1Two roles
For your account, you as our customer, we are the controller: we decide why and how your data is used.
For your subscribers, you are the controller and we are your processor: we store and use their data only to run MailCheap for you, on your instructions. If you get a newsletter sent with MailCheap, contact its sender first; we pass on the requests we get.
2What we collect about you
- Account: your email address, and your name and picture if you add them or sign in with Google.
- Billing: your plan, your subscription's status and your Stripe customer ID. Stripe collects your card and billing details; we never see your card number.
- Sign-ins and security: your IP address and browser when you sign in, kept with your session and sent to us in a sign-in alert. IP addresses also count toward rate limits.
- Your newsletter: its settings, sender name and address, postal address, domains, campaigns, uploaded images and API keys, which we store hashed.
- Usage: how many emails you sent this month, and server logs our hosting keeps for a short time.
- Emails with us: what you write to hello@mailcheap.ai.
3What we process about your subscribers
- Their email address, their status (subscribed, waiting for confirmation, unsubscribed, bounced or complained), and where and when they signed up.
- For contacts you import: the consent you confirmed, and the engagement numbers from your previous platform if your file has them.
- What happens to each email: delivered, opened, clicked, bounced or marked as spam. Opens are counted with a small image in each email, clicks through a redirect link.
- Unsubscribed and suppressed addresses, so nobody who left or bounced gets your emails again.
4Why we use it
- To run your account and send your newsletter: our contract with you.
- To bill you: our contract, and the law for invoices.
- To keep MailCheap safe and stop abuse, with rate limits, sign-in alerts and bounce and complaint checks: our legitimate interest in a service that works for every customer.
- To email you about your account: sign-in codes, billing, paused sending and changes to these policies.
We don't sell personal data, and we don't use your subscribers' data for anything but your newsletter.
6Who processes it
These providers process personal data for us, only to run MailCheap:
- Amazon Web Services and PostShiba: Email delivery: they send your emails and report deliveries, bounces and complaints.
- MongoDB Atlas: Our database: accounts, newsletters, contacts, campaigns and email events.
- Vercel: Hosting for the dashboard, the API and web archives, and storage for uploaded images.
- Stripe: Payments, invoices and the billing portal.
- Upstash: Background sending and scheduling (QStash), and rate limits (Redis).
- Resend: Sign-in codes and emails about your account.
- DataFast: Analytics: it counts visits to mailcheap.ai and the steps from signing up to paying, and never runs on newsletters' archives or emails.
They may process data in the United States and other countries. We rely on their data protection terms, including standard contractual clauses where those apply. We also share data when the law requires it.
7How long we keep it
- Account and subscriber data: while your account exists, including after your plan ends, until you ask us to delete it. We delete it within 30 days of your request.
- Invoices and payment records: as long as the law requires, usually 5 years in Singapore.
- After your account is deleted: a hash of your email and the dates, so abuse can be noticed. Stripe keeps its billing records.
- Server logs: a short time, then our hosting deletes them.
8Your rights
You can see, correct, export or delete your data, object to how we use it, or ask us to limit it. Most of it is in your dashboard; for the rest, email hello@mailcheap.ai and we answer within 30 days.
You can also complain to a data protection authority: in Singapore, the Personal Data Protection Commission; in the EU or the UK, the authority where you live.
Subscribers can unsubscribe with the link in any email. For anything else, contact the newsletter's sender; if you write to us, we pass it on.
9Security
Data travels over HTTPS. API keys are stored hashed, and the links in emails are signed. Every customer's data is scoped to their account. Only the people who run MailCheap can reach production data, and only to run it.
10Children
MailCheap is for people 18 and older. We don't knowingly collect data about children.
11Changes
We post changes to this policy here, and email you about the ones that matter before they take effect.