This Privacy Policy describes how MailerSpark ("we," "us," or "our") collects, uses, and protects your information when you use our service at app.mailerspark.com and our marketing site at mailerspark.com (collectively, the "Service").

1. What we collect

Account data. When you sign up, we collect your name, email address, and password (hashed with bcrypt). If you pay, our payment processor (Stripe) collects your card details — we never see or store them.

Email infrastructure credentials. When you connect an SMTP account, OAuth mailbox, or webhooks endpoint, we collect the credentials or tokens needed to send email on your behalf. SMTP passwords, OAuth tokens, and webhook secrets are encrypted at rest.

Contact data. If you upload contacts or use our public subscribe API, we store them on your behalf. You are the data controller; we are the data processor. We never use your contacts for marketing.

Usage data. We collect standard server logs (IP addresses, user agents, request paths) for security, abuse prevention, and debugging. We retain these for 30 days.

2. How we use it

To provide the Service: send emails, sync replies, process webhooks.
To process billing via Stripe.
To send service-related emails (verification, password reset, billing receipts).
To respond to support requests you send us.
To detect and prevent abuse, security incidents, and violations of our terms.

3. Subprocessors

We use the following subprocessors to deliver the Service:

Amazon Web Services — hosting, database (RDS), email (SES).
Stripe — payment processing.
OpenAI — AI reply classification (only if you opt in and provide your own key).

4. Your rights

You can export all your data and delete your account at any time from Settings. If you're a contact in someone else's MailerSpark account, you can request access, correction, or deletion by contacting that account holder directly — we can only act on their behalf.

For EU/UK residents (GDPR), our legal basis for processing is performance of a contract and our legitimate interest in operating a secure service. You have the right to access, rectify, restrict, port, and erase your personal data, and to object to processing.

5. Data retention

We retain your account data for as long as your account is active. When you delete your account, we delete your data within 30 days, except for records we must keep for legal reasons (e.g. tax records).

6. Security

See our Security page for details on encryption, SSRF protection, IDOR guards, and signed webhooks.

7. Contact

Questions about privacy? Email privacy@mailerspark.app.