Privacy Policy

This Privacy Policy explains how Oliver DeNune INC ("Postmaster Ops," "we," "us"), operating the Postmaster Ops sending-infrastructure service ("Service"), collects and uses personal data. Postmaster Ops is a Pennsylvania corporation. This policy applies to (a) personal data of Customer representatives who interact with us in commercial dealings, and (b) recipient personal data processed on behalf of Customers as part of Service delivery.

§ 01 Roles & Definitions

For personal data of Customer representatives (name, business email, contact history), Postmaster Ops acts as the data controller.

For recipient personal data submitted per-send through the Service (recipient email addresses and delivery-outcome metadata such as SMTP response codes and rejection classifications), Postmaster Ops acts as the data processor on behalf of the Customer, who is the controller of that data. Where Customer's processing is subject to GDPR, UK GDPR, or comparable regimes, appropriate data- processing terms and transfer safeguards will be negotiated and executed before such processing begins. Postmaster Ops does not warrant that these frameworks are pre-built and does not currently represent readiness to sign a Data Processing Addendum without tailored review.

§ 02 Data We Collect — About Customers

When a prospective or active Customer interacts with us, we collect:

• Business identity information (legal entity name, address, jurisdiction, principal contact)
• Contact details of the individuals with whom we communicate (name, business email, phone, messaging handles)
• Vetting-call notes, correspondence, and questionnaire responses
• Service Order and billing records
• Payment reference information necessary to reconcile wire or cryptocurrency payment (bank name, wire reference, wallet address)
• Server-side technical logs of Customer authentication and submission activity (IP addresses, timestamps, SMTP session identifiers)
• Operator-dashboard account credentials (hashed passwords, session tokens); scoped Google OAuth tokens that Customer authorizes for Postmaster Ops to read Postmaster Tools metrics for their own domains. Postmaster Ops does not accept or store Google account passwords under any circumstance.

§ 03 Data We Process — About Recipients & Messages

When a Customer submits messages through the Service, the following recipient- and message-related data is processed on the Customer's behalf:

• Recipient email addresses — present in primary storage only within the active sending queue; removed on final acceptance, final rejection, or standard maximum queue age (currently 72 hours). Not persisted in primary storage in subsequent delivery-event records (which retain recipient domain only). Transient operational copies may capture identifiable data within the maximum periods disclosed in § 06.
• Production message bodies (HTML, plain text, attachments, arbitrary custom headers) — present in primary storage only within the active sending queue and in transit; not persisted in primary storage after final disposition, except under the lawful-investigation carve-out below. Transient operational copies (MTA logs, backups, exception traces) may capture identifiable data within the maximum retention windows disclosed in § 06.
• Customer-approved warmup templates — retained separately from production content, on a per-account basis, while the template remains active for warmup use. This is not production Customer Content; it is content Customer has explicitly approved for use during warmup, and is purged within 30 days after replacement or account termination.
• Delivery-event metadata — slot, sender domain, recipient domain, message-id, timestamps, latency, SMTP response, outcome classification. Does not contain recipient local part, subject, body, attachments, or arbitrary headers.
• Customer-instrumented tracking URLs — any click-through or open-tracking URLs the Customer has themselves inserted into the message body, hosted on their own domains. Postmaster Ops does not itself perform open or click tracking and does not modify message content to insert tracking pixels or rewrite links.
• Suppression identifiers — bounce and unsubscribe events, retained as customer-scoped one-way HMAC hashes; the raw address is not retained after hashing.
• Abuse- or lawful-investigation carve-out — specific messages or metadata may be retained on an exceptional and access-restricted basis for the duration of an active investigation and up to 90 days of follow-up.
• Aggregate delivery outcomes at recipient-domain granularity (for example, per-Gmail delivery rate).

We do not accept uploaded subscriber files. Recipient email addresses are supplied per-message via SMTP submission by Customer and are not persisted as a standalone subscriber list. Suppression identifiers are stored as one-way hashes scoped to each Customer's account; the raw address is not retained after hashing.

§ 04 How We Use Data

Data collected above is used for:

• Providing the Service and performing our contract with Customer
• Vetting prospective Customers and enforcing the Acceptable Use Policy
• Billing, collection, and payment reconciliation
• Security, fraud prevention, and abuse investigation
• Complying with applicable law and lawful regulatory requests
• Communicating operational updates related to the Service

We use recipient personal data only to provide, secure, monitor, and enforce the Service, investigate abuse, comply with law, and act on the Customer's documented instructions. We do not sell recipient personal data. We do not use recipient personal data for third-party advertising.

§ 05 Legal Basis (GDPR / UK GDPR)

Where Postmaster Ops is the controller and GDPR applies, the legal bases we rely on are:

• Performance of a contract — for processing necessary to deliver the Service to a Customer.
• Legitimate interests — for security, fraud prevention, aggregate operational analytics, and defending our business against legal claims. We have assessed that these interests are not overridden by the rights of the data subjects involved.
• Legal obligation — for tax, accounting, and lawful regulatory compliance.
• Consent — where required and clearly obtained (rarely applicable in a B2B managed-service context).

Where Postmaster Ops is a processor, the lawful basis for processing recipient personal data is the Customer's responsibility.

§ 06 Data Retention

We retain data for the minimum period necessary to fulfill the purposes stated above and to satisfy legal or accounting obligations. Current defaults:

• Raw recipient addresses and production message content (body, attachments, arbitrary custom headers): present in primary storage only within the active sending queue, until final acceptance, final rejection, or the standard maximum queue age (currently 72 hours), whichever occurs first. Not persisted in primary storage after final disposition; transient operational copies may capture identifiable data within the maximum periods described below.
• Delivery-event metadata (slot, sender domain, recipient domain, message-id, timestamps, latency, SMTP response, outcome classification): approximately 30 days. Recipient local part is not retained in these records.
• Aggregate per-slot statistics (anonymized rollups from which no individual recipient can be recovered): approximately 90 days.
• Per-customer suppression identifiers (hashed): for the duration of the account plus 30 days after termination, to ensure honored unsubscribes are respected across a brief transition window. The raw address is not retained after hashing.
• Customer-approved warmup templates: retained while the template remains active for warmup use, and purged within 30 days after replacement or account termination.
• Abuse- or lawful-investigation evidence: specific messages or metadata may be retained on an exceptional and access-restricted basis for the duration of an active investigation and up to 90 days of follow-up.
• Customer contact, contract, billing, and sanctions-screening records: for the duration of the account plus the period required by applicable tax, accounting, and legal-defense retention rules (typically 7 years for financial and sanctions records).

Transient operational copies. Standard operating infrastructure — MTA logs, backup snapshots, and exception traces — may transiently capture identifiable data that has been purged from primary storage. Current maximums: MTA and journald logs are rotated at 30 days; encrypted backup snapshots are retained up to 30 days; exception traces are retained up to 7 days. Access to these copies is restricted to authorized operators for security-forensics and disaster-recovery purposes only.

§ 07 Sub-processors & Third-Party Recipients

Postmaster Ops uses a limited set of sub-processors to deliver the Service. Categories include:

• Infrastructure providers (compute, network, DNS)
• Google (for Postmaster Tools data retrieval on Customer-owned domains, which the Customer has independently registered with Google)
• Financial institutions and cryptocurrency payment processors for billing reconciliation
• Legal, accounting, and other professional advisors bound by obligations of confidentiality

A current sub-processor list is provided as part of onboarding and updated as the sub-processor set changes. We do not otherwise disclose personal data to third parties except (a) as required by law or lawful regulatory request, (b) to enforce our rights or the safety of the Service, or (c) in connection with a merger or acquisition of Postmaster Ops or its assets, subject to the acquirer's continued compliance with this Policy.

Google Fonts. Pages served under postmasterops.com reference typefaces hosted by Google Fonts. When a visitor loads a page, the visitor's browser makes a request to Google's font servers, which necessarily discloses the visitor's IP address and user-agent string to Google as part of that request. This is a passive connection limited to font delivery. Visitors who prefer not to connect to Google Fonts may block that request via browser extensions or DNS filtering; the site remains readable in a fallback system font.

§ 08 International Transfers

Postmaster Ops operates infrastructure primarily in the United States. Postmaster Ops does not currently maintain a general international-transfer framework and does not represent operational readiness to receive personal data from the European Economic Area, United Kingdom, or Switzerland in the ordinary course. Customers whose intended processing would involve such transfers must raise this during the fit-review call so that appropriate transfer safeguards (Standard Contractual Clauses, UK International Data Transfer Agreement, or equivalent) can be executed before processing begins.

§ 09 Data-Subject Rights

Subject to applicable law, data subjects have the following rights in relation to their personal data:

• Right of access to the personal data we hold about them
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten") in defined circumstances
• Right to restriction of processing
• Right to data portability where the processing is by automated means and based on consent or contract
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with a supervisory authority

For recipient personal data processed on behalf of a Customer, data subjects should first contact the Customer (as the controller of that data). Postmaster Ops will support Customer in fulfilling data-subject requests as required by our processor obligations.

Requests concerning personal data for which Postmaster Ops is the controller may be sent to privacy@postmasterops.com. We will respond within the timelines required by applicable law (typically 30 days).

§ 10 Security

Postmaster Ops implements administrative, physical, and technical safeguards designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. Current practices include: encrypted transport for customer submission (TLS) and for inter-service traffic where technically feasible; strict access controls limiting operational access to a small number of authorised operators; multi-provider redundancy against single-carrier outage or compromise; and routine review of infrastructure logs for suspicious activity.

No security programme is proof against every risk. We do not represent that our safeguards are unfailing.

§ 11 Data-Breach Notification

Where Postmaster Ops becomes aware of a personal-data breach affecting data for which we are the controller, we will notify (a) the applicable supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of the breach, when the breach meets the reporting threshold under applicable law (for GDPR, where the breach is likely to result in a risk to individuals' rights and freedoms); and (b) affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, in the manner and detail required by the applicable regime.

Where the breach affects personal data for which a Customer is the controller, Postmaster Ops will notify the affected Customer without undue delay upon becoming aware, and will provide reasonable assistance to the Customer in complying with the Customer's own notification obligations.

§ 12 Cookies & Tracking

The postmasterops.com marketing website does not set advertising cookies. Essential-only cookies may be used to remember interface preferences during a session. The Postmaster Ops operator dashboard (available to signed-in Customers only) uses functional cookies as necessary to maintain session state.

§ 13 Children

The Service is offered to businesses and other commercial operators and is not directed to children. Customers may not submit children's personal data through the Service where doing so would violate applicable law (including COPPA in the United States and the equivalent regimes elsewhere). Postmaster Ops does not knowingly seek to collect children's personal data for its own purposes; we cannot independently verify the age of every recipient address a Customer submits.

§ 14 Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active Customers by email; updates will be reflected in the version identifier at the top of this page. This Policy is a notice of our data-handling practices, not a contractual instrument; the terms binding you to the Service are the Terms of Service and your Service Order, which specify their own amendment procedures.