Privacy Policy

We act in two distinct roles. For information about you, our customer (your account, billing, and usage), we are the data controller. For the contact data you upload and the recipients you email through the Service, we act as a data processoron your behalf — you are the controller of that data and remain responsible for having a lawful basis to process and contact those individuals.

Account information.Name, email address, and — if you provide them — company, role, website, timezone, and country. Authentication is handled by our auth provider (Supabase); we do not store your password.

Email provider credentials (BYOK). When you connect your own email service provider, we store the API keys or SMTP credentials you supply so we can send on your behalf. These are stored to operate the Service and are never sold or shared.

Contact data you upload. Contacts, lists, custom fields, and tags you import. We process this data solely to provide the Service to you; we do not use it for our own marketing.

Usage and delivery data. Campaign activity, send/open/click/reply events, and diagnostic logs used to operate, secure, and improve the Service.

Cookies. We use strictly necessary cookies for authentication and session management.

• To provide, maintain, and secure the Service.
• To send emails through your connected provider at your direction.
• To process billing and enforce plan limits.
• To send you service, account, and (where permitted) product communications. You can opt out of non-essential messages at any time.
• To detect, prevent, and address abuse, fraud, and violations of our Terms.

MailTrigger does not operate a shared sending pool. Emails are sent through the email provider you connect, using your credentials and sender reputation. The contents and recipients of those emails are determined entirely by you, and the data of recipients is processed on your behalf under our role as processor.

We rely on a small set of vendors to run the Service:

• Supabase — database and authentication.
• Render — backend application hosting.
• Vercel — frontend hosting.
• Brevo — our own transactional and account email to you.
• Dodo Payments — subscription billing and payments.

Your connected email provider is engaged by you directly and is not our sub-processor.

We retain account and contact data for as long as your account is active. When you delete a record, list, or your account, the associated data is deleted (account deletion cascades to your contacts, campaigns, providers, and logs). You may request deletion at any time by contacting us.

Depending on your location (e.g. the EEA/UK under GDPR, or California under CCPA/CPRA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at support@offtrigger.com. If you email recipients located in these regions, you are responsible for honoring their rights as their controller.

We use industry-standard measures including encryption in transit, access controls, and row-level tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our infrastructure providers may process data in regions outside your own. Where required, transfers are made under appropriate safeguards such as Standard Contractual Clauses.

The Service is not directed to anyone under 16, and we do not knowingly collect their data.

We may update this policy from time to time. Material changes will be reflected by an updated effective date, and where appropriate we will notify you.

Questions about this policy or your data? Email support@offtrigger.com.