Privacy Policy

Version 2026-10-05 · Last updated October 5, 2026

In short: We collect what we need to run your account, we process your contacts only on your instructions, we do not sell data, and you can access, export or delete your data. Your contacts' data is covered by our Data Processing Addendum.

Who we are and our two roles

PostaraAI LLC (75 E 3rd St Ste 7, Sheridan, Wyoming 82801, USA) operates PostaraMail. Contact: support@postaramail.com.

We act in two roles. (1) As a controller of the personal data of people who visit our website and use our accounts (you and your team): this Policy explains that. (2) As a processor for the personal data in the contact lists and content our customers load into the Service: our customer decides what we do with it, and our Data Processing Addendum applies. If you received an email sent by a business using PostaraMail, that business is responsible for it; see the section on recipients below.

What we collect

Account data: your name, email address, business name, country, the regions you email, password (stored only as a one-way hash), and your agreement history (documents, versions, time, country, IP address and browser).
Business details you add: logo, brand colours, address, website, business and tax details for invoices, sender settings and business profile used by AI.
Billing data: handled by Stripe. We receive your plan, billing status, tax ID and invoice details, not full card numbers.
Your Content: contacts (names, email addresses, country, consent records), emails, templates, campaigns, automations and results (opens, clicks, bounces, unsubscribes).
Usage and security data: log entries, security events, IP addresses and the country derived from them. The IP address is looked up in an offline database on our own servers; nothing is sent to a third party for this.
Support and legal requests you send us, including privacy requests.
Website visitors: one strictly necessary session cookie. We do not use advertising, tracking or analytics cookies.

Why we use it, and our legal bases

We use personal data to create and run your account, deliver the Service, send emails for you, process payments, secure the Service and prevent abuse, provide support, keep records of your agreement and comply with law, and improve the product using aggregated usage information.

Where GDPR or UK GDPR applies, our legal bases are: performance of our contract with you; our legitimate interests (security, fraud and abuse prevention, defending legal claims, keeping consent and agreement records, improving the Service, sending you service tips that you can switch off); compliance with legal obligations (tax and accounting, sanctions); and consent where we ask for it (for example the optional DeepSeek processing notice). You can withdraw consent at any time.

Emails we send you

We send account emails (verification, password reset, security and billing notices), a welcome email after you verify, and a short series of helpful tips. Every tips email has a "Stop these tips" link and a one-click unsubscribe header; stopping tips never affects account emails.

AI features

When you use AI features, the text you provide (your instructions, business profile, template or email text) is sent to the AI provider you choose so it can generate a draft. We do not send your contact lists to AI providers. Providers, their locations and the optional DeepSeek processing in China are listed on our Sub-processors page and in the AI Use Terms.

Who we share data with

We share personal data only with service providers who help us run the Service (our sub-processors, listed on the Trust page and in the Data Processing Addendum), with people you instruct us to, with authorities where the law requires, and in a business transfer. We do not sell personal data or share it for cross-context behavioural advertising.

International transfers

We are based in the United States and our providers operate in the United States and other countries. Where personal data from the EEA, UK or Switzerland is transferred to countries without an adequacy decision, we rely on the Standard Contractual Clauses (and the UK Addendum) or another lawful mechanism. Data localisation or transfer rules of other countries (for example Saudi Arabia) are described in the regional terms. If you turn on DeepSeek, your AI input is processed in China.

How long we keep data

Account and workspace data: until you delete your account. Deletion removes your profile, workspace, contacts, emails, campaigns, automations and API keys from our live systems immediately.
Security and audit logs: about 12 months, then deleted. Expired verification and reset tokens: deleted after 7 days.
Agreement records (document, version, time, countries): up to 6 years after the agreement, kept without your name or IP address after you delete your account, to defend legal claims.
Billing and tax records: as long as tax and accounting laws require (typically up to 7 years).
Backups: encrypted copies may keep deleted data until the backup is replaced in our regular cycle, which we aim to complete within 90 days.

Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy (you can export contacts as CSV at any time), withdraw consent, and complain to a regulator. You can delete your account in Settings. To use other rights email support@postaramail.com or use our privacy request form; we respond within one month (or the shorter period your law requires).

California and other US state residents: we do not sell personal information or share it for cross-context behavioural advertising, and we act as a service provider for our customers' contact data. You may ask us for the categories of personal information we hold and to delete it; we will not discriminate against you for exercising your rights.

If you received an email sent through PostaraMail

The business that emailed you decided to contact you and holds your data as the controller; PostaraMail only sends on its behalf. You can unsubscribe with the link in the email at any time, and it takes effect immediately. You can also use our privacy request form to unsubscribe from all PostaraMail senders, ask who sent you an email, or ask for your data to be erased; we verify your email address, act where we can, and pass the request to the sender. To report abuse write to abuse@postaramail.com.

The WordPress plugin and connected websites

If you connect a website with the PostaraMail plugin, that website sends the email addresses and names of people who registered, ordered or subscribed there to your workspace, with the consent wording they were shown. You are the controller and are responsible for permission to email them. A connected website can only add contacts and read your automations; you can disconnect it at any time.

A connected website may pass on a visitor's IP address once, only so we can work out the person's country for regional rules when you send. We keep the country, not the IP address. If you show existing users in PostaraMail as "not asked yet", the website sends their email address, name and country; they are never emailed until they say yes and do not count toward your plan.

Security

We use encryption in transit (HTTPS), hashed passwords, access controls, rate limiting, automatic sign-out after inactivity, signed webhooks, encrypted backups and separation of customer workspaces. No system is perfectly secure. We notify affected customers of a personal data breach without undue delay.

Children

The Service is not for anyone under 18 and we do not knowingly collect data from children.

Changes and contact

We will update this Policy when our practices change and notify you of material changes. Contact: PostaraAI LLC, 75 E 3rd St Ste 7, Sheridan, Wyoming 82801, USA, support@postaramail.com. If you are in the EEA or UK you may also complain to your local data protection authority.

More: Legal centre · Trust and security · What changed · Privacy request