This Policy explains how Postal (postal.so) handles personal data, in accordance with Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD).
1. Roles
- Your account data: Postal is the controller.
- Your contacts' and recipients' data (including data collected through your forms): you, the customer, are the controller, and Postal acts as the processor, handling this data only to perform the service you request.
2. Data we process
- Account: name, email, password (stored only as a hash) and team name.
- Service usage: registered domains, API keys (stored only as a hash), webhook settings and access logs, such as IP address and the date and time of requests.
- Emails sent: sender, recipients, subject, content, attachments, tags and delivery events (delivered, bounce, complaint, failure).
- Suppression list: addresses that had a permanent bounce or a complaint, to prevent further sends.
- Audience and forms: contacts (email, name and the properties you define), segments, topics, form responses and the record of consent and unsubscribe (date, time and IP address).
- Engagement: when tracking is on, opens and clicks, with the date, time, IP address and browser of the person who opened or clicked.
- Payments: plan, invoices and subscription status. Card data is handled directly by the payment processor and does not stay with Postal.
- AI assistant: the text you send to the assistant and the generated replies.
3. What we use it for
- providing the service: authenticating you, verifying domains, sending emails, managing your audience and forms, and reporting the result of each send;
- protecting the platform and recipients: preventing spam, fraud and abuse and maintaining sending reputation;
- communicating with you about your account, such as password recovery, security notices, usage alerts and changes to the service;
- billing paid plans and issuing invoices;
- measure the use of this site and the results of our ads, with Google Analytics and Google Ads (see section 8);
- meeting legal and regulatory obligations.
The legal bases are performance of the contract, legitimate interest (security and abuse prevention) and compliance with a legal obligation. We do not sell personal data, and we do not use the content of your emails or your contacts' data for advertising or to train AI models.
4. Who we share it with
We use infrastructure providers that process data on our behalf:
- email infrastructure provider: processing and delivery of emails, in the region chosen for each domain (São Paulo, in Brazil, or regions in the United States, Ireland and Japan);
- DNS and network protection provider: name resolution and protection against attacks;
- hosting provider for the application servers and the database;
- payment processor: billing for paid plans;
- artificial intelligence provider: processing of the text sent to the AI assistant, only when you use it;
- Google (Google Analytics and Google Ads): visit statistics of this site and measurement of the conversions of our ads, through the Google tag on this site and at account creation in the dashboard (see section 8).
Emails also naturally pass through the recipients' providers' servers. We may share data when required by law or by order of a competent authority.
5. International transfer
When a domain uses a region outside Brazil, emails are processed in the country of that region (United States, Ireland or Japan). Payment processing, the AI assistant and ad measurement may also take place outside Brazil. In these cases, we use providers with adequate data protection safeguards, as provided in art. 33 of the LGPD.
6. Retention
We keep data while the account is active and for as long as needed to provide the service, resolve disputes and meet legal obligations. When you close the account, we delete or anonymize the data, except what we must keep by law. The record that you accepted the rules of use (version, date, IP and browser) is kept for up to 5 years after the account is closed, to answer payment disputes and complaints.
7. Security
- encrypted connections (HTTPS and TLS);
- passwords and API keys stored only as a hash; DKIM private keys encrypted in the database;
- restricted access to the infrastructure and least-privilege permissions on cloud services;
- signed webhooks and blocking of internal network addresses.
8. Cookies
This site (postal.so) loads the Google tag, with Google Analytics, for visit statistics, and Google Ads, to measure the conversions of our ads. It sets analytics and advertising cookies in your browser, such as _ga and _gcl_au, and the visit data (pages viewed, ad click, IP address and browser) is processed by Google under its own policies. See how Google uses advertising cookies.
The dashboard (app.postal.so) uses essential session cookies and CSRF protection cookies, needed for login. Right after an account is created, it reports that conversion (the sign-up) to Google Ads through the same tag, which may also set Google advertising cookies. The public form pages do not use tracking cookies.
You can block or delete these cookies in your browser settings.
9. Your rights
You can request confirmation of processing, access, correction, anonymization, portability or deletion of your data, as well as information about sharing and the withdrawal of consent, where applicable. Send your request through our contact form, with the subject “Privacy”.
If you received an email sent by a Postal customer, the controller of your data is the company that sent the message. Contact them first. If needed, we will forward your request to them.
10. Changes and contact
We may update this Policy. The current version is always on this page, with the date of the last update. To reach the data protection officer, use the same contact form, with the subject “Privacy”.