This is a placeholder template, not legal advice. Have an actual lawyer review this against whatever privacy law actually applies to your users (GDPR, CCPA, etc.) before you take real signups.
Your login email, a bcrypt hash of your password (never the password itself), your real inbox address (where forwarded mail is delivered), a per-account master seed used to generate your aliases, and the list of aliases you've generated (their addresses and any label you gave them — not which specific message went where).
[Be direct here: unlike a fully self-hosted setup, a shared relay serving multiple accounts has to be able to compute/verify aliases server-side to know where to forward mail. State plainly that this means the operator can, in principle, see the mapping between your aliases and your real inbox — the same trust model as any hosted alias provider.]
[E.g.: we don't read message content, we don't sell data to third parties, we don't share your real inbox address with the services you use aliases for. Adjust to match what's actually true of your deployment.]
Pesapal, via the shared payments-service (billing), your configured upstream SMTP provider (mail delivery), and — if you've enabled it — Sentry (error monitoring). [List whichever you've actually turned on.]
[State how long data is kept after account closure, and how a user can request deletion.]
[Privacy contact address.]