Privacy Policy

We handle two different kinds of personal data, and our role is different for each. The distinction runs through this whole policy.

• Controller for account data. Your own name and email address, your billing details, your domains and your dashboard sessions. We decide how that data is used, so we are the controller of it.
• Processor for message data. Everything inside the email you send, including recipient addresses, subjects and message bodies. You decide what is sent and to whom, so you are the controller and we are your processor.

Your recipients' personal data belongs to you. We hold it to deliver your mail and to show it back to you, and we act on your instructions. The terms of that arrangement are in our data processing agreement.

If you are a recipient of mail sent through our platform and you want your data changed or erased, the sender decides that. Contact them first. You can also write to privacy@avelto.dev and we will pass the request on and help where we can.

Account data, where we are the controller:

• The email address you sign in with, and the account name you choose.
• API keys, stored only as a SHA-256 hash with a short prefix kept so you can tell keys apart in the dashboard.
• The domains you add and their verification status.
• Dashboard sessions, magic-link tokens (hashed, single use) and the IP address that requested a sign-in link.
• If you add one, a password (stored only as a salted scrypt hash), the public half of any passkey you register, and the key of an authenticator app (stored encrypted, with the time of the last code used). A passkey's private key never leaves your device.
• Billing records: plan, invoices, usage counts and payments. Your card is held by our payment processor, not by us; we hold the brand, the last four digits and the expiry so the billing page can show you which card is on file.
• Messages you send us through the contact form or by email.
• How you found us, if you arrived from a link that said: the campaign tags on it, which kind of ad you clicked, the site that sent you and the page you landed on, kept with your account when you sign up.
• Usage analytics about our own website and dashboard, described in section 6.

Message data, where we are your processor:

• Email metadata: the from address, recipients, subject, tags, status, message id and timestamps.
• Message bodies, meaning the HTML and text you send, and their attachments where you send them.
• Delivery events from the sending provider: sent, delivered, delayed, bounced, complained, rejected and failed.
• Suppression lists, meaning addresses that hard bounced or complained on your account.
• Webhook endpoints you configure, and the deliveries made to them: what we sent, the response status and the start of what came back.

From anyone who sends us a report through our report form (abuse, phishing, copyright or privacy), where we are the controller: your email address, what you wrote, the email it was about if the link named one, and the IP address it was sent from.

We do not sell personal data, we do not share it for advertising, and we do not use message content to train machine-learning models.

Account data, email records and delivery events are stored in the European Union. Email is sent through Amazon Web Services in the eu-north-1 region, in Sweden. Requests to our website, dashboard and API reach us through Cloudflare's network, which handles each one at a location near whoever sent it, so a request from outside the EU passes through Cloudflare outside the EU on its way in. Cloudflare carries API requests through without storing them.

This is the same on every plan. Enterprise contracts state it in writing. Our sub-processors are listed on the sub-processors page.

Message bodies are kept for the retention window of your plan, then deleted. The email record stays, so ids, statuses and metadata keep resolving after the body has gone.

• Free: message bodies kept for 1 day.
• Pro: message bodies kept for 7 days.
• Growth: message bodies kept for 30 days.
• Enterprise: message bodies kept for 90 days.

What we sent to your webhook endpoints and what they answered is kept for the same window as message bodies, then deleted; the record that a delivery happened stays with the email.

Metadata is kept longer than content, because it is what billing and abuse prevention are built on. Billing records are kept for 24 months, which also covers our tax obligations. Abuse and security records, such as bounce and complaint rates and suspension history, are kept for 12 months.

Suppression lists and domain settings are kept until you remove them or delete the account. Deleting your account removes its emails, domains, keys, webhook endpoints and suppressions, and releases your domains from our sending provider. Billing records are kept for the period above, because we are required to keep them; each invoice carries the billing name and address it was issued to, and nothing else about you stays with it. Abuse records are kept for their period above with the recipient addresses removed.

Reports sent through our report form are abuse records and are kept for 12 months. The IP address a report came from is deleted after 90 days.

• Performance of a contract: running the service you signed up for, delivering your mail, showing you your logs and supporting you.
• Legitimate interests: keeping the platform secure, preventing abuse of our sending reputation, and improving the service, which includes measuring how our website and dashboard are used and which of our pages bring people to sign up. We balance those interests against your rights and use the least data that works.
• Legal obligation: keeping billing and tax records, and responding to lawful requests from authorities.

Where we act as your processor, our basis for handling recipient data is your instruction. Your own lawful basis for contacting those recipients is yours to hold, as set out in the Acceptable Use Policy.

We set one cookie: __Host-avelto_session. It keeps a signed-in dashboard user signed in, and it is strictly necessary for that. It is httpOnly, Secure and SameSite=Lax.

We set no analytics cookies, no advertising cookies and no tracking cookies, and our analytics stores nothing on your device, as described below. There is nothing to consent to, so there is no cookie banner on this site. Your browser also keeps one local preference for us, the light or dark theme you chose, which never leaves your device. When you enter a card on the billing page, the payment processor's fields set cookies of their own for fraud prevention; those are covered by its policy, and they are only loaded on that page.

Analytics. We measure how our website and dashboard are used with PostHog, on its EU cloud in Frankfurt. It runs without cookies: nothing is written to your device, not a cookie, not local storage, not session storage. Each visit is counted on its own, so we can count page views but cannot follow you from one visit to the next. Requests go to our own domain and are passed on from there, so your browser does not contact PostHog directly.

• On the public pages: which pages you view and for how long, the site that sent you here, the campaign tags on the link you followed, whether you came from an ad click, your browser and type of device, and which links and buttons you click.
• In the dashboard: which pages you view, with the ids and search terms taken out of the addresses, and a handful of named actions such as adding a domain, creating an API key or sending your first live email. These carry ids and counts only, never a domain name, an email address, a recipient, a subject or anything you typed.
• When you are signed in, those events are linked to your user id, your account id, your plan and your role. Never your name or email address.
• Your IP address is used to estimate an approximate location, such as the country, and is then discarded. PostHog is set not to store it.

Our lawful basis is legitimate interests: knowing which pages help people and which do not, so we can improve the service. PostHog keeps the data for its standard retention period and then deletes it; it is listed on the sub-processors page. To opt out, turn on Do Not Track or Global Privacy Control in your browser. We then do not load the analytics at all.

We do not add open-tracking pixels or rewrite links for click tracking in the mail you send. What you send is what the recipient receives.

Under the UK GDPR you have the right of access, and the rights to rectification, erasure, restriction of processing, data portability and objection. You also have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect.

How to use them:

• Account holders can export everything held for the account from the dashboard, or from the API at GET /v1/account/export: the account, domains, every email with its content and events, suppressions and webhooks, as one JSON file.
• Account holders can erase a single recipient from the dashboard, or from the API at POST /v1/recipients/erase. That removes the address everywhere we hold it for the account: from emails (recipients, reply-to address, subject and headers), from their delivery events, from what was sent to the account's webhooks about them, and from abuse records. Emails sent only to that person are deleted, and so is the stored content of every email sent to them. A hashed entry stays on the suppression list, so nothing is sent to that address again without us holding the address itself.
• Account holders can delete the whole account from the dashboard. We hold it for seven days first and email the owner, so a mistake can be undone; after that the data is deleted and any subscription is cancelled. While an account is suspended, its deletion is arranged with us rather than from the dashboard.
• Suppression entries can be removed one at a time from the dashboard or with the API.
• Anyone else, including a recipient asking about their own data rather than a customer asking about theirs, should write to privacy@avelto.dev. Recipients' data belongs to the customer who sent the mail, so we normally pass such a request to them and help them act on it.

Every one of those actions is recorded in an audit log against the account: what was done, by which credential, and when. We answer requests sent to the address above within 30 days, and tell you sooner if we need more information to identify the records.

We use a small number of sub-processors to run the service. They are listed, with what each one does and where it is, on the sub-processors page.

We give at least 30 days' notice before adding or replacing a sub-processor. Customers who object can tell us during that period, as set out in the data processing agreement.

Personal data is stored in the European Economic Area. The United Kingdom benefits from an adequacy decision covering transfers of personal data from the EU to the UK, so data can move between our UK operations and our EU infrastructure.

Two sub-processors can handle personal data outside the EEA: Cloudflare, whose network carries requests to our website, dashboard and API from wherever they are sent, and Stripe, which processes card payments. Both are US companies, and those transfers are covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, with the UK Addendum for UK data.

PostHog, which runs our usage analytics, is also a US company. Its EU cloud stores the data in Frankfurt; any access to it from outside the EEA is covered by the EU Standard Contractual Clauses in its data processing agreement, with the UK Addendum for UK data.

If we add another sub-processor outside the EEA, the transfer will be covered by the UK International Data Transfer Agreement, or by the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment. We will give notice first, as described above.

What we do to protect this data is described on our security page: hashed API keys, encryption in transit, redacted logging, per-account isolation and signed webhook delivery.

We do not claim any certification or audit. We describe the controls we actually run, and we update that page when they change.

If you think we have handled your personal data badly, tell us first at privacy@avelto.dev and we will try to put it right.

You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. Complaining to us first is not a condition of complaining to them.

Privacy questions, data subject requests and sub-processor objections go to privacy@avelto.dev.

The controller of account data is the business trading as Avelto, established in the United Kingdom. Registered business details are available on request from support@avelto.dev, and will be published on this page once the entity is confirmed.

We have not appointed a data protection officer, and this policy does not claim any certification.

We may update this policy. The date at the top shows when it last changed, and material changes are announced by email to account holders.