHA-256 hashes, and addresses quoted in a server reply are masked. They are fixed with an independent timestamp and kept for up to 400 days (the longest period for which a certificate can be issued for a message), then automatically deleted. A certificate that has been issued keeps its own copy of the evidence for the retention period of that certificate.
Your Rights
Under GDPR, you have the right to: access your personal data, rectify inaccurate data, request erasure ("right to be forgotten"), restrict processing, object to processing, and request data portability. Complaints can be filed with the Hellenic Data Protection Authority or your local supervisory authority.
Security
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS 1.3), encryption at rest, access controls, and regular security reviews. Our platform runs on cloud infrastructure that is independently SOC 2 Type II audited (AWS, Microsoft Azure), and our own controls are aligned with the SOC 2 Trust Services Criteria.
Contact
Data Protection Officer: dpo@wemail.io
Apifon S.A., 27 Georgikis Scholis str., 57001 Thessaloniki, Greece
Phone: +30 2316018500
