Privacy Policy
This Policy explains how SMTP2U processes personal data, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and, where it applies, the GDPR. It covers the website, the dashboard, the API and the SMTP server of SMTP2U.
In short: we use your data to provide the service and to bill for it. We do not sell personal data. We do not use advertising or third-party analytics cookies. The content and recipients of your emails are processed only to send the messages and to show you the results.
1. Who is who
SMTP2U processes personal data in two different roles:
- Controller, for the data of our customers and visitors: account, billing and dashboard usage data.
- Processor, for the data customers submit to the service: recipient addresses, contacts, message content and delivery events. In these cases the customer is the controller and decides who to send to and on what legal basis.
If you received an email sent by an SMTP2U customer and want to exercise your rights, contact the sender of the message first. If you prefer, write to privacy@smtp2u.com and we will forward the request to the responsible customer.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, workspace name, password (stored only as a hash) | You |
| Billing | Plan, subscription status, customer identifiers at Stripe. Card details stay with Stripe only | You and Stripe |
| Usage and security | IP address, browser or SMTP client agent, API request logs, actions in the dashboard | Automatic |
| Data submitted to the service | Sender, recipient, subject, content and attachments of messages, contacts and lists, templates | Customer |
| Delivery events | Sent, delivered, opened, clicked, bounced, complained, with date, clicked link, IP and mail client agent when reported by the provider | Delivery provider |
3. Purposes and legal bases
- Providing the service you contracted: creating the account, sending email, showing logs and metrics. Legal basis: performance of a contract.
- Billing paid plans and extra emails. Legal basis: performance of a contract and compliance with a legal obligation.
- Protecting the platform: preventing fraud, spam and abuse, reviewing new accounts, keeping the suppression list. Legal basis: legitimate interest and compliance with a legal obligation.
- Communicating service, security and billing notices. Legal basis: performance of a contract.
- Complying with the law and responding to authorities. Legal basis: compliance with a legal or regulatory obligation.
We do not make solely automated decisions that produce legal effects on you.
4. Cookies
The dashboard uses a single, strictly necessary cookie to keep you signed in. It is a first-party, HttpOnly cookie and expires within 7 days. The public website does not use advertising cookies or third-party analytics. For that reason we do not show a consent banner.
5. Open and click tracking
To tell customers whether an email was opened or clicked, messages sent through SMTP2U may contain an invisible image and have their links rewritten to pass through a tracking address of the delivery provider. These events record the date, the clicked link and, when available, the IP and the type of mail client. Recipients can avoid open tracking by blocking image loading in their mail client.
6. Who we share data with
We share data only with vendors needed to provide the service, under contract and with confidentiality and security obligations:
| Vendor | Purpose | Location |
|---|---|---|
| Amazon Web Services (SES and SNS) | Email delivery and delivery event notifications | United States |
| Stripe | Payment and invoice processing | United States and other countries |
| Cloudflare | DNS for the SMTP2U domain | Global network |
| Hosting provider | Application and database servers | As set in the hosting agreement |
We may also share data to comply with a court order or a request from a competent authority, and in corporate transactions, preserving the safeguards of this Policy. We do not sell personal data.
7. International transfers
Some of the vendors above process data outside Brazil, mainly in the United States. These transfers rely on the mechanisms of article 33 of the LGPD, including contractual clauses and necessity for the performance of the contract.
8. How long we keep data
- Account and workspace data: while the account exists and, afterwards, for the period needed to meet legal obligations and to defend legal claims.
- Emails, events and contacts: while the workspace exists, or until the customer deletes them.
- API and SMTP request logs: 30 days.
- Original message received over SMTP, with attachments: 30 days.
- Access records: at least 6 months, as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014).
- Suppression list: kept for as long as needed to prevent new sends to people who bounced, complained or unsubscribed.
9. Security
- Traffic protected by HTTPS in the dashboard and the API, and by TLS over SMTP.
- Passwords and API keys stored only as hashes. Provider credentials stored with AES-256-GCM encryption.
- Data isolated per workspace, role-based access control and an audit trail of actions.
- Signed webhooks and protection against request forgery in the dashboard.
No system is completely secure. In the event of an incident with relevant risk or harm, we will notify those affected and the Brazilian National Data Protection Authority, as the LGPD requires.
10. Your rights
You may at any time request: confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, review of automated decisions and withdrawal of consent, where consent is the legal basis. To do so, write to privacy@smtp2u.com. We answer within the periods set by law. You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or with your local supervisory authority.
11. Children and teenagers
SMTP2U is a service for companies and professionals. It is not intended for people under 18 and we do not knowingly collect their data.
12. Changes and contact
We may update this Policy. Material changes will be announced by email or in the dashboard. The date of the last update appears at the top of the page.
Data protection officer and privacy channel: privacy@smtp2u.com. Other matters: support@smtp2u.com.