Privacy Policy

This Privacy Policy explains how Mailsurge (“Mailsurge,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use our website, control panel, and transactional email API (the “Service”).

Questions about this policy or your data: mailsurge@vblinden.dev.

1. Who we are

Mailsurge is operated by vblinden. Contact: mailsurge@vblinden.dev.

2. Information we collect

We collect information in these categories:

• Account data — name, email address, password (stored hashed), and account status (for example verification, approval, or block reason).
• Team data — team profile details and related account settings.
• Sending configuration — domains, DNS-related metadata, API keys (stored hashed), suppression lists, and related settings.
• Message and delivery data — content and metadata of emails you submit through the API (including recipients, subject, headers, and body), plus delivery events such as sends, deliveries, bounces, complaints, and opens or clicks where applicable. Sensitive message fields are encrypted at rest.
• Usage and technical data — API usage metrics, timestamps, IP addresses, user-agent strings, and logs needed to operate and secure the Service.
• Communications — messages you send us (for example support requests).

If you include personal data about third parties in messages you send through Mailsurge, you are the controller of that data. We process it as a processor on your instructions to deliver and operate the Service.

3. How we use information

We use information to:

• Provide, operate, and improve the Service
• Authenticate users, verify email addresses, and enforce approval and abuse controls
• Send transactional product emails (verification, password reset, and similar notices)
• Provision and verify sending domains and deliver messages via email infrastructure providers
• Track usage and prevent fraud or abuse
• Comply with law and respond to lawful requests
• Communicate about the Service, security, and policy changes

4. Legal bases (EEA/UK)

Where GDPR or UK GDPR applies, we process personal data on these bases:

• Contract — to provide the Service you request
• Legitimate interests — to secure, improve, and administer the Service, and to prevent abuse, balanced against your rights
• Legal obligation — where we must retain or disclose information to comply with law
• Consent — where we ask for it and you give it (withdrawable at any time)

5. Sharing and subprocessors

We do not sell personal data. We share information with service providers that help us run Mailsurge, under appropriate agreements:

• Amazon Web Services (SES / SNS) — email delivery, account emails (verification and password reset), and delivery event notifications
• Vercel — application hosting, queues, and related infrastructure
• Turso — database hosting

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale (with notice where appropriate).

6. Retention

Message content and related delivery events are retained for a limited period for debugging, analytics, and support — typically 28 days — then deleted automatically, unless a longer period is required for security, dispute, or legal reasons.

Account, team, domain, API key metadata, and suppression data are kept for as long as your account remains active and as needed to operate the Service, meet legal obligations, and resolve disputes. You may request deletion of your account as described below.

7. Security

We use industry-standard measures appropriate to the Service, including encryption of sensitive fields at rest, hashed API keys, verified delivery webhooks from our email providers, and access controls for the control panel. No method of transmission or storage is completely secure; please protect your credentials and API keys.

To report a security vulnerability, email mailsurge@vblinden.dev.

8. International transfers

We and our providers may process data in the European Union, the United States, and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms offered by our providers.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal data; to object to certain processing; to data portability; and to withdraw consent.

To exercise these rights, or to request account deletion, contact mailsurge@vblinden.dev. We may need to verify your identity before responding. You may also lodge a complaint with your local data protection authority.

If you use Mailsurge to process personal data of your end users or recipients, you are responsible for providing them any required notices and for handling their requests that relate to data you control.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact mailsurge@vblinden.dev so we can delete it.

11. Cookies and similar technologies

We use essential cookies and similar technologies for authentication and session security in the control panel. We do not use third-party advertising cookies on the marketing site. You can control cookies through your browser settings; disabling essential cookies may prevent sign-in.

12. Changes

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may also be communicated by email or in-product notice where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact

Privacy requests and questions: mailsurge@vblinden.dev.