// legal
Privacy Policy
Last updated: August 17, 2026
This policy explains how Epostix (operator details on the Company Details page) processes personal data, what we process it for, and the rights you have under the General Data Protection Regulation ("GDPR"). It is written to give you the information required by Articles 13 and 14 GDPR.
Privacy contact: [email protected]. We have not appointed a data protection officer; the same address reaches the people responsible for data protection.
1. Two roles: controller and processor
Epostix processes personal data in two distinct roles:
- As controller — for data about visitors to this website, people who contact us, and holders of Epostix accounts, including billing. This policy covers that processing.
- As processor — for the personal data our customers include in the email they send through the platform (recipient addresses, names, message content, engagement events — together "Customer Content"). Here the customer is the controller and we process only on their documented instructions, under the Data Processing Agreement.
If you received an email sent through Epostix
The sender — not Epostix — decided to email you and holds your data as controller. To unsubscribe, use the link in the message; the resulting suppression is enforced on our platform automatically. To exercise GDPR rights over the sender's data about you, contact the sender named in the message. If you believe mail sent through our infrastructure is abusive, report it to [email protected] — we investigate every report and act under our Acceptable Use Policy.
2. What we process as controller, and why
| Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Account data: name, email address, password hash, account settings | Providing the Service, authentication, service communications | Contract, Art. 6(1)(b) |
| Billing data: plan, invoices, VAT ID, payment status (card details go directly to Stripe; we never store full card numbers) | Charging for the Service, invoicing | Contract, Art. 6(1)(b); retention under tax law, Art. 6(1)(c) |
| Usage and security logs: API requests, IP addresses, user-agent, dashboard actions | Operating and securing the Service, abuse and fraud prevention, enforcing sending thresholds | Legitimate interests, Art. 6(1)(f) — running a secure, abuse-free email platform |
| Deliverability data: bounce, complaint, and block signals tied to your account | Protecting sending reputation, AUP enforcement | Legitimate interests, Art. 6(1)(f); contract, Art. 6(1)(b) |
| Support and contact messages | Answering you, onboarding review (including licence review for regulated senders) | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Website analytics (see Section 3) | Understanding aggregate site usage | Legitimate interests, Art. 6(1)(f) — measuring our own marketing without tracking individuals |
| Product news to existing customers (optional) | Telling you about relevant changes and features | Legitimate interests, Art. 6(1)(f) or consent, Art. 6(1)(a); you can opt out at any time |
We do not sell personal data and do not use it for third-party advertising.
3. Website analytics and cookies
- Analytics. We use a self-hosted Plausible Analytics instance, running on our own EU infrastructure. It uses no cookies, stores no persistent identifiers, and produces only aggregate statistics. No analytics data is shared with any third party.
- Bot protection. The registration flow uses Cloudflare Turnstile to distinguish humans from bots. Turnstile evaluates technical browser signals and may set a cookie for that sole purpose; Cloudflare acts as our processor and does not use this data for advertising.
- Strictly necessary storage. The dashboard sets cookies or local storage needed to sign you in and keep the session secure; this site stores your colour-scheme preference locally. At checkout, Stripe sets cookies for payment security and fraud prevention.
We set no advertising or cross-site tracking cookies, which is why you see no cookie banner.
4. Recipients of data
We share personal data only with:
- Sub-processors and service providers listed on our Sub-processors page — currently Hetzner (EU hosting), Cloudflare (DNS, DDoS protection, Turnstile), and Stripe (payments). Each is bound by a data processing agreement.
- Competent authorities, where we are legally required to disclose, as described in the AUP.
5. International transfers
The platform runs on Hetzner infrastructure in Germany and Finland; Customer Content is stored and processed in the EU. Two ancillary providers involve third-country transfers: Stripe (payments) and Cloudflare (network services) may process limited data in the United States, in each case under the EU–US Data Privacy Framework and/or Standard Contractual Clauses (Art. 46 GDPR). Details per provider are on the Sub-processors page.
6. Retention
| Data | Retention |
|---|---|
| Account data | Life of the account, then deleted within 30 days of account deletion (backups purged within 90 days) |
| Invoices and billing records | As required by applicable tax and commercial law (typically 6–10 years) |
| Usage and security logs | 30 days, unless needed longer for an ongoing security investigation |
| Deliverability events (bounces, complaints, blocks) | Up to 12 months, to operate reputation controls |
| Suppression records we hold as controller | Kept as long as needed to honour the opt-out |
| Support correspondence | Up to 24 months after the case is closed |
Customer Content is retained and deleted per the customer's instructions and the DPA.
7. Your rights
Where we are controller, you can at any time:
- access the data we hold about you (Art. 15),
- have inaccurate data rectified (Art. 16),
- have data erased (Art. 17) or processing restricted (Art. 18),
- receive your data in a portable format (Art. 20),
- object to processing based on legitimate interests, and to any direct marketing (Art. 21), and
- withdraw any consent with effect for the future (Art. 7(3)).
Write to [email protected] from the address associated with your data, or include proof of identity; we respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority — in Portugal, where we are established, the Comissão Nacional de Proteção de Dados (CNPD) — or with the authority of the EU member state of your residence, workplace, or the place of the alleged infringement.
8. Automated decisions
The platform automatically throttles or pauses sending streams whose bounce or complaint signals breach the AUP thresholds — a contractual safeguard under Art. 22(2)(a) GDPR that affects customer sending, not individual recipients. You can always contest such a measure and have it reviewed by a human via [email protected]. We make no automated decisions with legal or similarly significant effects on individuals beyond this.
9. Security
Customer Content lives in ISO 27001-certified EU data centres; transport is TLS-encrypted, storage is encrypted at rest, access is role-restricted and logged, and secrets are managed in a dedicated vault. The technical and organisational measures are described in Annex 2 of the DPA.
10. Children
The Service and this website are not directed at children, and we do not knowingly process children's data. Accounts require users to be 18 or older.
11. Changes
We will update this policy as the Service and the law evolve, and will announce material changes by email to account owners and by updating the date above.