Privacy

This is a draft, not a policy. Everything stated below is how the software behaves today and can be checked. The parts a policy legally needs — the controller’s identity, retention periods, lawful basis, sub-processors, transfer mechanisms and how to exercise your rights — are marked and are not yet written.

Two different sets of people

This matters more than anything else here. You are our customer. Your contacts are not — they are people whose details you uploaded. We hold their data on your behalf and act on your instructions, not on our own.

What we store about you

• Your account. Email address, a hashed password (argon2id — the password itself is never stored and cannot be recovered), your role, and when you last signed in.
• Your workspace. Its name and the postal address that the law requires on every marketing email you send.
• Credentials you create. API keys and webhook signing secrets are stored hashed or encrypted, and their plaintext is shown to you exactly once.
• Your sending domains’ DKIM private keys, encrypted at rest.

What we store about your contacts

• What you uploaded — email address and any fields you chose to add.
• What happened to their mail — delivered, bounced, opened, clicked, complained, unsubscribed, with timestamps. Opens are recorded but are unreliable, because mail apps fetch images automatically whether or not anyone read the message.
• Suppressions. Anyone who unsubscribes, hard-bounces or complains is recorded so they cannot be mailed again, including by a later import. That record has to outlive the contact row — it is the mechanism that honours their choice.

Isolation

Every workspace’s rows are separated in the database itself by row-level security, so one customer’s queries cannot reach another’s data even if application code were wrong.

Tracking

Opens and clicks are tracked on the emails you send, through links signed so they cannot be tampered with or used to redirect elsewhere. This marketing site sets no analytics or advertising cookies. The only cookie the app sets is your sign-in session.

Still to be written

The legal entity acting as controller and its address · lawful basis for each purpose · retention periods and deletion schedule · the list of sub-processors (hosting, mail transport, payments) · international transfer mechanism · how to make an access, correction or deletion request and how long it takes · breach notification · cookie detail · a contact address for privacy questions.