Privacy Policy
Last updated: [date of legal review]
1. Who this applies to
This policy covers people who use Aftermain (“the service”): account holders and the visitors to our website. It does not cover the recipients of our customers' emails — customers are responsible for their own contact lists and their own privacy obligations toward their recipients.
2. What we collect
- Account data: username, email address, display name, role, and a password hash (passwords themselves are never stored in readable form).
- Usage data: campaigns, contacts (email, names, company, title), targets and their engagement timestamps (sent, delivered, opened, clicked, submitted, bounced, unsubscribed), and support tickets.
- Sending credentials: SMTP/IMAP usernames and passwords you provide are stored encrypted (AES-GCM) and are never shown back in the interface.
- Technical data: session records, IP addresses in audit logs, and page/API requests for security and rate limiting.
- Landing-page submissions: if you use landing pages, submitted form data is stored per campaign and target; fields that look like passwords, codes, or tokens are replaced with
[redacted]before storage.
3. Why we process it
To operate your account (authentication, quotas, plan limits), to send the campaigns you configure, to measure engagement and produce reports, to protect the platform (rate limits, abuse detection, audit logs), and to provide support. We do not sell personal data or use your contact lists for our own marketing.
4. Where it is stored
All data is stored on servers operated for the service (application database, file storage, and caching layers) with encrypted daily backups, including off-site copies. Sending itself happens through the mail servers you connect to the platform — those providers process the messages and their delivery status.
5. How long we keep it
Engagement events and audit logs are automatically deleted after 90 days. Account, campaign, and contact data is kept while your account is active, and for a limited retention period after suspension or deletion, after which it is removed.
6. Third parties
The application does not share your data with advertising networks or analytics vendors. The only third parties that touch your data are (a) the mail servers you connect to the platform, (b) infrastructure providers hosting the application and its database, and (c) any integration you explicitly enable. This list should be confirmed on legal review.
7. Your rights
You may access and correct your account information in the app settings, export your campaign data through the reporting features, and request deletion of your account and data by opening a support ticket. We respond to such requests within the timeframe set by applicable law.
8. Security
Access requires authentication; accounts are isolated from each other; sending credentials are encrypted at rest; and the platform enforces rate limits and audit logging. In the event of a data breach affecting your account, we will notify you through the contact details on your account.
9. Contact
Questions about this policy or your data: open a support ticket from inside the app, or use the contact page. [Data-protection contact details to be completed on legal review.]