Privacy Policy — Thundermail

Effective date: February 10, 2026
Welcome to the MZLA Privacy Statement, which applies to all MZLA websites and online services, including Thunderbird Pro Services. This is where we describe how we handle your “Personal Data,” which is information that is directly linked or can be linked to you. It applies to the Personal Data that MZLA Technologies Corporation and its affiliates (Mozilla Foundation and Mozilla Corporation) process as the “Data Controller” when you use our online services, interact with MZLA’s websites, or participate in events or activities such as user surveys and focus groups (collectively, the “Services”).
Depending on how you use the Services, we may collect Personal Data from you directly, automatically from your device, and/or from third parties. The Personal Data MZLA processes when you use the Services depends on variables like how you interact with our Services (such as through web interfaces, desktop or mobile applications), the Services you use (such as Thundermail, Send, or Appointment), and the features of each Service that you use. Below, we describe the categories of information we may collect through these channels depending upon how you use them:
The Personal Data we process depends on your interaction and access methods with our Services, including the interfaces (web, desktop, mobile apps), services used (e.g. Thundermail, Send, and Appointment), and the features of each service that you choose to use. This section details all the potential ways MZLA may process your Personal Data.
When carrying out these activities, MZLA practices data minimization and uses the minimum amount of Personal Information required.
We may share Personal Data with the following recipients:
You control the access to any private information associated with your Thunderbird account, such as emails. MZLA personnel does not access private information without your consent except as provided in this Privacy Statement and for:
Files shared using Send are end-to-end encrypted with keys accessible only to the account owner. MZLA cannot access the contents of a Send file unless you (or someone with whom you have shared the file) provides the key to us.
MZLA processes Personal Data in compliance with the GDPR, ensuring a lawful basis for each processing activity. The basis varies depending on the data type and the context, including how you access the services. Our processing activities typically fall under these lawful bases:
Depending on where you reside, you may have specific legal rights regarding your Personal Data:
To exercise these rights, please submit a request here. To verify your identity for security, we may request extra information before addressing your data-related request. Please contact us with any feedback or concerns. Depending on your region, you have the right to complain to your local Data Protection Authority. European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner’s Office website.
We aim to promptly respond to requests in compliance with legal requirements. Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims.
MZLA stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where MZLA, its affiliates, subsidiaries, or subprocessors have operations. We transfer Personal Data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help protect your rights and enable these protections to travel with your data. To learn more about the European Commission’s decisions on the adequacy of the protection of personal data in the countries where MZLA processes personal data, see this article on the European Commission website.
MZLA uses appropriate administrative, technical, and physical security controls to protect your Personal Data. We’ll retain Personal Data associated with your Thunderbird account as long as your account is active and as needed to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The retention duration depends on the purpose of data collection and any legal obligations.
MZLA uses administrative, technical, and physical security controls where appropriate to protect your Personal Data.
Contact us via our contact form or by mail to:
MZLA Technologies Corporation Attn: Mozilla - Privacy 447 Sutter Street, Suite 405 San Francisco, CA 94108 USA
If you’re in the UK or EEA, you can also contact our Data Protection Officer at [email protected], or by mail at:
Bird & Bird DPO Services SRL Avenue Louise 235 b 1 1050 Brussels Belgium
Please specify in your message that your request or inquiry relates to Thunderbird.
Our Services are not intended for individuals under the age of 13. We do not intentionally gather Personal Data from such individuals. If you become aware that a minor has provided us with Personal Data, please notify us.
MZLA may periodically revise this Privacy Statement. If there are material changes to the statement, we will provide at least 30 days prior notice by updating our website or sending an email to your primary email address associated with your Thunderbird account.
MZLA uses cookies to provide, secure and improve our Services or to develop new features and functionality of our Service. For example, we use them to (i) keep you logged in, (ii) remember your preferences, (iii) identify your device for security and fraud purposes, including as needed to maintain the integrity of our Service, (iv) compile statistical reports, and (v) provide information and insight fo