Privacy Policy

1. Introduction & Roles

MailChamp ("we", "us", or "our") provides high-performance cloud email delivery, SMTP relays, API services, contact management, and marketing campaign automation. This Privacy Policy explains how personal data is collected, stored, protected, and processed when you access our website, dashboard, or APIs.

Depending on the context:

• Data Controller: For your account registration, billing information, and direct usage telemetry, MailChamp is the Data Controller.
• Data Processor: When you send transactional emails or marketing campaigns through our platform, you are the Data Controller of your recipient email lists, and MailChamp acts strictly as the Data Processor.

2. Information We Collect

We collect information necessary to authenticate users, deliver communications, prevent network abuse, and maintain world-class email deliverability:

3. How We Use and Process Data

We process your data for the following legitimate business and operational purposes:

• Email Transmission: Packaging, authenticating (DKIM/SPF signing), routing, and delivering outbound emails to mailbox providers worldwide (Google, Microsoft, Yahoo, etc.).
• Event Tracking & Analytics: Providing you with real-time webhooks, delivery confirmation, bounce diagnostics, and engagement metrics.
• Fraud & Anti-Abuse Prevention: Machine-learning models to detect credential stuffing, phishing campaigns, malware attachments, or unauthorized spam runs violating our Acceptable Use Policy.
• Billing Calculation: Calculating monthly usage volumes and tiered overage fees.

4. Data Retention & Erasure

We retain message transmission logs (metadata and delivery event histories) for a default window of 30 days to allow debugging, deliverability audits, and bounce management. After this operational retention window, diagnostic logs are automatically purged or anonymized.

You may request immediate erasure of your audience contact lists or account records at any time by contacting our support desk or utilizing the in-dashboard purge controls.

5. Global Privacy Rights (GDPR & CCPA / CPRA)

Regardless of your geographic location, MailChamp extends fundamental privacy rights to all customer accounts:

• Right to Access & Portability: Obtain a structured, machine-readable export of your account data and audience lists.
• Right to Rectification: Correct inaccurate or outdated profile records.
• Right to Erasure ("Right to be Forgotten"): Delete your entire organizational profile and associated message logs.
• Non-Discrimination: We do not alter service tier pricing or performance based on the exercise of statutory privacy rights.

6. Security Safeguards

MailChamp utilizes multi-layered security controls to protect confidential payload data:

• End-to-end transport layer security (TLS 1.3 enforced for SMTP and HTTPS REST endpoints).
• AES-256 encryption at rest for customer templates, databases, and stored audience lists.
• Cryptographically hashed API tokens and salted authentication cookies (httpOnly, Secure).
• Strict multi-region redundancy and role-based access control (RBAC) across engineering staff.

7. Cookies & Local Storage

Our web applications use strictly necessary cookies to maintain authenticated sessions and protect against Cross-Site Request Forgery (CSRF). We do not deploy invasive third-party cross-site advertising trackers inside customer dashboards.

8. Contact Us & Data Protection Officer

If you have inquiries regarding this Privacy Policy, wish to execute a Data Processing Addendum (DPA), or need to exercise privacy rights, contact our privacy compliance team: