Legal
Privacy policy
Last updated 10 August 2026
Ulaach operates mail, DNS and server infrastructure on behalf of a small number of companies in Mongolia. This page explains what personal data passes through that infrastructure, why we hold it, and what we do with it.
Who is responsible
For the services we run under our own name, Ulaach is the data controller. Where we host mail or servers for a client company, that company is the controller of its own correspondence and we act as its processor — we operate the systems, they decide what is sent and to whom.
What we handle
- Mailbox content. Messages sent and received by the mailboxes we host, stored on our servers so that the account holder can read them.
- Mail metadata. Sender and recipient addresses, timestamps, message size, delivery status and authentication results, recorded in our mail server logs.
- Access records. IP addresses and login times for mailbox and control panel access, used to detect compromised accounts.
- Contact details. The name, email address and phone number of the people who administer a client account.
Why we handle it
To deliver mail, to keep the service running, and to protect it. Log data in particular exists so that we can answer three questions: did this message arrive, why did it not, and is this account behaving the way its owner would expect.
How long we keep it
- Mailbox content stays until the account holder deletes it or the account is closed.
- Server and mail logs are kept for a limited operational window — long enough to investigate a delivery problem or a security incident — and then rotated out.
- Backups are retained on a rolling schedule and overwritten as newer backups are taken.
Who else sees it
We do not sell personal data and we do not share it for advertising. Data reaches third parties only where the service requires it:
- Outbound mail providers. Messages leaving our servers are handed to a third-party sending service so that they reach the recipient's mail provider.
- Infrastructure providers. Our servers run in commercial data centres, which means the data is physically stored on hardware they operate.
- Legal requests. Where we are required by applicable law to disclose information.
These providers may process data outside Mongolia, including in Japan, Europe and the United States.
Email we send
The mail leaving our infrastructure is business correspondence and system notification — invoices, service notices, replies to customers. We do not send marketing campaigns and we do not send to addresses that were bought, rented or scraped.
Security
Mail is carried over encrypted connections. Mailbox access requires authentication, and every account has an hourly sending limit so that a stolen password cannot be turned into a mass send. Repeated failed logins are blocked automatically, and accounts showing unusual behaviour are suspended while we investigate.
Cookies
This website does not set tracking cookies and carries no advertising or analytics trackers. The webmail and control panel interfaces we host use session cookies purely to keep a signed-in user signed in.
Your choices
You can ask us what personal data we hold about you, ask for it to be corrected, or ask for it to be deleted. If the data belongs to a mailbox we host for a client company, we will pass your request to that company, since the correspondence is theirs.
Write to info@ulaach.net and we will respond.
Changes
If this policy changes we will update the date at the top of this page.
Contact
- General — info@ulaach.net
- Abuse — abuse@ulaach.net
- Postmaster — postmaster@ulaach.net
- Ulaanbaatar, Mongolia