Privacy Policy

This Privacy Policy explains how SmartMailing ("SmartMailing," "we," "us") collects, uses, stores, and protects personal data when you visit smartmailing.io, create an account, or use our email-marketing platform.

SmartMailing is operated by Ionuț-Săndel Badiu, sole proprietor (Einzelunternehmen, Gewerbeschein) based at Nordbahnstraße 13/11, 1020 Vienna, Austria. GISA-Zahl: 40104775. Kleinunternehmer gemäß §6 Abs 1 Z 27 UStG (no UID-Nummer). Full legal notice available in our Impressum. We are the data controller for personal data of platform users and the data processor for the subscriber data our customers upload (see Section 9 below).

1. Personal data we collect

We collect and process the following categories of personal data:

Account data

When you create an account: email address, name, hashed password (managed by our authentication provider; we never see your plaintext password), and account creation / last sign-in timestamps. If you sign up or sign in with Google, Google provides your name and email address. We also keep a record of your acceptance of our Terms of Service (the time, the Terms version and where you accepted; for acceptances in the app, the IP address and browser; at checkout, your request to start a paid plan immediately) as proof of our contract. When you delete your account, we keep only the time, version and place of these acceptances (no IP address or browser) for 7 years, as proof in a billing dispute.

Profile and brand data

Brand names, logo files, brand colors, fonts, website URLs you ask us to extract, footer text, social links, and any other content you enter to configure your brand.

Email content and templates

The email templates, web landing pages, transactional emails, and campaign content you create using the platform, including AI-generated content based on your inputs.

Subscriber data (processed on behalf of our customers)

When you use SmartMailing to manage your own mailing lists, you upload personal data of your subscribers (email address, name, language, custom fields, consent records, opt-in source, IP at signup, approximate country). The approximate country is derived at sign-up from the IP address (the country only, no finer location) or provided by you through an import, the API or the dashboard; it decides whether a recipient must agree before opens and clicks are measured when you ask for consent only in the EU, EEA and UK, and you can use it to group your subscribers and in exports. We process this data on your instructions as a processor (see Section 9).

Email delivery data

The recipient addresses, subject lines, rendered email HTML, and delivery events (sent, delivered, opened, clicked, bounced, complained) for emails sent via the platform, including timestamps and IP-derived metadata from our delivery provider.

Payment data

If you purchase a paid plan, our payment processor (Stripe) collects billing name, address, card details (we never see card numbers), and transaction history. We store only billing-related identifiers and amounts on our side.

Technical / log data

IP address (truncated to /24 where stored long-term), browser user agent, referrer, request paths, error logs. We retain this for security, debugging, and abuse prevention.

AI chat history

If you use AI features (e.g. generating email content from your website), we store the prompts you submit and the responses you receive, linked to your project, so you can revisit and refine them.

Uploaded images and files (hosted at public links)

Images, logos and other files you upload to the editor, your brand library or the email-signature builder, and images we extract from a website URL you give us, are stored in our cloud file storage and served from a public web address. This is necessary so that email clients and web browsers can display the images inside the emails, signatures and hosted pages you create without logging in. The addresses are long and not listed anywhere, but they are not password-protected: anyone who has the link can open the file, including after an email has been forwarded. Do not upload files that contain personal data of other people, confidential material or anything you would not want a recipient to share. You can delete a file at any time from the editor, and we delete your files when your account is deleted.

Inbound replies to your emails

If you enable reply handling for a brand, replies that subscribers send to your reply-to address are received on our infrastructure. We store the sender address, subject line and message text, show them to you in the Replies inbox, and use them to prepare a suggested answer with AI that you review and approve before anything is sent. If you connect a Telegram chat, the message text is forwarded there as well. Replies are kept for 12 months and are deleted earlier when you GDPR-delete the subscriber.

Brand knowledge (Brand Brain)

Documents and text you upload as brand knowledge are split into passages and converted into numeric vectors (embeddings) by our AI provider so the platform can retrieve the relevant passages when drafting content. Passages and vectors are stored with your brand and deleted with it.

Voice input

If you dictate text with the microphone feature, the audio recording is sent to our AI provider for transcription. We keep the resulting text as part of your project; the audio itself is not stored by us.

Data imported from other email platforms

When you use the one-click importer (Mailchimp, MailerLite, Brevo) we use the API key you paste to read your lists and subscribers from that provider, store the imported subscribers in your account, and discard the key once the import finishes. The other provider remains an independent controller of the data it holds.

Campaign reviewers

If you invite someone to review a campaign, we store their name and email address, send them a one-time sign-in code, and keep their comments and approval decision with the campaign. Their review session lasts up to 7 days.

Email authentication reports (DMARC)

When you route DMARC reports for your domain to us, mailbox providers send us aggregate reports that contain the IP addresses of servers that sent mail using your domain, message counts and authentication results. They contain no recipient addresses and are kept for 6 months.

Connected services

If you connect Canva, we store the access tokens Canva issues so we can list and import your designs; if you link a Telegram chat, we store the chat identifier. You can disconnect either at any time.

Support and correspondence

When you contact us by email, we keep the correspondence and any details you include for as long as needed to handle the matter and, where it relates to your contract, for the statutory limitation period.

Support chat

Our website and dashboard offer a live chat with our support, run by Crisp. It loads only when you open it. What you write in the chat, and your email address if you are signed in, go to Crisp and to us so that we can answer; we keep chats like email correspondence (see above).

SmartMailing newsletter

If you sign up for our own newsletter on smartmailing.io, we store your email address and the time of your double-opt-in confirmation. You can unsubscribe from every issue with one click.

Launch waitlist

While SmartMailing is not yet open to everyone, our holding page lets you leave your email address to get an invitation. We store the address and the time, use it only to send that invitation, and delete it after 12 months at the latest.

Where the data comes from

We obtain personal data from you directly, from the websites whose URL you ask us to extract, from your subscribers when they use your forms or reply to your emails, from mailbox providers (delivery and DMARC reports), from the email platforms you import from, from Google if you sign in with Google, and from our payment processor. Providing account and billing data is a contractual requirement: without it we cannot create your account or bill a paid plan. Everything else is optional and only processed when you use the corresponding feature.

2. Legal basis for processing (Article 6 GDPR)

Each processing activity relies on one of the following bases:

• Contract performance (Art. 6(1)(b)): operating your account, storing your projects, sending emails on your behalf, providing customer support. Without this we cannot deliver the service you signed up for.
• Legal obligation (Art. 6(1)(c)): retaining billing records for tax law, responding to lawful requests from authorities, maintaining records required by anti-money-laundering or consumer-protection rules.
• Legitimate interest (Art. 6(1)(f)): security monitoring, fraud and abuse prevention, service improvement, internal analytics. We weigh these interests against your rights and use the minimum data needed.
• Consent (Art. 6(1)(a)): sending you optional marketing emails about new SmartMailing features. You can withdraw consent at any time by clicking unsubscribe in the relevant email.

Service and product emails. Emails that are part of running your account (sign-in codes, receipts, payment failures, campaign status, deliverability warnings, security notices) are sent on the basis of the contract and cannot be switched off while the account exists. Occasional news about the SmartMailing features you already use may be sent to existing customers on the basis of our legitimate interest, with an opt-out link in every message (Article 13(2) of the ePrivacy Directive). Our newsletter for people who are not customers is sent only with your double-opt-in consent.

Where we rely on legitimate interest we have weighed our interest against your rights and use only the data needed; you can object at any time (see Section 6).

3. Sub-processors we use

We rely on the following third-party processors to deliver the service. Each one is bound by a Data Processing Agreement, and where any data is transferred outside the European Economic Area (EEA), the transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures.

We update this list when we add or change processors. Material changes are communicated to platform users in advance where reasonable.

Other recipients. Beyond the processors above, we disclose personal data only to: courts, regulators and law-enforcement authorities where we are legally required to; our accountants, lawyers and insurers under confidentiality; and a successor operator if SmartMailing is sold or merged, in which case you will be informed and this policy continues to apply. We never sell personal data and never share subscriber data with advertisers.

4. International data transfers

Most personal data is processed within the EU/EEA: our application servers run in Frankfurt (Vercel), production email delivery uses Amazon SES in the EU, the brand-extraction worker runs at Hostinger in the EU, and the support chat runs at Crisp in the EU. The database is hosted by Supabase in Switzerland, which the EU recognizes as providing an adequate level of data protection under an adequacy decision (so no SCCs are required for it). Where personal data is transferred outside the EEA (to certain US-based sub-processors, namely OpenAI, Stripe, Cloudflare, Vercel (support access and edge delivery), and Resend for SmartMailing's own emails), we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) supplemented by technical and organizational measures (TLS in transit, encryption at rest, access controls). For more information about a specific transfer, contact [email protected].

Two optional integrations involve additional transfers only if you switch them on: Telegram (servers in the United Arab Emirates and elsewhere) receives the text of inbound replies, and Canva (Australia and the United States) receives requests for the designs you import. Neither country has an EU adequacy decision for this purpose, so both transfers rely on Standard Contractual Clauses in the providers' data-processing terms, and you can end them at any time by disconnecting the integration.

5. How long we keep your data

We retain personal data only as long as needed for the purpose for which it was collected. Automatic clean-up jobs run every hour to enforce the periods below.

• Account data: for as long as your account is active. Deleted within 30 days of an account deletion request.
• Brand profiles, templates, projects, brand knowledge: same as account data; deleted with the account.
• Uploaded images and files: until you delete them or delete your account.
• AI chat history: retained until you delete the project or your account.
• Subscriber data uploaded by our customers: retained until the customer deletes the subscriber or their account. Sign-ups that are never confirmed by double opt-in are deleted after 30 days.
• Per-message delivery and engagement events (sent, delivered, opened, clicked, bounced, complained): 90 days from the send date for campaign and automation emails, 30 days for transactional emails. Aggregate campaign statistics without recipient addresses are kept with the campaign.
• Inbound replies: 12 months, or earlier when the subscriber is deleted.
• DMARC aggregate reports: 6 months.
• Suppression list entries: kept for as long as the brand exists, so that the brand never emails the address again; deleted when the customer deletes the brand or the account. That the person opted out stays in the consent proof described next.
• Consent records: kept for the lifetime of the subscriber. When a subscriber, a brand or an account is deleted, a minimal proof is kept for 3 more years and then deleted, so that consent can be evidenced in a dispute or a regulatory inquiry: a one-way hashed form of the address (a known address can be matched to it, but the address cannot be read from it), the sign-up and confirmation dates, the consent wording and source, tracking-consent answers and opt-out dates. No IP address, name or other data is kept.
• Record of service emails we sent you: 6 months.
• Launch waitlist: until we send the invitation, and at most 12 months.
• AI query logs (Brand Brain): 30 days.
• Record that an account was deleted: 7 years (a pseudonymised user ID, the Stripe customer reference and the Terms acceptances described in Section 1, as proof in a billing dispute).
• Billing and tax records: 7 years, as required by Austrian Bundesabgabenordnung (BAO) §132.
• Technical / security logs: up to 90 days, then deleted or aggregated.
• Backups: our database host, Supabase, makes a daily backup of the database, kept for 7 days and stored encrypted, so deleted data can remain in a backup for up to 7 days. Uploaded images and files are not part of these backups.

6. Your rights

Under the GDPR you have the following rights regarding your personal data. To exercise any of these, contact [email protected]. We respond within one month (extendable by two months for complex requests).

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): request deletion of your account and personal data. Some data may be retained for legal obligations (e.g. billing records).
• Restriction (Art. 18): request that we pause processing of your data pending a dispute.
• Portability (Art. 20): request your data in a structured, machine-readable format (JSON).
• Object (Art. 21): object to processing based on legitimate interest, including profiling.
• Withdraw consent (Art. 7): where processing is based on consent, withdraw it at any time. This does not affect prior lawful processing.
• Lodge a complaint (Art. 77): file a complaint with a supervisory authority. The competent authority for SmartMailing is the Austrian Datenschutzbehörde (DSB): dsb.gv.at, Barichgasse 40-42, 1030 Vienna, Austria. You can also file with the supervisory authority of your habitual residence.

You can exercise most rights yourself: download a copy of your data (Account, then Export my data; the file lists what it contains), change your details in Account settings, and delete your account with "Delete my account". For requests by email we may ask you to confirm the request from the email address registered to the account so that we do not release data to the wrong person. Requests are free of charge unless they are manifestly unfounded or excessive.

7. Automated decision-making, profiling and AI

SmartMailing uses AI models (currently provided by OpenAI, reached through the Cloudflare AI Gateway, except the brand-setup worker, which calls OpenAI directly) for: generating and translating email copy from your inputs, converting brand knowledge into embeddings and ranking the relevant passages, drafting suggested answers to inbound replies, summarising campaign results, and transcribing voice input. In every case the output is shown to you and nothing is sent to a recipient without your action. OpenAI processes API requests under its Enterprise terms, does not use them to train its models, and retains them for up to 30 days for abuse monitoring before deleting them.

This is content assistance, not automated decision-making about you within the meaning of Article 22 GDPR. Two automated mechanisms nevertheless affect how you can use the service, and we want to be transparent about them:

• Deliverability protection: we automatically monitor bounce and complaint rates and DNS authentication for every sending domain. If the thresholds in our Terms of Service are exceeded, or DKIM stays broken for more than 24 hours, sending for that domain is paused automatically and you are notified. This protects every customer's deliverability. You can always ask a human to review a pause by contacting us, and sending resumes automatically once the cause is fixed.
• Segmentation of subscribers: the platform can group a customer's subscribers by engagement (for example "opened in the last 90 days"). This is profiling carried out on the customer's instructions; the customer is the controller and decides whether to use it.

We do not use personal data to train AI models of our own.

8. Cookies and similar technologies

SmartMailing uses only essential cookies and browser-storage entries required to operate the service:

• Authentication session: set when you log in, used to keep you signed in. Required for the service to function.
• CSRF / security tokens: set to protect against cross-site request forgery.
• Language preference (NEXT_LOCALE): stores the language you chose in the site switcher.
• Review access: a 7-day session cookie set only for reviewers who sign in to a campaign review page.
• Bot protection: Cloudflare Turnstile may set a short-lived challenge cookie on forms it protects.
• Support chat: only after you open the chat, Crisp stores cookies and browser-storage entries that keep your conversation; nothing from Crisp is loaded before.
• Payment pages: Stripe sets its own strictly necessary cookies on checkout and billing-portal pages; see Stripe's privacy policy.
• Editor state: browser storage entries that keep unsaved editor work and interface preferences on your device.

We use Vercel Web Analytics, a privacy-friendly, cookieless analytics tool, to measure aggregate page views and traffic on our own site. It sets no cookies, stores no identifiers on your device, and does not track you across sites; it derives a short-lived, non-reversible hash from request data to count visits. Because nothing is stored on or read from your device, this does not require consent under the ePrivacy Directive (§165 TKG 2021). Our legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding aggregate usage of our site. Vercel processes this data in the United States under the Standard Contractual Clauses. We do not use advertising cookies or cross-site trackers. If we ever introduce technologies that store or access information on your device beyond what is strictly necessary, we will deploy a compliant consent banner before they are activated.

Tracking in emails sent by our customers. Campaign emails sent through SmartMailing can contain an invisible tracking image that registers when the email is opened, and rewritten links so that clicks can be counted. Whether they do depends on two things: the setting the customer chose for their brand (measure everyone; measure only recipients who agreed; ask for agreement only from recipients in the EU, EEA and UK and measure everyone else; or measure nobody) and the recipient's own answer. A recipient who has refused is never measured, whatever the setting; where agreement is required, only recipients who agreed are measured, plus recipients collected before 14 April 2026 who received a one-time information notice and did not object within 14 days. In the regional setting, recipients whose country is unknown are treated as needing agreement unless the customer chose otherwise. Measured emails carry a "Tracking preferences" link next to the unsubscribe link: it opens the preference page, where the recipient can withdraw or give that answer at any time without unsubscribing. An email sent without measurement carries no tracking image and plain links. Transactional emails (receipts, confirmations, password resets) and replies to messages a recipient sent are never measured. Each customer is responsible, as the controller, for informing recipients and for obtaining consent where the law of the recipient's country requires it: the French CNIL (recommendation of 14 April 2026) and the Italian Garante (decision of 17 April 2026) treat open-tracking pixels as access to the recipient's device that needs prior consent for marketing purposes. Every answer is stored with its wording, time and source. Engagement events are deleted after 90 days (see Section 5).

9. When SmartMailing acts as a processor

When you (the customer) upload subscriber data to SmartMailing (through the API, hosted subscribe forms, manual add, or CSV import), you are the data controller for those subscribers, and SmartMailing acts as your data processor.

We process subscriber data only on your documented instructions: storing it, segmenting it, sending the emails you compose, recording consent and delivery events. We do not use subscriber data for our own purposes, do not sell it, and do not contact subscribers ourselves (except for transactional emails you trigger, such as the double-opt-in confirmation).

The terms of this processor relationship are set out in our Data Processing Agreement, available at smartmailing.io/legal/dpa. By using the platform you accept the DPA. Subscribers who want to exercise their rights should contact you (the controller); we will assist you in responding.

The processor role also covers the hosted pages we run for you (subscribe, confirmation, preference and unsubscribe pages, including the conversational unsubscribe flow), inbound reply handling and the AI-drafted answers described in Section 7, engagement tracking and segmentation. When you enable reply handling, link a Telegram chat or use AI features on subscriber data, you instruct us to use the corresponding sub-processors listed in Section 3. Your subscribe forms and hosted pages should link to your own privacy notice so that subscribers receive the information Article 13 GDPR requires from you.

10. Security

We protect personal data with these technical and organizational measures: TLS for all connections to our platform; encryption at rest by our hosting providers; separation between customers by row-level security for all database access from the customer dashboard and by ownership checks in our server code wherever our servers use the privileged database key, which never reaches a browser; webhooks verified by signature or shared secret; optional two-factor sign-in for every account; security reviews of our code; and security updates to our dependencies when vulnerabilities become known. Each account has a single owner; there are no shared team roles yet.

In the event of a personal-data breach affecting your data, we will notify the relevant supervisory authority within 72 hours and inform affected users where required by Articles 33-34 GDPR.

Two limits are worth knowing. First, images and files you upload are, by design, served from public links without authentication (see Section 1), so their protection depends on the link not being shared. Second, our staff can access customer data only for support, abuse investigation and legal obligations; administrative access requires two-factor sign-in, and administrative changes to customer accounts (such as approving, pausing or deleting a brand) are logged; looking at data is not logged individually.

11. Children

SmartMailing is a service for businesses and adults. You must be at least 18 to create an account (see Section 3 of our Terms of Service), and the service is not directed at children. We do not knowingly collect personal data from anyone under 18 as a user of the platform. If we learn that an account belongs to someone under 18, we close it and delete the associated personal data, except records we are required by law to keep. If you believe a minor has created an account or provided personal data to us, contact us and we will act on it.

12. Changes to this policy

We may update this policy from time to time to reflect changes in processing, processors, or applicable law. Material changes will be communicated to platform users via email at least 14 days before they take effect. The "Last updated" date at the top of this page indicates the most recent revision.

13. Contact

For any privacy-related question or to exercise any of the rights listed in Section 6, contact us at [email protected]. We aim to respond within five business days and within one month for formal data-protection requests.

If you are not satisfied with our response, you may lodge a complaint with your local data protection authority. The competent authority for SmartMailing is the Austrian Datenschutzbehörde (DSB): dsb.gv.at.

We have not appointed a Data Protection Officer because the conditions of Article 37 GDPR do not apply to a business of our size and activity; the address above is the single point of contact for all data-protection matters.