Held in trust.

For the personal data in the mail, messages and submissions you send and receive through Postboi, you're the controller and we're your processor. That's the data this addendum is about, and we call it your personal data below.

Some data we hold for ourselves: your team members' sign-in details, billing records, and what we need to stop abuse of the platform. For that data we're the controller, and the privacy policy covers it rather than this addendum.

If you connect a provider of your own on the Providers page (Resend, Twilio and the rest), your mail or texts go through your account with them. They're your processor, not our subprocessor, and your agreement with them governs what they do.

We process your personal data only on your documented instructions. Those are the terms, this addendum, and what you tell the service to do: the API calls you make, the settings you choose and the messages you send. We don't use your personal data for any other purpose, including training models or marketing.

If the law requires us to process it some other way, we'll tell you first, unless the law forbids that. If we think an instruction of yours breaks data protection law, we'll tell you.

Postboi is run by its founder, who is the only person with access to production systems. We look inside an account only to answer that account's support request or to investigate abuse, and when we do it from inside your account, every page opened and setting changed is written to your team's audit log. Anyone we ever authorise to process your personal data will be bound by a duty of confidentiality.

We keep technical and organisational measures that protect your personal data to the standard Article 32 requires. They're described on the security page: encryption in transit and at rest, hashed API keys, sealed provider credentials, no passwords, per-account sending isolation, and an audit log of access. We may change them, but never in a way that lowers the overall level of protection.

You give us general authorisation to use the subprocessors below. Each is bound by a written contract with data protection terms no less protective than this addendum, and we're responsible to you for what they do.

Stripe and Google Analytics are listed so the list is the same everywhere we publish it. They handle our own billing and our site's visitors, and never receive your personal data.

Before we add or replace a subprocessor, we'll update this list and email every team's owners at least 30 days ahead. If you object on reasonable data protection grounds, tell us. If we can't resolve it, you may end your subscription and we'll refund any fees you've prepaid for the time after it ends.

A personal data breach means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your personal data. Blocked attempts that don't get through, such as failed sign-ins, port scans or denial of service, aren't breaches.

• We tell you within 72 hours. We notify you without undue delay, and in any case within 72 hours of becoming aware of a breach affecting your personal data. We don't hold a notice back to finish investigating: you get what we know as soon as we know it.
• By email, to your team's owners. A notice never waits on you opening a support ticket.
• What the notice says. What happened and when, the kinds of data and roughly how many people and records are affected, the likely consequences, what we've done and are doing to contain it, and who to talk to. Where we don't know everything yet, we send what we know and follow up as we learn more.
• We help you with your own notices. Deciding whether to notify the regulator and the people affected is yours as controller. We give you the information and help you need to make those notices, at no charge, and we don't notify your recipients or a regulator about your personal data ourselves unless you ask us to or the law requires it.
• We contain it and keep a record. We take reasonable steps to stop the breach, limit the harm and stop it happening again, and we keep a record of every breach and what was done about it. Incidents are also listed on the delivery record.

Notifying you of a breach isn't an admission of fault or liability by us. Breaches of data we hold as controller (your sign-in and billing details) are covered on the security page.

• Requests from the people in your data. A contact's page shows their history with your team, the Sent and Received logs search the rest, and you can correct or delete their contact record, suppress their address and export your message log. If a request reaches us directly, we pass it to you rather than answer it ourselves. Where the tools don't reach, such as deleting one person's past messages, ask us and we'll do it.
• Impact assessments. If you need to assess or consult a regulator about processing that involves us, we'll give you the information we reasonably can.

Email is sent by Amazon SES in Stockholm and received in Ireland, and the application runs on Cloudflare's global network. Where your personal data is processed outside the UK, it goes only to countries with UK adequacy regulations, or under the ICO's International Data Transfer Agreement or its Addendum to the EU Standard Contractual Clauses, with our subprocessors.

While your account is open, message content is deleted on the retention schedule your team chooses in Settings, and you can export your log and form submissions at any time. When you delete your team, we delete your personal data from our live systems. Copies in our infrastructure's point-in-time recovery age out within 30 days. We keep only what we must for legal, billing or anti-abuse reasons, as the privacy policy says.

We'll give you the information you reasonably need to show that we meet Article 28, including answers to security questionnaires. Postboi doesn't hold SOC 2 or ISO 27001 certification of its own; the infrastructure your data lives on, Cloudflare and AWS, does, and we can point you to their reports. If that isn't enough, or a regulator requires it, we'll agree a reasonable audit with you, on reasonable notice and at your cost, in a way that protects other customers' data.

This addendum lasts as long as we process your personal data. Where it conflicts with the terms, this addendum wins on data protection. Liability under it is subject to the limits in the terms, except where the law doesn't allow them. It's governed by the laws of England and Wales. If we change it, we'll update the date above and email paying customers before a material change takes effect.