Archived snapshot: Tuta · Is It Training on Me?

← Tuta · Privacy Policy

This is an extract from an archived copy, fetched 5 August 2026. Tuta didn't author this page for us. It's a snapshot we captured from https://tuta.com/privacy-policy. We hold the whole page and publish this part of it: the sentence a verdict rests on, with the text either side, so you can see it hasn't been lifted out of an exception.

SHA-256
08E09E7F…892C

The passage, in context

Paragraph 38 of 79

credit card data,

PayPal user name.

This inventory data is processed for the performance of the contract with the customer according to Art. 6 para. 1 p. 1 lit. b) GDPR. For the execution of direct debiting we will share your banking details with the authorized credit institution. For the execution of payments via PayPal or credit card we will share your payment data with PayPal (Europe).

Tuta provides services for saving, editing, presentation and electronic transmission of data, such as email service, contact management and data storage. This data is processed for the performance of the contract with the customer according to Art. 6 para. 1 p. 1 lit. b) GDPR. All user data is encrypted in a way that it is only accessible for the user and their communication partners. Tutao GmbH has no access to the unencrypted data. This data can be deleted by the user.

If unencrypted emails are sent or received by Tuta servers, they are encrypted for the user before they are stored.

In order to maintain email server operations, for error diagnosis and for prevention of abuse, mail server logs are stored max. 7 days. These logs contain sender and recipient email addresses and time of connection but no customer IP addresses. Storage takes place for the performance of the contract with the customer according to Art. 6 para. 1 p. 1 lit. b) GDPR.

In order to prevent abuse that could jeopardize the continued operation of the service usage data like IP addresses, device types and geolocation of IP addresses are processed and stored. IP addresses are only stored anonymized. This processing takes place for the performance of the contract with the customer according to Art. 6 para. 1 p. 1 lit. b) GDPR.

Checking the rest of it

The complete page is kept here and isn't republished. It's Tuta's copyrighted document, and an extract is what a reader needs to check a quotation. The SHA-256 above is of that whole snapshot: fetch the page yourself, hash it, and you can tell whether ours has been altered without having to trust us.

If you work for Tuta, or you are researching this and need the full capture, ask us for it and we will send it. If you believe a quote here is wrong or out of date, send us the paragraph. The correction gets published beside the clause.