Privacy Policy

1. Information We Collect

• Account data: name, email address, company name, login credentials (stored hashed), and session tokens.
• Billing data: subscription status, invoices, and payment metadata processed by Stripe (we do not store full card numbers).
• API and usage data: API key metadata, send volume, domain configuration, webhook settings, and product usage logs.
• Message data: email content, recipients, delivery events, suppressions, and inbound messages you route through the Service.
• Technical data: IP address, browser type, device information, activity logs, and product analytics events (for example signups, billing actions, and feature usage).

2. Why We Collect Data

We collect and process data to provide and operate the Service, authenticate users, deliver email, bill accounts, prevent abuse, improve reliability, and comply with legal obligations.

3. Legal Bases for Processing

• Contract necessity: to provide the Service you request.
• Legitimate interests: security, abuse prevention, service improvement, and infrastructure operations.
• Consent: where required for optional communications or features.
• Legal obligation: to comply with applicable laws and lawful requests.

4. How We Use Your Information

• Operate accounts, domains, API keys, templates, webhooks, and billing.
• Send, receive, track, and troubleshoot transactional email on your behalf.
• Monitor abuse, enforce limits, and protect shared infrastructure reputation.
• Provide support and communicate about the Service.
• Measure product usage and improve onboarding, reliability, and feature development through analytics.

5. Data Sharing & Subprocessors

We use trusted service providers to operate the Service. Categories include cloud hosting (Google Cloud), mail delivery infrastructure, payment processing (Stripe), caching/queues (Redis), error monitoring (Sentry), website analytics (Google Analytics via Google Tag Manager), product analytics (PostHog on the marketing site with consent, documentation, and dashboard), in-app support chat (Crisp on the dashboard), and demo scheduling (HubSpot Meetings) when you book a demo.

We may disclose data when required by law, to prevent fraud or abuse, or to protect rights and safety.

Customer data may be processed in the United States and other regions where our providers operate. For EU/UK transfers, contact us regarding applicable safeguards.

For a Data Processing Agreement or subprocessors list, contact [email protected].

6. Data Retention

• Active accounts: retained while your account is active and as needed to provide the Service.
• Message and event logs: retained for operational, billing, and abuse investigation purposes according to plan and configuration.
• Deleted accounts: account data is deleted or anonymized within a reasonable period after deletion request, subject to legal retention requirements.

7. Security

We implement technical and organizational measures including encryption in transit, access controls, monitoring, and incident response procedures.

No method of transmission or storage is completely secure. You are responsible for securing your API keys and account credentials.

8. Cookies

We use cookies and similar technologies for authentication, session management, essential site functionality, and — with your consent on public marketing and documentation pages — analytics and marketing tags loaded through Google Tag Manager (for example Google Analytics) and PostHog product analytics. The authenticated dashboard uses separate product analytics (PostHog) and support chat (Crisp) as described in this policy. We do not use advertising cookies without consent where required by law.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data.

To exercise these rights, email [email protected] or [email protected]. We will respond within applicable legal timeframes.

10. Children's Privacy

The Service is not directed at children under 16 in the EEA/UK or under 13 in the US. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a revised effective date and communicated as appropriate.