Chameleon SMTP: Terms of Service and Privacy Statement

Last updated: 23 September 2026

Chameleon SMTP is a WordPress plugin provided by Chameleon Web Services (“Chameleon”, “we”, “us”). It helps a website administrator send emails from their WordPress site using either configured SMTP credentials or a Microsoft 365 mailbox connected through Microsoft sign-in. This page explains the terms for using the plugin and how information is handled in connection with it.

Terms of Service

Who may connect a mailbox

You must have authority to administer the website and to connect the chosen sending mailbox. If the mailbox belongs to an organisation, its Microsoft 365 administrator may need to approve the Chameleon SMTP application. You are responsible for ensuring that emails sent by your site comply with applicable law and your organisation’s policies, and for maintaining your website and Microsoft 365 account security.

How the service works

In Microsoft 365 mode, you authorise the Chameleon SMTP application through Microsoft sign-in. The plugin uses delegated Microsoft Graph Mail.Send permission to submit emails as the connected account. The plugin requests offline access so it can renew its connection without requiring a sign-in for every email. In SMTP mode, the plugin uses the server and credentials you configure. Your website administrator can send a test email and view a local delivery log.

A “Sent” result means that the configured mail service accepted the request. It does not guarantee arrival in the recipient’s inbox. Delivery also depends on the mailbox, Microsoft or SMTP service, recipient systems, and the sending domain’s configuration, including SPF, DKIM and DMARC where applicable.

Your responsibilities

Keep WordPress, the plugin, your hosting environment and administrator accounts secure. Enter a sending address you are authorised to use, review the recipient data your website collects, and provide any notices and obtain any permissions needed for emails your website sends. If you stop using the plugin, disconnect the Microsoft account in the plugin and review its access in your organisation’s Microsoft Entra settings.

Availability and changes

The plugin depends on WordPress, your hosting environment and third-party email services. Features may need to change if those services change their requirements. Chameleon may update the plugin and these terms; the date above identifies this version of the page. Any separate support agreement between you and Chameleon continues to govern the support services covered by that agreement.

Contact

For questions about Chameleon SMTP or these terms, email support@chameleon.co.uk.

Privacy Statement

Scope and responsibility

This statement concerns the Chameleon SMTP plugin and Chameleon’s Microsoft application. The organisation operating a WordPress website decides why its site sends emails and which recipients it contacts. That organisation is responsible for its website’s own privacy notice and handling requests about emails it sends. Chameleon is responsible for personal information it handles directly when providing its own support and services.

Information handled by the plugin

• Connection and settings: the sending address and name, configured SMTP settings where used, and a Microsoft refresh token when a mailbox is connected. These are stored in the WordPress site’s database. Microsoft access tokens are stored temporarily on that site.
• Email delivery: the message, recipient addresses and any attachments provided by the website are sent to the configured SMTP server or to Microsoft Graph for delivery. This plugin does not store email bodies or attachments in its delivery log.
• Local delivery log: date and time, recipient address, subject, submission status and any error message. The plugin removes log entries older than seven days through WordPress’s scheduled tasks and also removes expired entries when adding new log entries. A delayed WordPress scheduled task can delay routine deletion until the site runs it.

These settings, tokens and logs are held on the client’s WordPress site and its hosting or backup systems. The plugin does not automatically send a list of connected websites or copies of its local delivery logs to Chameleon. Chameleon may see information a client chooses to provide for support, or may access a client site under a separate support arrangement.

Why this information is used

Connection data is used to authorise email delivery and keep the mailbox connection working. Email content and addresses are processed to send the messages requested by the website. The short-lived log helps site administrators test and diagnose delivery. Each website operator must identify and explain its own lawful basis for the emails it sends to recipients in its website privacy notice.

Chameleon support enquiries

If you contact Chameleon for help with the plugin, we use the contact details and information you provide to respond and deliver the requested support. Depending on our relationship with you, we do so to perform a contract or for our legitimate interest in responding to enquiries and maintaining our service. We retain support correspondence for as long as needed for those purposes and any applicable record-keeping obligations. Do not include passwords or Microsoft tokens in a support request.

Other providers and transfers

In Microsoft 365 mode, authentication and email submission are handled by Microsoft under the connected organisation’s Microsoft 365 arrangements. In SMTP mode, delivery is handled by the configured SMTP provider. The site’s hosting and backup providers may also hold its WordPress database. Their processing and any international transfers depend on the client’s chosen providers and contracts; consult those providers’ privacy information and the website operator’s own privacy notice.

Control and retention

A website administrator can disconnect Microsoft 365 through the plugin, which removes the locally stored refresh token. The organisation can also review or revoke the application’s access through Microsoft Entra. Disconnecting does not delete emails already sent or copies held in the mailbox, recipient systems, website backups or third-party systems. SMTP settings and local logs remain in the WordPress database unless the website operator removes them; the log’s routine retention is seven days as described above.

Your rights and questions

For a request concerning an email sent by a client website, contact the organisation operating that website first. For information Chameleon holds directly in providing support or its own services, contact support@chameleon.co.uk. Where applicable, you may have rights to access, correct or erase personal data, object to or restrict its use, and complain to the UK Information Commissioner’s Office at ico.org.uk. The availability of particular rights depends on the circumstances and applicable law.