Data Processing Agreement

1. Scope and roles

You are the controller of the personal data in the messages you send. We are your processor for it. Where we determine our own purposes — your account, your billing, our service security — we are a controller in our own right, and the Privacy Policy governs that instead.

2. Subject matter, duration, nature and purpose

• Subject matter. Transmission and storage of the transactional email you submit, and the recording of its delivery outcomes.
• Duration. For as long as your account is open, plus the retention window you configure for message content. Deleting your account ends it immediately.
• Nature. Receiving message data over our API, storing it, dispatching it via Amazon SES in London, receiving delivery events, and making all of it available to you.
• Purpose. Delivering the email you asked us to deliver, and telling you what happened to it.

3. Types of personal data and categories of data subject

• Data subjects. The recipients of your messages — typically your own users, customers or staff.
• Personal data. Email addresses and display names; subject lines; message bodies and attachments, whose contents you determine; delivery, bounce, complaint, open and click events; and suppression records.
• Special category data. The service is not designed for it and you should not send it. If you do, you remain responsible for having a lawful basis, and you must tell us first so we can confirm whether we can support it.

4. Our obligations as processor

• (a) Documented instructions. We process the data only on your instructions. Your use of the API is that instruction; this agreement and the Terms are the rest of it. If we believe an instruction breaches data protection law we will tell you. Where law requires us to process for another reason, we will tell you before doing so unless that law forbids it.
• (b) Confidentiality. Everyone we authorise to access the data is under a duty of confidence.
• (c) Security. See section 5.
• (d) Sub-processors. See section 6.
• (e) Data subject requests. Your dashboard is the first answer: it exports your data on demand and deletes it on demand, both self-serve and immediate, which covers access, portability and erasure without needing us in the loop. The one exception is an account suspended for abuse, where self-serve deletion is refused while the case is open — erasure still happens, it goes through a person, and the refusal message says so. For anything the dashboard cannot do we will assist you, at no charge for reasonable volumes.
• (f) Assistance with compliance. We will help you with data protection impact assessments, prior consultation, and security of processing, taking into account what we know and what is available to us. Breach notification: we will tell you without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting your data, with what we know at the time and updates as we learn more.
• (g) Deletion or return. On termination we delete the data. Account deletion in the dashboard does this immediately and irreversibly. Export first if you want a copy — after deletion we cannot produce one. Where we have terminated an account for abuse we may keep the records needed to answer a chargeback, a regulator or a law-enforcement request, for as long as that need lasts and no longer.
• (h) Audit. We will make available the information needed to demonstrate compliance with this agreement, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, and subject to confidentiality.

5. Security measures

Taking into account the state of the art, the cost of implementation and the risks involved, we maintain:

• Encryption in transit for all API, dashboard and webhook traffic, and at rest by our infrastructure providers.
• Tenant isolation on every data path — no query returns another customer's rows.
• API keys stored only as SHA-256 hashes, displayed once, individually revocable, and scoped so a send-only key cannot read your data.
• HMAC-SHA256-signed webhook deliveries, so your endpoint can verify a payload is ours.
• Configurable retention that automatically strips message bodies and attachments past your chosen window.
• Redaction of recipient addresses from operational logs.
• Administrative access restricted to a named allowlist requiring a verified identity, with every state-changing action recorded in an audit log.

The security page describes these in more detail, including what we do not yet claim.

6. Sub-processors

You give general authorisation for the sub-processors below. Each is bound by written terms no less protective than these.

• Amazon Web Services — Email delivery (SES) and attachment storage. London, UK (eu-west-2).
• Convex — Application database — message records and account data. United States; storage region not yet confirmed in writing.
• Clerk — Authentication and user accounts. United States.
• Vercel — Dashboard and website hosting. United States, with edge delivery worldwide.
• Stripe — Payment processing and subscription billing. United States and Ireland.
• Sentry — Error monitoring for the dashboard. United States.

We will give at least 30 days' notice by email before adding or replacing one. If you reasonably object on data protection grounds you may terminate before the change takes effect and we will refund any prepaid, unused fees.

7. International transfers

Message dispatch happens in London (eu-west-2). Some sub-processors above operate outside the UK; those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on adequacy where it applies.

One thing we state plainly rather than leaving you to discover: while sending is demonstrably from the UK, we have not yet obtained written confirmation of the storage region for our application database. Until we do, we do not claim UK data residency at rest, and you should treat that entry in the table above as it is written.

8. Liability and precedence

Liability under this agreement is subject to the limits in the Terms of Service. Where this agreement and the Terms conflict on data protection, this agreement wins.

Questions, or a request for a countersigned copy for your records: support@yourmail.dev.