Privacy policy

1. Who is responsible

The controller for the processing described in sections 2 to 4 is:

Full provider details are in the Legal notice. We have not appointed a data protection officer because we are not legally required to. Please send any privacy question to info@i-mailsend.eu.

2. This website

No cookies, no analytics, no tracking. This website sets no cookies, uses no analytics or advertising tools, loads no external fonts or scripts and contains no social media plugins. Fonts are served from our own server.

Server logs. When you open a page, your browser sends technical data that our web server needs to deliver it: IP address, date and time, the page requested, status code, amount of data, referring page and browser identification (user agent). Where we keep this in log files, we use it only to run the site securely, to detect and fix errors and to defend against attacks.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a working and secure website.
• Retention: log entries are deleted after 14 days at the latest, unless a specific entry is needed to investigate a security incident; it is then kept until the investigation is finished.

3. Contacting us by email

If you write to us (for example to info@i-mailsend.eu or abuse@i-mailsend.eu), we process your email address, your name if you give it, the content of your message and the time it was sent, in order to answer you.

• Legal basis: Art. 6(1)(b) GDPR if your message relates to a contract or to steps before one; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries and handling abuse reports).
• Retention: until your request is settled. Business correspondence that commercial or tax law requires us to keep is stored for the statutory period (generally 6 to 10 years).

4. Customer accounts (we are controller)

When a business signs up for i-mailsend, we process the following data about the account holder and the team members they invite:

• Account data: name, email address, password (stored only as a secure hash), two-factor authentication settings, language, role in the workspace.
• Business data: company name, legal form, address, register and VAT details, sender name and the legal footer information that must appear in your emails.
• Review and compliance data: information you give us when we check a new account (for example your website and how your subscribers signed up), sender domains and their DNS status, sending volumes and quality figures such as bounce and complaint rates, and abuse reports concerning your account.
• Usage and security data: login times, IP addresses and browser identification of logins, and an audit log of important actions in the account.
• Billing data: plan, subscription status, invoices and the customer reference that our merchant of record (Creem) gives us. We do not receive or store your card details.
• Support communication with you.

Purposes and legal bases:

• Providing the service under our contract with you: Art. 6(1)(b) GDPR.
• Keeping accounting and tax records: Art. 6(1)(c) GDPR.
• Security of the platform, preventing fraud, spam and abuse, and protecting the reputation of our sending infrastructure for all customers: Art. 6(1)(f) GDPR. This includes the review of new accounts and the monitoring of bounce and complaint rates.

Service emails. We send you emails that are necessary for your account, such as address confirmation, password reset, security notices, billing notices and warnings about your sending. These are part of the service and cannot be switched off while the account exists.

Cookies in the application. The application at app.i-mailsend.eu uses only strictly necessary cookies: a session cookie that keeps you logged in and a security token against cross-site request forgery. The session ends after 7 days without activity and after 30 days at the latest, or when you log out. We use no tracking or advertising cookies there either.

Automatic protective measures. To protect recipients and the platform, sending from an account is paused automatically when its bounce or complaint rate exceeds the limits in our Acceptable use policy. A person reviews every pause before sending resumes, and you can always ask us to review it and give your point of view. We do not otherwise make decisions about you based solely on automated processing.

The data marked as account and business data is required to conclude and perform the contract; without it we cannot open an account.

5. Subscribers of our customers (we are processor)

Our customers use i-mailsend to manage their subscriber lists and to send email. For this data the customer is the controller and we act as their processor under Art. 28 GDPR, based on a data processing agreement that forms part of our Terms of service. We process this data only on the customer's instructions and not for our own purposes.

Typical data includes email address, name and other fields the customer collects, list and tag memberships, the consent record (time, signup form or source, the consent text shown, IP address and browser identification at signup and confirmation), sending and delivery events, bounces, complaints and unsubscribes.

Open and click tracking is switched off by default. It is used only where the customer has switched it on and the recipient has given separate consent.

If you received an email from one of our customers, the sender named in that email is responsible for your data. Please contact the sender to exercise your rights. Every email contains a link to unsubscribe at once. If you write to us instead, we will forward your request to the customer concerned.

Our own suppression list. As an exception, we are controller for a short platform-wide list of addresses that must not receive email from the platform at all: addresses that do not exist (hard bounces) and known spam traps. We keep this list to protect recipients and the delivery of all customers' email (Art. 6(1)(f) GDPR). Entries are stored for as long as they are needed for this purpose, where possible only as a one-way hash.

6. Service providers and sub-processors

We use the following providers. Except where stated, they act as our processors and are bound by data processing agreements. For subscriber data (section 5) they are sub-processors on behalf of our customers.

We will update this list before we add or replace a sub-processor. Customers are informed in advance as set out in the data processing agreement. Beyond these providers, we disclose personal data only where the law requires it, for example to authorities with a lawful request.

7. Transfers outside the EU

We store and process data in the European Union. Some of our providers belong to groups based in the USA. Where personal data may be accessed from outside the European Economic Area, the transfer is protected by an adequacy decision (in particular the EU–US Data Privacy Framework, where the recipient is certified) or by the EU Standard Contractual Clauses (Art. 45 and 46 GDPR). You can ask us for a copy of the relevant safeguards.

8. How long we keep data

• Website server logs: 14 days at the most (see section 2).
• Account data: for as long as the account exists. After the account is closed, you have 30 days to export your data; we then delete it within another 30 days.
• Subscriber data of customers: as instructed by the customer, and deleted at the end of the contract as described above.
• Backups: encrypted backups are replaced on a rolling basis; deleted data disappears from them within 90 days at the latest.
• Security and audit logs: 12 months.
• Invoices, accounting records and related correspondence: for the statutory retention periods (generally up to 10 years).
• Records about abuse and suppression entries: as long as needed to prevent repeated abuse and to honour unsubscribes and bounces; where possible only as a one-way hash.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17) or its processing restricted (Art. 18);
• receive your data in a structured, machine-readable format (Art. 20);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21);
• withdraw any consent you gave, with effect for the future (Art. 7(3)).

To exercise these rights, write to info@i-mailsend.eu. We may need to confirm your identity before we act on a request.

You also have the right to lodge a complaint with the competent data protection supervisory authority, in particular in the EU member state where you live, where you work or where you believe the infringement took place (Art. 77 GDPR).

10. Changes to this policy

We update this policy when our services, providers or legal requirements change. The date at the top shows the current version. Customers are informed by email about material changes.