Last updated 17 September 2026. Data controller: Interop Solutions Ltd, United Kingdom. Contact: hello@smtp-365.com.
SMTP-365 is installed on your own server or virtual machine. Emails, scans and attachments pass from your devices through your SMTP-365 installation directly to your Microsoft 365 tenant using Microsoft's Graph API. Interop Solutions Ltd never receives, stores or has access to that content. Message metadata (sender, recipients, subject, sizes, outcome) is logged locally on your installation and nowhere else.
Apart from these, the only outbound connections the product makes are to Microsoft 365 (login.microsoftonline.com and graph.microsoft.com). The appliance does not fetch operating-system updates by itself, and Debian's own automatic updates are not installed; if you add them, SMTP-365 does not manage them. When your administrator asks for operating-system updates on the Software update page (from version 0.3.8), the appliance contacts the Debian mirrors (deb.debian.org and security.debian.org); those requests carry no information about your organisation beyond the appliance's IP address and the package names being fetched.
We do not collect usage analytics or telemetry from the product.
This site sets no cookies unless you accept analytics in the banner. If you accept, Google Analytics 4 (Google Ireland Ltd) records which pages are visited, with IP addresses anonymised; Google receives that data under its own privacy policy. If you decline, or before you choose, no analytics runs and no cookie is set; your choice is remembered in your browser. Change your choice. There are no advertising trackers. Fonts are served from this site. The checkout is provided by Paddle.com Market Ltd as merchant of record. Nothing is loaded from Paddle while you browse: only when you press a Buy or Renew button does Paddle's script load from Paddle's servers, and Paddle then processes your payment details under its own privacy policy. If a challenge to keep automated submissions out is switched on for the partner application form, the partners page also loads the Cloudflare Turnstile script from Cloudflare's servers, and Cloudflare receives your IP address and browser details to decide whether to show a challenge; when it is not switched on, nothing is loaded from Cloudflare. Our web hosting (Microsoft Azure, UK region) keeps standard server logs, including IP addresses, for security and troubleshooting, retained for up to 90 days.
When you buy a licence or contact support we hold your name, company, email address and correspondence to fulfil the order, deliver the key, provide support and meet our accounting obligations. We keep licence records for as long as the licence may be used, and accounting records for the period required by UK law.
The partner application form collects what you type into it: company, your name, email address, telephone number, website, country, the kind and size of your business and your message, together with the time and the IP address the application came from. We use it to assess the application, to reply to you and to set up the partnership, on the basis of your consent when you submit the form, and we use the email and IP address to limit repeated or automated submissions. The application is stored on our licence server (Microsoft Azure, UK region) and emailed to our sales mailbox; you receive an acknowledgement by email that carries your first name and nothing else you typed. It is seen only by Interop Solutions staff who handle partner enquiries, and it is not shared with anyone else. There is no automatic deletion: we keep an application while we are considering it and, if you become a partner, for as long as the partnership lasts, and we delete it sooner if you ask.
Under UK GDPR you can ask us to access, correct or delete personal data we hold about you, or to restrict or object to its processing. Email hello@smtp-365.com. You may also complain to the Information Commissioner's Office.
We do not sell personal data. We use Microsoft Azure to host the licence server and this website, and email providers to correspond with you. We disclose data only where the law requires it.