Privacy Policy

This policy explains what personal data Postbud collects, why, who it is shared with, how long it is kept and what rights you have. We have tried to write it plainly. If anything is unclear, write to info@postbud.email.

1. Who we are, and our two roles

Postbud (postbud.email) is an email marketing service. Contact: info@postbud.email.

We handle personal data in two different roles:

• As controller for data about our own customers (people with a Postbud account), visitors to our website and people who contact us. This policy covers that data.
• As processor for the contacts our customers upload or collect (their subscribers). For that data the customer is the controller and decides what happens to it; we process it only on their instructions, under the data processing terms in our Terms of Service. Section 9 below explains this for subscribers.

2. What we collect

Your account

• Name, email address and password (stored only as a one-way hash).
• If you sign in with Google: your Google account ID, name, email address and profile picture. We do not get access to your Google mailbox or files.
• Your workspaces (organizations), their names and logos, and your role in each.
• Whether your email address is verified, and when the account was created.

Billing

• Payments are handled by Stripe. We never see or store your full card number. We keep your plan, subscription status and copies of your invoices (amounts, dates, billing name and address as entered at Stripe checkout).

What you put into Postbud

• Campaigns, templates, images, forms, landing pages, automations, segments, sending domains, API keys and integration settings. Images are stored with our image host.

Technical data

• Server logs, which include your IP address and the request made. For API keys we keep the IP address that last used each key, so you can spot misuse.
• Google reCAPTCHA runs on the sign-in, sign-up and password reset pages to stop automated abuse. Google receives your IP address and information about your browser and how you interact with the page.

Cookies and similar storage

• Strictly necessary: a sign-in cookie (postbud_rt, valid for up to 30 days) that keeps you logged in, and browser storage for your session, active workspace and display preferences. These are needed for the service to work and are set without asking.
• Analytics on our public pages (only with your consent): Microsoft Clarity, which records clicks, scrolling and page interactions on our homepage and pricing page so we can improve them. It sets cookies, so it only starts after you click “Allow” in the banner. It never runs inside the dashboard, on sign-in pages or on our customers' landing pages.
• Vercel Analytics: counts page views on our public pages without cookies and without identifying you.

To change your analytics choice, clear this site's data in your browser; the banner will ask again.

When you contact us

• Your email and whatever you write to us.

3. Why we use it, and on what legal basis

We do not sell personal data, and we do not use it for advertising profiles.

4. Who we share it with

We use these service providers (sub-processors) to run Postbud. Each gets only what it needs for its job and is bound by a data processing agreement.

If you connect an integration (for example WordPress, Zapier or your own webhook URL), Postbud sends the data you configured to that destination. You choose those connections; the receiving service handles the data under its own terms.

We may also disclose data when the law requires it, or to protect our rights, our users or the public from fraud or abuse.

5. International transfers

Several of the providers above are based in the United States, so personal data may be processed outside the European Economic Area. Where that happens, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Account data: for as long as your account exists. If you ask us to delete your account, we delete it and your workspaces' data within 30 days.
• Invoices and billing records: for as long as accounting and tax law requires, even after the account is deleted.
• Sending logs (who was sent which email, opens and clicks): 90 days, then deleted automatically.
• Suppression list entries (addresses that bounced, complained or unsubscribed): kept so those people are not emailed again; a temporary soft bounce expires after 72 hours.
• Expired or cancelled accounts: data is kept so you can come back, until you ask us to delete it. We may delete accounts that have had no paid plan and no activity for more than 12 months, after emailing you first.
• Backups and server logs held by our hosting providers may keep copies for a limited time after deletion, and are overwritten in their normal cycle.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Most account details can be changed in Settings; for anything else, email info@postbud.email from your account's address. We answer within one month.

You can also complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs); in the EU, the authority of the country where you live or work.

8. Security

Passwords are hashed, all traffic is encrypted in transit, the sign-in cookie cannot be read by page scripts, and access to customer data is limited to what running and supporting the service needs. Our staff can view account data and, to help with a support request or investigate abuse, open an account as its user; that access is time-limited, logged and cannot send campaigns or change billing. No system is perfectly secure; if a breach affects your data, we will tell you and, where required, the authorities.

9. If you received an email sent with Postbud

Our customers use Postbud to send emails to their own contacts. If you received one, the sender is the controller of your data and decided to email you; Postbud processes your data on their behalf. For that data:

• The sender may have stored your email address, name, tags, custom fields and, for online shops, what you bought or viewed in their store. If you filled in a form with a consent checkbox, we store the consent text, time and the IP address it was given from.
• Emails may contain a tracking pixel and tracked links, so the sender can see whether an email was opened and which links were clicked. We record that an open or click happened and when; we do not record your IP address or device for this.
• Links in marketing emails may carry UTM parameters (for example utm_source=newsletter), so the sender's website can tell that a visit came from the newsletter.
• Every marketing email has an unsubscribe link. Using it stops further marketing emails from that sender immediately.
• To access, correct or delete your data, contact the sender. If you cannot reach them, email us and we will pass your request on.

10. Children

Postbud is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.

11. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we use your data, we will tell customers by email before it takes effect.

12. Contact

Postbud. Email: info@postbud.email.