Privacy Policy.

This policy covers the StackSender marketing site, the StackSender dashboard, and the StackSender REST API (collectively, the “Service”). It applies to people who create a StackSender account (“you”, “customers”) and to the data those customers send through the API.

It does not govern how our customers handle their own users' data. A customer who sends a password-reset email through StackSender is responsible for its own privacy notice to its own users.

StackSender wears two different hats, and the distinction matters for your rights and ours.

• Controller — for account data. When you sign up, choose a plan, verify a domain, or open a support conversation, we decide what to collect and why. We are the controller of that data.
• Processor — for the email you send through us. Recipient addresses, subject lines, message bodies, contact lists, and the delivery events attached to them are your data. We process them only to deliver your mail, report on it, and protect the platform — on your instructions, for as long as your account and plan retention window allow. We do not sell that data, mine it to build our own mailing lists, or use it to train models.

Account and team data

• Your email address and authentication credentials. Authentication runs on Supabase Auth — passwords are hashed by Supabase and StackSender never receives or stores a plaintext password.
• Team name, team membership, and pending team invitations.
• The IP address and browser user-agent recorded at signup. We keep these specifically for abuse review — shared sending infrastructure means one spammer damages every legitimate sender on it.
• Support correspondence you send to us at support@stacksender.com.

Billing data

• Your plan tier, Stripe customer ID, Stripe subscription ID, whether a payment method has been verified, and monthly usage counters used for metering.
• Card details are collected and stored by Stripe. They never reach StackSender's servers and we never store card numbers.

Sending configuration

• Sending domains you add, their DKIM/SPF/DMARC DNS records, verification status, and any custom MAIL FROM or tracking subdomain.
• API keys. We store an 8-character public prefix (used to look the key up) and an argon2 hash of the full token. The plaintext key is shown to you exactly once at creation and cannot be recovered afterwards — not by you and not by us.
• Webhook endpoint URLs and their signing secrets. Secrets are encrypted at the application layer with AES-256-GCM before they are written to the database.
• Forwarding rules for inbound email, and per-team suppression lists.

Customer Data — the email you push through the API

When you call the send endpoint, schedule a send, or run a broadcast, we store the message and its delivery record so the dashboard log, retries, scheduled dispatch, and webhook fan-out can all reproduce exactly what shipped. That includes:

• From, To, Cc, Bcc, and Reply-To addresses; the subject line; and the rendered HTML and plain-text bodies.
• The provider message ID, send status (queued, sent, delivered, bounced, complained, failed), timestamps, and any error returned by the mail transport.
• Bounce and complaint notifications, and the suppression entries automatically created from them.
• Contacts and audiences you upload or create: email address, optional first and last name, tags, subscription category preferences, and unsubscribe state.
• Broadcast content, per-recipient send records, and aggregate counters (sent, bounced, complained, opened, clicked, unsubscribed).
• Open and click tracking events, where you have tracking enabled: open counts, click counts, and first-open / first-click timestamps.
• Inbound messages received on domains you have configured for forwarding, held only as long as needed to forward or drop them.

Operational and security logs

• An audit trail of security-relevant actions — who created an API key, verified a domain, changed billing, sent a broadcast — with the actor, the resource, the IP address, and the user-agent.
• Webhook delivery attempts to your endpoints: HTTP status, round-trip duration, error text, and attempt number.
• Standard server and request logs generated by our hosting provider, plus rate-limit counters.

What we do not do

We do not run third-party advertising or marketing analytics on the StackSender site. There are no advertising cookies, no ad-network pixels, and no data brokers in the pipeline. We do not sell personal data.

• To deliver the Service you asked for — authenticating requests, sending your mail, verifying your domains, showing delivery logs and analytics, dispatching webhooks, forwarding inbound mail.
• To bill accurately — metering sends against your plan allowance and processing subscription payments through Stripe.
• To protect the platform and its senders— enforcing rate limits, detecting abnormal bounce and complaint rates, maintaining suppression lists, blocking abusive accounts. StackSender sends over shared infrastructure, so abuse by one account harms every other customer's deliverability. This is our (and your) legitimate interest.
• To meet legal obligations — tax and accounting records, and responding to lawful requests.
• To support you — answering questions, debugging failed sends, and telling you about material changes to the Service.

Where the GDPR or a similar regime applies, we rely on performance of a contract (delivering the Service), legitimate interests (security, abuse prevention, service improvement), legal obligation (accounting), and consent where consent is the correct basis.

Email log retention depends on your plan. After the window passes, the message record for that send is no longer available to you in the dashboard or API:

• Audit logs — retained for 90 days.
• Suppression entries — retained for the life of the account. Deleting the record of a hard bounce or a spam complaint would mean mailing that address again, which is exactly what suppression exists to prevent.
• Contacts and audiences — retained until you delete them or close your account.
• Inbound messages — retained only as long as needed to forward or discard them, then deleted.
• Account and billing records — retained while your account is open and afterwards for as long as tax, accounting, and fraud-prevention obligations require.
• Webhook delivery logs and dedupe records — trimmed on a rolling basis by scheduled cleanup jobs.

When a team is deleted, its dependent records — domains, API keys, email logs, contacts, audiences, broadcasts, webhooks, suppressions, audit entries — are deleted with it by database-level cascade.

We keep the vendor list deliberately short. Each of these processes data on our behalf under its own terms, and all processing takes place in the United States (our primary sending region is us-east-1).

If we add or replace a subprocessor, we will update this list. Customers who need advance notice of subprocessor changes should contact us at support@stacksender.com.

The measures actually in place today include argon2 hashing of API keys, AES-256-GCM encryption of webhook signing secrets, TLS on every connection, Postgres row-level security, per-team scoping on every read and write, signature verification with topic pinning on inbound provider notifications, automatic suppression of hard bounces and complaints, and per-team rate limits.

The Security page describes all of this in detail, including what we do not claim.

We disclose data in four situations, and no others:

• To the subprocessors listed above, strictly to operate the Service.
• When you tell us to — for example, delivering your message to the recipient you addressed it to, or POSTing an event to a webhook endpoint you configured.
• When required by law, or to investigate suspected abuse, fraud, or a threat to the safety or deliverability of the platform. Abuse reports may be shared with the upstream email provider and with the relevant abuse desks.
• In connection with a merger, acquisition, or sale of assets, in which case we will give notice before your data becomes subject to a different policy.

Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal data, and to object to processing based on legitimate interests. You can exercise most of these directly:

• Access and export — your email logs, contacts, audiences, domains, and API key metadata are visible and exportable from the dashboard.
• Correction — account and team details are editable in dashboard settings.
• Deletion — you can delete individual contacts, audiences, domains, and webhooks yourself. To delete your entire account and everything attached to it, email support@stacksender.com from the address on the account.

For anything you cannot do yourself, write to support@stacksender.comwith the word “Privacy” in the subject. We aim to respond within 30 days and will tell you if we need longer. We will not charge you for a first, reasonable request, and we will not discriminate against you for making one.

You are probably here because a StackSender customer emailed you. In that case the customer — not StackSender — decides what data it holds about you and why. We are only the delivery mechanism.

• To unsubscribe or change preferences, use the link in the message you received.
• To ask for access to or deletion of your data, contact the sender of the message directly. They are the controller.
• If the sender is unreachable, or if you believe you were mailed without consent, write to support@stacksender.comwith the message headers. We will route the request to the sender, add your address to that sender's suppression list, and investigate the account.

The dashboard sets essential session cookies through Supabase Auth so you stay signed in. Those cookies are required for the application to function; there is no advertising, profiling, or cross-site tracking cookie anywhere on the Service.

Separately, StackSender can insert open-tracking pixels and click-tracking redirects into customeremail when a customer enables that feature. Those are the customer's tracking, applied to the customer's recipients, under the customer's legal basis — we process the resulting events on their behalf. Click links are signed so they cannot be repurposed as open redirects.

StackSender's infrastructure and all of the subprocessors listed above operate in the United States. If you are in the EEA, the UK, or Switzerland and use the Service, your data will be transferred to and processed in the US. Where required, transfers rely on Standard Contractual Clauses or an equivalent mechanism offered by the relevant subprocessor.

The Service is a developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, email support@stacksender.com and we will remove it.

We may update this policy as the Service changes. The “last updated” date at the top always reflects the current version. For material changes — a new category of data, a new purpose, a new subprocessor handling message content — we will notify account holders by email before the change takes effect.

Privacy questions, data requests, and complaints: support@stacksender.com

Security vulnerabilities: security@stacksender.com

If you are in the EEA or UK and are unsatisfied with our response, you have the right to complain to your local supervisory authority.