GDPR

This page explains how we operate. It is not legal advice. If you process personal data of people in the EU or UK, take your own advice on what your obligations are.

Who is responsible for what

There are two different relationships here, and the distinction decides who is answerable for what.

• For your account data — your name, email, billing details, and how you use the dashboard — we are the data controller.
• For your contacts and the emails you send, we are a data processor. You are the controller. You decide who is on your lists and what you send them; we act on your instructions. That also means the lawful basis for emailing those people is yours to establish, not ours.

What we process, and why

• Account data — to give you access, bill you, and provide support. Lawful basis: performance of a contract.
• Contact data you upload — email addresses, names and any custom fields you add, processed solely to deliver the mail you send.
• Delivery and engagement data — sends, bounces, complaints, opens and clicks. We need this to run suppression lists and protect sending reputation, which is a legitimate interest of both of us.
• Analytics — only with your consent. See the Cookie Policy.

Subprocessors

We use a small number of providers to run the service:

• Contabo GmbH — server hosting in Germany. The application, the database and the mail servers that deliver your campaigns all run there. Email delivery is operated by us rather than by a third party, so the contents of your campaigns and your contact lists are not passed to another provider in order to send them.
• Stripe — payment processing. Card details go to Stripe directly; we never see or store them.
• Resend — system emails such as verification and password resets.
• Google Analytics — website analytics, consent-gated.

We will tell you before adding a subprocessor that handles your contact data, so you have a chance to object.

International transfers

Our own infrastructure runs in Germany. Your account data, your contact lists and the campaigns you send are stored and processed there, within the EEA.

Some of the supporting services listed above are based in the United States — payment processing, system notification email and website analytics. Personal data reaching those providers leaves the EEA, and those transfers rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with the providers' own transfer mechanisms.

Retention

• Contacts — kept until you delete them or close your account.
• Email logs and engagement data — kept for the retention period on your plan, then deleted.
• Suppression list — kept indefinitely on purpose. It is the record of who asked not to be emailed, and deleting it would mean mailing them again.
• Account and billing records — kept while your account is open, then for as long as tax and accounting law requires.

Your rights

If you are in the EU or UK you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. We do not make automated decisions with legal effects.

Email privacy@pigeonify.com and we will respond within 30 days. You can also complain to your local supervisory authority — in the UK, the Information Commissioner's Office.

If you are a recipient of email sent through Pigeonify rather than a customer, contact the company that emailed you — they are the controller and hold the data. Unsubscribing through the link in any message stops further email from that sender immediately.

Security

• Encryption in transit (TLS) everywhere, including SMTP submission.
• Passwords hashed with bcrypt; API keys stored only as SHA-256 hashes.
• Sessions are signed, expire after 30 days, and can be revoked.
• Rate limiting on authentication and sending endpoints.

Data processing agreement

If you need a signed DPA, email privacy@pigeonify.com and we will send one over.

Breach notification

If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours of becoming aware, and tell you without undue delay where the risk to individuals is high.