Privacy policy

What we collect

• Account data. Your email, display name, and (optional) profile preferences from sign-up and onboarding.
• Mailbox metadata. Provider, status, OAuth refresh tokens (envelope-encrypted), warmup settings.
• Operational telemetry. Per-mailbox send/verify outcomes, placement results, reputation snapshots, audit log entries.
• Strictly-necessary cookies. Auth session + CSRF tokens. No tracking, no analytics, no ad pixels.

Where it lives

Production data is stored in the EU (Hetzner Falkenstein / Nuremberg). OAuth tokens are envelope-encrypted with AES-256-GCM and a master key held in HashiCorp Vault. Backups are encrypted with a separate key and retained for 30 days.

What we don't do

• We don't read your warmup conversations beyond what's needed to verify deliverability (Message-ID lookup + folder classification).
• We don't sell or share customer data with third parties for marketing.
• We don't run third-party trackers, analytics SDKs, or ad pixels in the app.

Your rights

Workspace owners can export workspace data and request deletion at any time from Workspace settings. Deletion starts a 30-day grace window during which restoration remains possible.

Contact

Reach the data protection team at privacy@warmup.example.com.