Privacy Policy
Last updated 14 November 2026
This Privacy Policy explains how Postwaves ("we", "us"), of United Kingdom, collects and uses personal data when you visit https://postwaves.online or use Postwave (the "Service"). We are the controller of the personal data described in sections 1–6. For the emails, contacts and other data our customers send or receive through the Service, our customer is the controller and we act as their processor (see section 7).
1. Data we collect
- Account data: your name, email address, company name, password (stored only as a secure hash) or the profile details you share if you sign in with Google or GitHub.
- Billing data: plan, invoices and billing address. Card details are collected and stored by our payment processor, Stripe; we never see your full card number.
- Usage data: API requests and responses, log-in events, IP addresses, browser type, and how you use the dashboard, used for security, troubleshooting and usage-based billing.
- Support data: messages you send us and our replies.
- Cookies: we use strictly necessary cookies to keep you signed in and remember your theme preference. We do not use advertising cookies or third-party tracking.
2. How and why we use it
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and providing the Service | Contract |
| Billing, invoicing and collecting overage charges | Contract; legal obligation (tax records) |
| Keeping the Service secure, preventing abuse and spam, and enforcing our Terms | Legitimate interests |
| Service emails such as login links, receipts and important changes | Contract; legitimate interests |
| Improving the Service using aggregated usage information | Legitimate interests |
| Product news, only if you opt in (you can unsubscribe at any time) | Consent |
3. Who we share it with
We do not sell personal data. We share it only with service providers that help us run the Service, under contracts that require them to protect it:
- Amazon Web Services (email sending and receiving, Amazon SES, London region)
- OVHcloud (server hosting)
- Cloudflare (DNS)
- Stripe (payments)
- Google and GitHub (only if you choose to sign in with them)
We may also disclose data if required by law, to protect our rights or users, or as part of a sale or reorganisation of our business.
4. International transfers
Some providers may process data outside the UK or European Economic Area. Where they do, we rely on adequacy regulations or the UK International Data Transfer Addendum / EU Standard Contractual Clauses to keep it protected.
5. How long we keep it
- Account and billing data: for as long as your account is open, then up to 6 years for tax and accounting records.
- Sent and received email data and events: for your plan's retention period (30 days, or 90 days on Enterprise), then deleted automatically.
- API logs and webhook delivery logs: 30 days.
- Suppression lists: kept while your account is open, so we don't email people who bounced or complained.
6. Your rights
Under UK and EU data protection law you can ask to access, correct or delete your personal data, restrict or object to how we use it, and receive a copy in a portable format. Where we rely on consent you can withdraw it at any time. Email privacy@postwaves.online and we will reply within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
7. Data our customers send through the Service
When customers use Postwave to send or receive email, the recipients' details and message contents belong to that customer, and we process them only on their instructions under our Terms. If you received an email sent through Postwave and want to know how your data is used or want it removed, please contact the sender directly. You can also email privacy@postwaves.online and we will pass your request on. Every marketing email sent through Postwave includes an unsubscribe link.
8. Security
We protect personal data with encryption in transit (TLS), hashed passwords and API keys, signed webhooks, access controls and regular backups. If a breach affects your personal data, we will tell you and the relevant authorities where required.
9. Changes
We will post any changes here and update the date above. For significant changes we will also notify account holders by email.
Contact
Postwaves, United Kingdom. Privacy questions: privacy@postwaves.online. General: support@postwaves.online