Privacy Policy

1. Information We Collect

• Account data: name, email address, company name, login credentials (stored hashed), and session tokens.
• Billing data: subscription status, invoices, and payment metadata processed by Stripe (we do not store full card numbers).
• Product and usage data: product events you send or connect, campaign configuration, API key metadata, send volume, domain configuration, webhook settings, conversion goals, and feature usage logs.
• Message data: email content, recipients, delivery events, suppressions, and replies or inbound messages you route through the Service.
• Integration data: when you connect third-party services (for example GitHub), we receive the data needed to provide the integration, such as repository metadata and pull request activity you authorize.
• Technical data: IP address, browser type, device information, activity logs, and product analytics events (for example signups, billing actions, and feature usage).
• Waitlist and marketing data: email address and source when you request early access or interact with our public site.

2. Why We Collect Data

We collect and process data to provide and operate the Service, authenticate users, deliver email, attribute conversions, prevent abuse, improve reliability, support customers, and comply with legal obligations.

3. Legal Bases for Processing

• Contract necessity: to provide the Service you request.
• Legitimate interests: security, abuse prevention, service improvement, and infrastructure operations.
• Consent: where required for optional communications, cookies, or features.
• Legal obligation: to comply with applicable laws and lawful requests.

4. How We Use Your Information

• Operate accounts, domains, campaigns, automations, API keys, and billing.
• Analyze product usage to recommend and run lifecycle marketing on your behalf, within limits you set.
• Send, receive, track, and troubleshoot email when you use our sending infrastructure.
• Monitor abuse, enforce guardrails, and protect platform integrity.
• Provide support and communicate about the Service.
• Measure product usage and improve onboarding, reliability, and feature development through analytics.

5. Data Sharing & Subprocessors

We use trusted service providers to operate the Service. Categories include cloud hosting (Google Cloud), mail delivery infrastructure, payment processing (Stripe), caching and queues (Redis), error monitoring (Sentry), website and product analytics (PostHog), and other vendors needed to run the Service.

We may disclose data when required by law, to prevent fraud or abuse, or to protect rights and safety.

Customer data may be processed in the United States and other regions where our providers operate. For EU/UK transfers, contact us regarding applicable safeguards.

For a Data Processing Agreement or subprocessors list, contact [email protected].

6. Data Retention

• Active accounts: retained while your account is active and as needed to provide the Service.
• Message, event, and campaign logs: retained for operational, billing, attribution, and abuse investigation purposes according to plan and configuration.
• Deleted accounts: account data is deleted or anonymized within a reasonable period after deletion request, subject to legal retention requirements.

7. Security

We implement technical and organizational measures including encryption in transit, access controls, monitoring, and incident response procedures.

No method of transmission or storage is completely secure. You are responsible for securing your API keys, integration credentials, and account access.

8. Cookies

We use cookies and similar technologies for authentication, session management, essential site functionality, and, with your consent on public marketing and documentation pages, analytics and marketing tags loaded through Google Tag Manager (for example Google Analytics) and PostHog product analytics. The authenticated dashboard may use separate product analytics as described in this policy. We do not use advertising cookies without consent where required by law.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data.

To exercise these rights, email [email protected] or [email protected]. We will respond within applicable legal timeframes.

10. Children's Privacy

The Service is not directed at children under 16 in the EEA/UK or under 13 in the US. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a revised effective date and communicated as appropriate.