Privacy and LGPD
Your data and your contacts' data, made clear
See who is responsible for each piece of data, where it is stored, for how long and what you control in the dashboard. This page summarizes our Privacy Policy.
- Account data: Postal is the controller
- Contact data: you are the controller
- Data subject requests through the contact form
Summary
The essentials, in a few lines
You control your contacts' data
For your account data, Postal is the controller. For the data of your contacts and recipients, including those who arrive through your forms, you are the controller and Postal is the processor.
One region per domain
São Paulo is the default. You can also choose regions in the United States, Ireland and Japan.
Short retention in the logs
Emails, webhook deliveries and API logs are deleted after 30 days.
for emails, webhooks and logs
Your rights
Access, correction, anonymization, portability, deletion and more: request it through the contact form.
Security
Passwords and API keys stored only as hashes, encrypted connections and two-step verification.
Consent and unsubscribe
Forms store the date, time and IP of whoever agreed. Every broadcast and automation carries the unsubscribe link.
What you control
Export, delete contacts, delete the team or close the account whenever you need.
This page summarizes the Privacy Policy (last updated: November 2, 2026) and the Terms of Use. Those two texts are the legal document: if there is any difference, what they say prevails.
Who is who
Roles depend on where the data comes from. For your account data, Postal is the controller. For your contacts' and recipients' data, including data collected by your forms, you are the controller and Postal acts as the processor, handling that data only to run the service you ask for.
- Postal does not sell personal data and does not use the content of your emails or your contacts' data for advertising or to train AI models
- You are responsible for the content, the questions and the consent text of your forms, and for telling people how their data will be used
- Anyone who received an email sent by a Postal customer should contact the company that sent it first: it is the controller of that data
Where the data lives
You choose the region of each domain when you add it. São Paulo is the default region, and emails from domains in it are processed in Brazil.
- When a domain uses a region outside Brazil, emails are processed in the country of that region
- Payment processing and the AI assistant may also happen outside Brazil
- In those cases, we use providers with adequate data protection safeguards, in accordance with art. 33 of the LGPD
| Region | Where it is |
|---|---|
sa-east-1 | São Paulo, Brazil (default) |
us-east-1 | Northern Virginia, United States |
us-east-2 | Ohio, United States |
eu-west-1 | Ireland |
ap-northeast-1 | Tokyo, Japan |
What we keep and for how long
We keep data while the account is active and for as long as needed to provide the service, resolve disputes and meet legal obligations. Some usage records have a short retention period and are deleted automatically.
- When you close the account, we delete or anonymize the data, except what we must keep by law
- Open and click tracking is off by default and is your choice for each domain
| Data | How long |
|---|---|
| Account data: name, email and team name | While the account is active |
| Contacts, segments, form responses and consent records | While the account is active, or until you delete them |
| Emails sent and received, with attachments and delivery events | 30 days |
| Webhook deliveries and API logs | 30 days |
| Events your system sends to Postal | 90 days |
| Export files | 7 days |
What you control
The dashboard and the API have what you need to handle requests from your contacts and to take your data out of Postal.
- Export emails, domains, logs, API keys, the suppression list, contacts and form responses as CSV, on plans that include exports
- Delete a contact through the dashboard or the API
- View, add and remove addresses on the suppression list
- Delete the team, which erases the domains, API keys, emails, webhooks and logs and cannot be undone; only the owner can, by typing the team name
- Delete the account, which erases the account, the photo and the sessions; first leave your teams or delete the ones you own
Consent and unsubscribe
To send marketing, you need the recipient's consent and proof of it. Postal helps you store and respect what each person chose.
- In forms, the consent checkbox carries the text you write, and Postal records the date, time and IP of whoever agreed
- With email confirmation (double opt-in), the person joins the audience only after clicking the link
- Every broadcast and automation email carries the unsubscribe link and one-click unsubscribe; the preferences page lets the person leave everything or just one topic
- Anyone who unsubscribes stops receiving broadcasts and automations, and addresses with a permanent bounce or complaint are left out of all sends
- Purchased, rented or automatically scraped lists are not allowed by the Terms of Use
Your rights as a data subject
You can request confirmation of processing, access, correction, anonymization, portability or deletion of your data, as well as information about sharing and the withdrawal of consent, where applicable. Send your request through the contact form, with the subject “Privacy”. We reply by email.
- If your request is about an email you received from a Postal customer, contact the company that sent it first; if needed, we forward your request to them
- To reach the data protection officer, use the same form, with the subject “Privacy”
Security and cookies
These are the measures described in the Privacy Policy, in addition to what the dashboard offers to protect your account.
- Encrypted connections (HTTPS and TLS)
- Passwords and API keys stored only as hashes; the API key is shown in full only once, when it is created
- DKIM private keys encrypted in the database
- Signed webhooks and blocking of internal network addresses
- Two-step verification with an authenticator app and recovery codes, a list of sessions and email alerts for sign-ins from a new device
- The dashboard uses essential session cookies and CSRF protection cookies, and the public form pages do not use tracking cookies
- This site loads the Google tag (Google Analytics and Google Ads), which sets analytics and advertising cookies for visit statistics and to measure the conversions of our ads; the dashboard tells Google Ads when an account is created
Who we share with
We use infrastructure providers that process data on our behalf. The Privacy Policy lists them by type of service:
- Email infrastructure: processing and delivery, in the region chosen for each domain
- DNS and network protection
- Hosting of the application servers and the database
- Payment processing
- Artificial intelligence, which processes the text sent to the assistant only when you use it
- Google (Google Analytics and Google Ads), which measures the visits to this site and the conversions of our ads
- Emails also pass through the recipients' providers' servers, and we may share data when the law or a competent authority requires it
Still have a privacy question?
Talk to us through the contact form. We reply by email.