Privacy Policy

We handle two different kinds of personal data, and our role is different for each. The distinction runs through this whole policy.

• Controller for account data. Your own name and email address, your billing details, your domains and your dashboard sessions. We decide how that data is used, so we are the controller of it.
• Processor for message data. Everything inside the email you send, including recipient addresses, subjects and message bodies. You decide what is sent and to whom, so you are the controller and we are your processor.

Your recipients' personal data belongs to you. We hold it to deliver your mail and to show it back to you, and we act on your instructions. The terms of that arrangement are in our data processing agreement.

If you are a recipient of mail sent through our platform and you want your data changed or erased, the sender decides that. Contact them first. You can also write to privacy@staging.avelto.dev and we will pass the request on and help where we can.

Account data, where we are the controller:

• The email address you sign in with, and the account name you choose.
• API keys, stored only as a SHA-256 hash with a short prefix kept so you can tell keys apart in the dashboard.
• The domains you add and their verification status.
• Dashboard sessions, magic-link tokens (hashed, single use) and the IP address that requested a sign-in link.
• If you add one, a password (stored only as a salted scrypt hash) and the public half of any passkey you register. A passkey's private key never leaves your device.
• Billing records: plan, invoices, usage counts and payments. Your card is held by our payment processor, not by us; we hold the brand, the last four digits and the expiry so the billing page can show you which card is on file.
• Messages you send us through the contact form or by email.

Message data, where we are your processor:

• Email metadata: the from address, recipients, subject, tags, status, message id and timestamps.
• Message bodies, meaning the HTML and text you send, and their attachments where you send them.
• Delivery events from the sending provider: sent, delivered, delayed, bounced, complained, rejected and failed.
• Suppression lists, meaning addresses that hard bounced or complained on your account.
• Webhook endpoints you configure, and the delivery attempts made to them with their response status.

We do not sell personal data, we do not share it for advertising, and we do not use message content to train machine-learning models.

Account data, email records and delivery events are stored and processed in the European Union. Email is sent through Amazon Web Services in the eu-north-1 region, in Sweden.

This is the same on every plan. Enterprise contracts state it in writing. Our sub-processors are listed on the sub-processors page.

Message bodies are kept for the retention window of your plan, then deleted. The email record stays, so ids, statuses and metadata keep resolving after the body has gone.

• Free: message bodies kept for 1 day.
• Pro: message bodies kept for 7 days.
• Growth: message bodies kept for 30 days.
• Enterprise: message bodies kept for 90 days.

Metadata is kept longer than content, because it is what billing and abuse prevention are built on. Billing records are kept for 24 months, which also covers our tax obligations. Abuse and security records, such as bounce and complaint rates and suspension history, are kept for 12 months.

Suppression lists and domain settings are kept until you remove them or delete the account. Deleting your account removes its emails, domains, keys, webhook endpoints and suppressions, and releases your domains from our sending provider. Billing records are kept for the period above, because we are required to keep them; each invoice carries the billing name and address it was issued to, and nothing else about you stays with it. Abuse records are kept for their period above with the recipient addresses removed.

• Performance of a contract: running the service you signed up for, delivering your mail, showing you your logs and supporting you.
• Legitimate interests: keeping the platform secure, preventing abuse of our sending reputation, and improving the service. We balance those interests against your rights and use the least data that works.
• Legal obligation: keeping billing and tax records, and responding to lawful requests from authorities.

Where we act as your processor, our basis for handling recipient data is your instruction. Your own lawful basis for contacting those recipients is yours to hold, as set out in the Acceptable Use Policy.

We set one cookie: avelto_session. It keeps a signed-in dashboard user signed in, and it is strictly necessary for that. It is httpOnly, Secure and SameSite=Lax.

We set no analytics cookies, no advertising cookies and no tracking cookies. There is nothing to consent to, so there is no cookie banner on this site. Your browser also keeps one local preference for us, the light or dark theme you chose, which never leaves your device. When you enter a card on the billing page, the payment processor's fields set cookies of their own for fraud prevention; those are covered by its policy, and they are only loaded on that page.

We do not add open-tracking pixels or rewrite links for click tracking in the mail you send. What you send is what the recipient receives.

Under the UK GDPR you have the right of access, and the rights to rectification, erasure, restriction of processing, data portability and objection. You also have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect.

How to use them:

• Account holders can export everything held for the account from the dashboard, or from the API at GET /v1/account/export: the account, domains, every email with its content and events, suppressions and webhooks, as one JSON file.
• Account holders can erase a single recipient from the dashboard, or from the API at POST /v1/recipients/erase. That removes the address from emails, their events and the stored message content. A hashed entry stays on the suppression list, so nothing is sent to that address again without us holding the address itself.
• Account holders can delete the whole account from the dashboard. We hold it for seven days first and email the owner, so a mistake can be undone; after that the data is deleted.
• Suppression entries can be removed one at a time from the dashboard or with the API.
• Anyone else, including a recipient asking about their own data rather than a customer asking about theirs, should write to privacy@staging.avelto.dev. Recipients' data belongs to the customer who sent the mail, so we normally pass such a request to them and help them act on it.

Every one of those actions is recorded in an audit log against the account: what was done, by which credential, and when. We answer requests sent to the address above within 30 days, and tell you sooner if we need more information to identify the records.

We use a small number of sub-processors to run the service. They are listed, with what each one does and where it is, on the sub-processors page.

We give at least 30 days' notice before adding or replacing a sub-processor. Customers who object can tell us during that period, as set out in the data processing agreement.

Personal data stays in the European Economic Area. The United Kingdom benefits from an adequacy decision covering transfers of personal data from the EU to the UK, so data can move between our UK operations and our EU infrastructure.

If we ever add a sub-processor outside the EEA, the transfer would be covered by the UK International Data Transfer Agreement, or by the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment. We would give notice first, as described above.

What we do to protect this data is described on our security page: hashed API keys, encryption in transit, redacted logging, per-account isolation and signed webhook delivery.

We do not claim any certification or audit. We describe the controls we actually run, and we update that page when they change.

If you think we have handled your personal data badly, tell us first at privacy@staging.avelto.dev and we will try to put it right.

You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. Complaining to us first is not a condition of complaining to them.

Privacy questions, data subject requests and sub-processor objections go to privacy@staging.avelto.dev.

The controller of account data is the business trading as Avelto, established in the United Kingdom. Registered business details are available on request from support@staging.avelto.dev, and will be published on this page once the entity is confirmed.

We have not appointed a data protection officer, and this policy does not claim any certification.

We may update this policy. The date at the top shows when it last changed, and material changes are announced by email to account holders.