Privacy Policy
Last updated: 28 October 2026
These terms are provided by Studio 404 d.o.o., Gradišče 15c, 1360 Vrhnika, Slovenia, EU, VAT ID SI42531357 ("SpacePost", "we", "us"), contact: legal@spacepost.dev.
1. Who is responsible
For data about our customers and website visitors (account holders, billing contacts, dashboard users), Studio 404 d.o.o. is the controller. For recipient and message data that you send through SpacePost, you are the controller and we are your processor; see the DPA. Contact for privacy matters: privacy@spacepost.dev or legal@spacepost.dev, Gradišče 15c, 1360 Vrhnika, Slovenia, EU.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account data: name, email, password hash, GitHub profile if you sign in with GitHub, team membership | Create and secure your account, authenticate you | Contract (1)(b) |
| Billing data: plan, invoices, tax details; card details are held by Stripe, not us | Charge and invoice you, comply with tax law | Contract; legal obligation (1)(c) |
| API usage and security logs: IP address, user agent, API key id (never the key), request metadata | Operate the service, rate limiting, fraud and abuse prevention, debugging | Legitimate interests (1)(f) |
| Email logs and events that you create via the API: recipients, subject, status and delivery events, message content you submit | Deliver messages and show them to you (as processor) | On your instructions; see DPA |
| Website analytics | None. This marketing site sets no tracking cookies and runs no third-party analytics. | n/a |
| Support correspondence, including the support chat if you open it: your messages and attachments, a random visitor ID, browser language, time zone and the page you are on; if you are signed in to the dashboard, also your name, email address, user ID and team (name, plan, trust level) | Answer your questions | Legitimate interests; contract |
| Customer record (CRM): your name, email address and user ID, your team's name, plan, trust level, number of domains and a rough monthly sending volume, and account milestones (sign-up, email verified, team created, domain added or verified, API key created with its permission, first email sent, plan changes, payments and failed payments with the amount, a team paused by our reputation guard, trust level promotions) | Help you when you contact support, know where you are in getting started, follow up on failed payments, keep a record of our customers | Contract (1)(b); legitimate interests (1)(f) |
We do not sell personal data and do not use Customer Data to build advertising profiles or to train AI models.
Support chat and customer record. Both run on HAL (chatwithhal.com), our own support chat and CRM product. The CRM never receives API keys, the content or recipients of your emails, card data, passwords or your billing address.
3. Cookies
The marketing site uses no cookies. The dashboard sets strictly necessary session cookies to keep you signed in, which do not require consent.
Support chat. The "Chat with support" button on the website, the docs and the dashboard is ours. Nothing from HAL is loaded, stored or contacted until you click it, so you can use the site without any of it; you asked for the chat, so no separate consent is needed. When you click it, we load the chat from api.chatwithhal.com. It sets no cookies. It stores a random visitor ID (hal_visitor_…) and whether the chat is open (hal_widget_open_…) in your browser's local storage so that your conversation continues, and talks to HAL's servers; if you chatted before, the chat loads again on later visits to show your conversation. In the dashboard we also tell the chat who you are (name, email address, user ID, team), with a signature made by our server so that nobody else can pose as you, and keep your user ID in local storage (hal_identified_user) so the chat is disconnected from your account when you sign out.
4. Who we share data with
We use a small number of sub-processors, listed with their purpose and location on the sub-processors page: Amazon Web Services (email delivery), Stripe (payments), Railway (hosting), and GitHub if you choose GitHub sign-in. We may disclose data when legally required, to protect rights and safety, or in a business transfer, with notice to you.
5. International transfers
Email is sent through AWS in Frankfurt (eu-central-1). Some providers (for example Stripe, Railway or GitHub) may process data outside the EEA, including in the United States. Where they do, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses and additional safeguards.
6. Retention
- Email logs and delivery events are kept for 30 days (Free), 30 days (Pro) or 60 days (Scale), then deleted automatically.
- Suppression list entries are kept while your account is active so that we do not send to recipients who bounced or complained.
- Account data is kept while your account is active and deleted within 30 days of account deletion, except billing records, which we keep as long as the law requires (in Slovenia, generally 10 years). Invoices are issued with our own invoicing service, Space Invoices (a Studio 404 product), and stored there for the legally required retention period (10 years in Slovenia).
- Backups roll off within 35 days.
7. Security
We use TLS in transit, encryption at rest, hashed API keys and passwords, and access controls. See Security. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as required.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to processing of your data, to data portability, and to withdraw consent where processing is consent-based. To exercise these rights write to privacy@spacepost.dev. If you are a recipient of an email sent by one of our customers, please contact the sender first, since they decide why that data is processed; we will help them respond. You can also lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec) or your local supervisory authority.
9. Children
The Service is not directed at anyone under 18 and we do not knowingly collect their data.
10. Changes
We will post updates here and, for material changes, notify account holders by email.