DRAFT — requires review by a qualified lawyer before publication. This text was prepared as a working draft. It has not been reviewed for any specific jurisdiction. Items in [SQUARE BRACKETS] must be completed or decided before publication. Depending on where the company is established, additional local-law sections may be required (for example Turkey’s KVKK, or a GDPR Article 27 representative if the company is outside the EU).
Last updated: [DATE]
This Privacy Policy explains how [COMPANY LEGAL NAME] (“Postfaro”, “we”, “us”) handles personal data. We have written it in plain language. If anything is unclear, contact us at [PRIVACY EMAIL].
1. Who this policy covers
| You are… | Our role | Where to read about it |
|---|---|---|
| A visitor to postfaro.com, or a user of our free domain checker | Controller | This policy |
| A customer (or a team member of a customer) with a Postfaro account | Controller | This policy |
| A recipient of an email that one of our customers sent through Postfaro | Processor for our customer (the customer is the controller) | Section 8 of this policy and our Data Processing Agreement |
2. Who we are
Controller: [COMPANY LEGAL NAME], [ADDRESS], registered in [JURISDICTION] under number [REGISTRATION NUMBER]. Privacy contact: [PRIVACY EMAIL] Data protection officer: [NAME / “We have not appointed a DPO because we are not required to.” — DECIDE] EU representative (GDPR Art. 27): [NAME AND ADDRESS — required if the company is established outside the EU and offers services to people in the EU] UK representative: [NAME AND ADDRESS — if applicable]
3. What we collect and why
3.1 Website visitors
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Technical data your browser sends (IP address, browser type, pages requested, time) in server logs | Running and securing the website | Legitimate interests (security, operation) | [e.g. 14 days] |
| Cookie data | See the Cookie Policy | Consent, or legitimate interests for strictly necessary cookies | See Cookie Policy |
| Messages you send us via a contact form or email | Answering you | Legitimate interests, or steps before a contract | [e.g. 2 years after last contact] |
3.2 Free domain checker
You enter a domain name. We look up its public DNS records (for example SPF, DKIM, DMARC and MX) and show you a report. We do not ask for an email address to show the report. We log the domain checked, the time and your IP address [CONFIRM] to prevent abuse of the tool, and keep this for [e.g. 30 days]. A domain name on its own is usually not personal data, but it can be when it relates to an individual. Legal basis: legitimate interests (providing the tool, preventing abuse).
3.3 Customers
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email address, password (stored hashed), two-step login data, language | Creating and securing your account | Contract | Life of the account + [e.g. 90 days] |
| Company name, billing address, VAT number | Billing, tax compliance | Contract, legal obligation | As required by tax law [e.g. 10 years] |
| Domain registrant details (Path A): name, organisation, address, email, phone | Registering your domain in your name with the registrar and registry, as required by ICANN rules | Contract, legal obligation (registry rules) | For the life of the registration and as required by registrar/registry rules |
| Sending configuration: sender addresses, reply-forwarding addresses, DNS records you add | Providing the Service | Contract | Life of the account |
| Usage data: number of emails sent, queued, bounced and complained, per day and per sender address; panel activity logs; DNS change logs | Providing the Service, enforcing limits, security, preventing abuse | Contract, legitimate interests | [e.g. 13 months] |
| Support conversations | Helping you | Contract, legitimate interests | [e.g. 2 years after closing] |
| Records of consent to our terms and policies | Proving what you agreed to | Legal obligation, legitimate interests | Life of the account + [limitation period] |
Payment data: Payments are handled by Paddle, which acts as Merchant of Record (the seller of record) and processes payment data as an independent controller under its own privacy notice: [LINK TO PADDLE PRIVACY NOTICE]. We never see or store your full card number. Paddle shares with us the information we need to manage your subscription (for example your name, email, country, the plan bought, payment status and invoices).
3.4 Emails we send you
We send service emails that are part of the contract (for example account verification, setup progress, queue summaries, pause notices, payment and renewal notices). You cannot opt out of these while you have an account, because they are necessary to run the Service.
We send product news or marketing emails only if you opted in, or where the law allows us to contact existing customers about similar services. Every such email has an unsubscribe link. [DECIDE whether there will be marketing emails at all.]
4. Who we share data with
We do not sell personal data. We share it only with service providers who help us run Postfaro, under contracts that require them to protect it:
| Provider | What they do | Location |
|---|---|---|
| [HOSTING PROVIDER NAME] | Hosts our servers (panel, database, sending servers, DNS) | Turkey |
| Paddle (Paddle.com Market Ltd and affiliates) | Checkout, payments, invoicing, tax (independent controller) | [UK / EU / US — check Paddle DPA] |
| Openprovider ([LEGAL ENTITY]) | Domain registration for Path A customers | Netherlands [CONFIRM] |
| Domain registries (e.g. Verisign for .com/.net) | Registry operation; receive registrant data required by ICANN | [US] |
| [SECONDARY DNS PROVIDER] | Secondary (backup) DNS servers — public DNS data only | [LOCATION] |
| [BACKUP STORAGE PROVIDER] | Encrypted off-site backups | [LOCATION] |
| [MONITORING PROVIDER] | External uptime monitoring | [LOCATION] |
| [EMAIL PROVIDER FOR OUR OWN MAIL] | Our own corporate and support email | [LOCATION] |
| [Optional] Amazon Web Services (Amazon SES) and/or Brevo | Fallback sending capacity, used only during the warm-up period if our own capacity is temporarily insufficient | [EU/US] |
| [Optional] [AI CONTENT-CHECK PROVIDER] | Automated phishing / spam classification of message content | [LOCATION] — [CONFIRM WHETHER A THIRD PARTY IS USED AT ALL] |
We may also disclose data if required by law, to respond to valid legal requests, to protect our rights or the safety of others, or as part of a merger or sale of our business (with notice to you).
5. International transfers
Our main servers are located in Turkey. Turkey is not currently covered by an adequacy decision of the European Commission or the UK. When we transfer personal data from the EU/EEA or UK to Turkey or other countries without adequacy, we use appropriate safeguards — normally the European Commission’s Standard Contractual Clauses (and the UK Addendum) — together with additional technical measures such as encryption in transit. [CONFIRM TRANSFER MECHANISM AND TRANSFER IMPACT ASSESSMENT. ALSO CHECK TURKISH KVKK RULES ON TRANSFERS ABROAD IF THE COMPANY IS IN TURKEY.] You can ask us for a copy of the safeguards at [PRIVACY EMAIL].
6. How we protect data
- Encrypted connections (TLS) for the website, the panel and SMTP submission.
- Passwords and SMTP credentials stored only as hashes; SMTP passwords are shown to you once.
- Two-step login available for the customer panel.
- Access to production systems limited to staff who need it, with logging.
- Encrypted backups stored in a separate location.
- Separation between our brand domain and our sending infrastructure.
No system is completely secure. If a personal data breach affects you, we will tell you and the authorities where the law requires.
7. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data (“right to be forgotten”);
- restrict or object to certain processing, including processing based on legitimate interests and any direct marketing;
- data portability (receive your data in a machine-readable format);
- withdraw consent at any time, where we rely on consent;
- complain to a data protection authority — for example the authority in the EU country where you live or work. [LIST LEAD AUTHORITY ONCE THE COMPANY LOCATION IS KNOWN.]
You can delete your account yourself in the customer panel, or contact [PRIVACY EMAIL]. We answer within one month (which may be extended where the law allows). We may need to verify your identity.
Some data must be kept even after you ask for deletion — for example invoices (tax law) and domain registration records (registry rules).
California and other US states: We do not sell or “share” personal information as those terms are defined in US state privacy laws. [LAWYER TO CONFIRM WHETHER A US STATE-LAW SECTION IS REQUIRED.]
8. If you received an email sent through Postfaro
Our customers use Postfaro to send email to people on their own lists. For that email, the customer is the controller — they decided to email you and they hold your address in their own systems. Postfaro acts only as their processor (service provider).
What this means for you:
- To unsubscribe: use the unsubscribe link in the email, or the “Unsubscribe” button your email app shows. We stop delivering that sender’s bulk email to your address.
- To ask how the sender got your address, or to exercise your other rights: contact the sender directly — their details must be in the email.
- What Postfaro keeps: We process your address and the message only to deliver it (including while it waits in the sending queue). The only information about you we keep long-term is your address on a do-not-mail list, if you unsubscribed, marked a message as spam, or your address bounced — so that we can stop further email to you. [CONFIRM: retention period of delivery logs that contain recipient addresses, e.g. “Technical delivery logs are deleted after [X] days.”]
- Shared do-not-mail list: In certain cases (for example, an address that does not exist, or a spam trap), we keep an address on a do-not-mail list that applies to all our customers, to protect recipients and our infrastructure. We do this on the basis of our legitimate interests. [LAWYER TO CONFIRM CONTROLLER ROLE FOR THE SHARED LIST AND DEFINE CRITERIA.]
- To report unwanted email: write to [ABUSE EMAIL].
If you contact us about an email a customer sent, we may forward your request to that customer.
9. Children
Postfaro is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16.
10. Changes
We will post any changes on this page and update the “Last updated” date. If a change is significant, we will tell customers by email.
11. Contact
[COMPANY LEGAL NAME] [ADDRESS] Privacy: [PRIVACY EMAIL]