Privacy Policy
Effective date: January 1, 2027 · Last updated: October 18, 2026 · Draft for attorney review
In short: this website uses no cookies and no third-party trackers. The Service processes your organization’s email to protect it, under a Business Associate Agreement or Data Processing and Safeguards Addendum. We do not sell personal information, do not use it for advertising, and do not use customer data to train AI models. Your data stays in the United States. You can access, correct, export and delete it.
1. Who we are
PacinfraX Corporation, 19900 MacArthur Boulevard, Suite 915, Irvine, California 92612, USA (“PacinfraX”, “we”) operates the PXCMail service and the website pxcmail.com. Privacy questions: [email protected].
2. Two roles: service provider and business
For the Service, our customers (medical practices, accounting firms, law firms, advisers and other organizations) decide what data to send through PXCMail and why. For that data we act as a service provider (California), processor (other state laws) and business associate (HIPAA). We process it only on the customer’s instructions under the Terms, the Business Associate Agreement or the Data Processing and Safeguards Addendum. If you are a patient or client of one of our customers and have questions about your information, please contact that organization; we will help them respond.
For this website, our marketing, our customer accounts and our business operations, we decide how data is used and act as a business or controller. Sections 3–9 describe that.
3. Information we collect
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Identifiers and contact details | Name, work email, phone, organization, job title, billing address | You (forms, signup, support) | Provide the Service, respond, bill, send service notices |
| Account and configuration data | Domains, Seats, policies, industry profile, named security officer, MFA enrollment status | You; your directory (Google/Microsoft) if you enable sync | Provide and secure the Service |
| Commercial information | Plan, invoices, payment status; payment credentials (card, Apple Pay, Google Pay, Link, ACH) are held by Stripe and PayPal account details by PayPal — not by us | You; Stripe; PayPal | Billing, accounting, tax |
| Service metadata | Sender and recipient addresses, timestamps, message size, detection verdicts, encryption outcome, device type, IP address of connections, audit events | Generated by the Service | Deliver, secure, audit and support the Service; required recordkeeping |
| Message content | Email bodies, attachments, calendar and contacts | Your organization and its correspondents | Processed automatically to deliver, scan, encrypt and archive; accessed by people only as described in the Terms §6.2 |
| Recipient data (encrypted delivery) | Email address or mobile number of a person who receives a secure message; one-time code events; time opened | Our customer; the recipient | Deliver the secure message and keep the audit record |
| Website usage | Pages viewed, referrer, country, browser type — aggregated, without cookies or persistent identifiers | Privacy-preserving analytics | Understand which pages are useful |
| Support and communications | Tickets, chat transcripts, call notes, call recordings (with notice) | You | Support and quality |
| Professional information (job applicants) | Résumé, work history, background-check results (with consent) | You; background-check provider | Recruiting; HIPAA workforce requirements |
We do not collect sensitive personal information about website visitors. Regulated Data processed in the Service is governed by Section 2. We do not knowingly collect information from anyone under 18; the Service is for organizations.
4. Cookies and tracking
pxcmail.com sets no cookies and loads no third-party advertising or analytics trackers. We measure traffic with self-hosted, cookie-less analytics that store no personal identifiers. Our advertising landing pages capture campaign parameters (for example utm_*, gclid, fbclid) only when you submit a form, so that we can attribute the request; we report conversions to advertising platforms server-side using hashed identifiers, not with pixels on the page. Because we do not use cookies or sell or share personal information, there is no cookie banner and no need to opt out of tracking on this site. We honor Global Privacy Control signals as an opt-out request where applicable.
5. How we share information
- Subprocessors and service providers who help us run the Service and the business, under contracts limiting their use of data: listed at Subprocessors (infrastructure, payments — Stripe for cards, Apple Pay, Google Pay, Link and ACH; PayPal, Inc. for PayPal — SMS delivery, e-signature, compliance automation, security testing). Business operations providers include accounting, legal, recruiting and background-check firms.
- Our customers: if you are a User, your organization’s administrators can see your account, configuration and audit records.
- Partners: if you came to us through an IT provider or referral partner, we share account status (not message content) with that partner to support you.
- Legal and safety: to comply with law, respond to lawful requests, enforce our agreements, or protect rights, safety and security. We notify customers of requests for their data unless legally prohibited, and we publish a transparency summary annually.
- Corporate transactions: with a successor in a merger, acquisition or sale, with notice.
We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months.
6. Retention
| Data | Retention |
|---|---|
| Message content and archives | As configured by the customer (default 1 year; up to 7 years on archive plans); deleted 30 days after termination unless under legal hold |
| Service metadata and audit records | 6 years (regulatory recordkeeping), with content scrubbed |
| Account and billing records | Duration of the relationship plus 7 years (tax and accounting) |
| Encrypted-delivery recipient data | Until the message expires (default 30 days) plus the audit record |
| Support tickets | 3 years |
| Website analytics | Aggregated; no personal data |
| Job applicant data | 2 years after the decision, or longer if required by law |
7. Security
Safeguards are described on the Security page: encryption in transit (TLS 1.2+) and at rest (AES-256, dedicated keys for Hosted and Pro customers), multi-factor authentication, least-privilege access with logging, US-only access to message content, continuous monitoring, independent penetration testing, backups and disaster recovery. No system is perfectly secure; if an incident affects your information we will notify you as the law and our agreements require.
8. Where data is stored
All Service data is stored and processed in Amazon Web Services regions in the United States. We do not transfer Service data outside the United States. Website and business data may be processed by providers in the United States.
9. Your rights
Everyone can ask us to access, correct, export or delete their personal information, and can object to or restrict certain processing, by emailing [email protected] or writing to the address in Section 1. Customers can do most of this directly in the console. We verify requests using the email address or account on file and respond within 45 days (extendable once by 45 days with notice). You may use an authorized agent with written permission. We will not discriminate against you for exercising your rights.
California residents (CCPA/CPRA). You have the rights to know the categories and specific pieces of personal information we collect, the sources, purposes and categories of recipients (described above); to delete; to correct; to opt out of sale or sharing (we do none); to limit use of sensitive personal information (we do not use it for inferences); and to non-discrimination. Our California notice at collection is Section 3. We do not respond to “Do Not Track” browser signals because there is no tracking to disable, but we treat Global Privacy Control as a valid opt-out. We do not use or disclose sensitive personal information for purposes other than providing the Service.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland and other states with comprehensive privacy laws have comparable rights, including to appeal a decision by replying to our response; we will explain the outcome of an appeal and how to contact your state attorney general.
Washington residents (My Health My Data Act) and Nevada residents. We do not collect consumer health data from website visitors. Health information processed in the Service on behalf of a covered entity or business associate is handled under HIPAA and our Business Associate Agreement.
Patients and clients of our customers. Your rights under HIPAA or other laws are exercised through the organization that treats or serves you. We assist that organization under our Business Associate Agreement.
10. Communications
We send service notices (security, billing, changes) to account owners; these cannot be opted out of while you have an account. Marketing email is sent only with consent and includes an unsubscribe link. Text messages are used only for one-time codes and, with consent, appointment reminders for calls; reply STOP to end.
11. Changes
We will post changes here with a new effective date and, for material changes, email account owners at least 30 days in advance.
12. Contact
PacinfraX Corporation · Attn: Privacy · 19900 MacArthur Boulevard, Suite 915, Irvine, CA 92612 · [email protected]. Security concerns: [email protected].