Trust and security
How we protect your data and your contacts' data, who helps us run PostaraMail, and where to ask questions.
Our role
For your contacts' data you are the controller and we are your processor under our Data Processing Addendum. We do not sell personal data, and we do not use advertising or tracking cookies.
Security measures
- HTTPS (TLS) everywhere; passwords stored only as one-way hashes; two-step verification for administrators.
- Customer workspaces are separated; API keys are stored as hashes; connected websites get a restricted key that can only add contacts and read automations.
- Rate limiting on sign-in, signup, API and public forms; signed webhooks from our email provider; automatic sign-out after 30 minutes of inactivity.
- Encrypted backups, regular deletion of expired tokens and old logs, and secure deletion when you close your account.
- One-click unsubscribe, automatic suppression of bounces and complaints, and automatic suspension of senders who attract spam complaints.
- Personal data breaches: we notify affected customers without undue delay and aim to do so within 72 hours of becoming aware.
Sub-processors
These companies process data for us. We give 30 days' notice of changes (by email to account owners and on this page).
| Company | What for | Data | Where |
|---|---|---|---|
| Hostinger International Ltd and its data-centre partners | Hosting of the application, database and file storage; mailbox for fallback account emails and encrypted backups | All account and workspace data (including contacts and emails), in encrypted form where stated | Data-centre region of our hosting plan (EU or US) |
| Resend, Inc. | Email delivery of campaigns, automations and account emails; bounce and complaint notifications | Recipient email address and first name, email content, delivery events | United States |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices and tax calculation | Name, email, billing address, tax ID, plan and payment details (card data goes directly to Stripe) | United States / Ireland |
| Anthropic, PBC (Claude) | AI drafting of emails and designs, only when you choose Claude | The text you provide for the draft (instructions, business profile, email text); never contact lists | United States |
| OpenAI OpCo, LLC (GPT) | AI drafting of emails and designs, only when you choose GPT | The text you provide for the draft; never contact lists | United States |
| xAI Corp. (Grok) | AI drafting of emails and designs, only when you choose Grok | The text you provide for the draft; never contact lists | United States |
| Google LLC (Gemini) | AI drafting of emails and designs, only when you choose Gemini | The text you provide for the draft; never contact lists | United States / Google data-centre regions |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek) Optional. Off by default for EU, UK and Swiss customers. | AI drafting of emails and designs, only when you choose DeepSeek (off by default for EU, UK and Swiss customers, who must opt in) | The text you provide for the draft; never contact lists | China |
AI providers only receive the text you give an AI feature, never your contact lists.
Where your data goes
We are based in the United States. For transfers from the EEA, UK or Switzerland we use the Standard Contractual Clauses (in the DPA). You choose the AI provider for each task. Each country's rules are in the regional terms.
Questions and reports
Security or privacy questions: support@postaramail.com. Abuse: abuse@postaramail.com. Recipients of an email sent through PostaraMail: privacy request form.