Privacy Policy

1. Overview

Slate and Pixel LLC d/b/a GoodPostal ("we," "us," or "our") is committed to protecting the privacy of our users and their contacts. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the GoodPostal email marketing platform ("Service").

GoodPostal serves two types of individuals whose data we process:

Users: individuals who register for and use GoodPostal to create and send email campaigns.
End Recipients: individuals whose email addresses are stored in a user's contact lists and who receive emails sent through the Service. We process End Recipient data on behalf of our Users, who act as the data controller for their contact data.

2. Information We Collect

2.1 Account Information

When you register for GoodPostal, we collect:

Name
Email address
Password (stored as a bcrypt hash; we never store plaintext passwords)
Workspace (tenant) name
Two-factor authentication settings (if enabled)

2.2 Contact List Data

When you import or add contacts, we store the data you provide, which typically includes:

Email addresses
Names (first and last)
Phone numbers (when you provide them)
Postal addresses (when you provide them)
Custom fields you define
Subscription status and consent records
Contact group memberships

You are the data controller for your contact list data. We process this data solely on your behalf and according to your instructions.

2.3 Email Content

We store the email templates, campaign content, and images you create or upload through the Service. This content is stored in your workspace and is not shared with other users.

2.4 Sending Service Credentials

When you connect your email sending service, we store your service API keys, SMTP credentials, and webhook signing keys. These credentials are encrypted at rest using AES-256 encryption via Laravel's built-in encryption.

2.5 API Access Data

If you use the GoodPostal REST API, we collect:

API key identifiers (hashed tokens, key names, and creation dates)
API request metadata (endpoint accessed, request timestamp, originating IP address, and HTTP response status code)
Rate limiting counters (request counts per time window, associated with your API key)

We do not log the full content of API request or response bodies. API keys are stored as hashed values. The plaintext key is shown only once at creation and cannot be retrieved afterward.

2.6 Usage Data

We automatically collect:

IP addresses (for security and abuse prevention)
Browser type and version
Pages visited within the Service
Time and date of access
Actions taken (campaigns sent, templates created, etc.)

2.7 Email Tracking Data

When emails are sent through the Service, we collect analytics data including:

Open events: detected when a tracking pixel (a small, transparent 1x1 image) embedded in the email is loaded by the recipient's email client.
Click events: detected when a recipient clicks a link in the email, which is routed through our tracking redirect before reaching the destination URL.
Bounce events - reported by your sending service when an email cannot be delivered.
Complaint events - reported by your sending service when a recipient marks an email as spam.

2.8 Billing Information

Payment processing is handled entirely by Stripe. We do not store your credit card numbers, bank account details, or full payment information on our servers. We store only: Stripe customer ID, subscription plan and status, billing cycle dates, and invoice history references.

2.9 Nonprofit Verification Data

If you apply for nonprofit pricing, we collect your organization name and Employer Identification Number (EIN). We verify this against the IRS Business Master File. The EIN and verification result are stored in your account.

2.10 Newsletter Signup

If you subscribe to the GoodPostal newsletter on our website, we collect your first name, your email address, and optionally your last name. We use this information only to send you the newsletter. Signup is double opt-in: we send you a confirmation email first, and you are only subscribed once you confirm. Every newsletter includes an unsubscribe link, and unsubscribing stops the emails immediately. Registering for a GoodPostal account does not add you to the newsletter.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service
Process your email campaigns through your chosen email sending service
Generate campaign analytics (opens, clicks, bounces, complaints)
Process payments and manage subscriptions
Send you Service-related communications (account alerts, billing receipts, security notices)
Send you the GoodPostal newsletter, if you subscribed and confirmed your subscription
Enforce our Terms of Service and Acceptable Use Policy
Enforce API rate limits, detect abuse patterns, and debug API integration issues using request metadata
Detect and prevent fraud, abuse, and security incidents
Respond to your support requests
Comply with legal obligations

We do not sell, rent, or share your personal information or your contact list data with third parties for their marketing purposes.

4. Email Tracking Disclosure

GoodPostal provides email tracking features to help you understand how your recipients engage with your campaigns. This section describes exactly how tracking works:

4.1 Open Tracking

When open tracking is enabled, a small transparent image (tracking pixel, approximately 1x1 pixel) is embedded in each email. When a recipient's email client loads this image, our server records the open event along with the timestamp. Open tracking may not be accurate for all recipients due to email clients that block images or pre-fetch content.

4.2 Click Tracking

When click tracking is enabled, links in your email are rewritten to pass through our tracking server. When a recipient clicks a tracked link, we record the click event (including which link was clicked and the timestamp) before redirecting the recipient to the original destination URL. Click events also record the recipient's browser user agent and an anonymized IP address: the final octet of IPv4 addresses is zeroed and IPv6 addresses are truncated, so the stored value does not identify the recipient's exact address.

4.3 Your Disclosure Obligations

As a GoodPostal user, you are responsible for disclosing email tracking to your recipients as required by applicable privacy laws. Some jurisdictions (including the EU under GDPR and the ePrivacy Directive) may require you to obtain consent before using tracking technologies in emails.

5. Legal Basis for Processing (GDPR)

For users and contacts in the European Economic Area (EEA), we process personal data under the following legal bases:

Contract performance (GDPR Article 6(1)(b)) - processing necessary to provide the Service to you (account data, sending service credentials, email content).
Legitimate interests (GDPR Article 6(1)(f)): processing for security, fraud prevention, service improvement, and analytics, where our interests do not override your rights.
Legal obligation (GDPR Article 6(1)(c)): processing required to comply with legal or regulatory requirements.
Consent (GDPR Article 6(1)(a)): where you have given explicit consent, such as for optional marketing communications from us.

For End Recipient data (your contact lists), you are the data controller and are responsible for establishing a lawful basis for processing. We process End Recipient data solely as your data processor. A Data Processing Agreement is available to formalize this relationship.

We share your data only with the following categories of service providers, and only to the extent necessary to provide the Service:

6.1 Your Email Sending Service

When you send a campaign, we transmit email content and recipient addresses to the email sending service you have configured (Amazon SES, SendGrid, Mailgun, Postmark, SMTP2GO, Mailtrap, or your SMTP server). You select and control which sending service receives your data. We do not choose your sending service for you.

6.2 Stripe (Payment Processing)

Stripe processes all payments on our behalf. When you subscribe to a paid plan, your payment information is sent directly to Stripe and is never stored on our servers. Stripe's privacy policy governs their handling of your payment data.

6.3 Infrastructure Providers

We use hosting and infrastructure providers to run the Service. These providers may process data as part of their hosting services but do not have independent access to your data.

6.4 Legal Compliance

We may disclose your information if required by law, regulation, legal process, or government request, or to protect our rights, property, or safety, or the rights, property, or safety of others.

6.5 AI Assistants and Connected Agents

You can connect AI assistants and agent tools (such as ChatGPT, Claude, and command-line coding agents) to your workspace through our API and Model Context Protocol (MCP) integrations. You authorize each connection yourself on an OAuth consent screen, where you choose the workspace and the access level (read-only or read-and-write). A connected assistant receives the workspace data you ask it to work with (for example contact summaries with masked email addresses, campaign statistics, templates, sender identities, and brand settings) and can take the actions its access level allows (for example creating templates or adding contacts). Campaign sending always requires your approval in the GoodPostal dashboard and can never be completed by a connected assistant. The AI provider you connect (for example OpenAI or Anthropic) processes the data it receives under its own privacy policy. You can disconnect an assistant at any time from that client's connection settings, and you can ask us to revoke its issued tokens.

7. Multi-Tenant Data Isolation

GoodPostal uses a multi-tenant architecture where each workspace operates in logical isolation. This means your contact lists, templates, campaigns, and analytics are only accessible within your workspace. Other GoodPostal users cannot see or access your data. Tenant isolation is enforced at the application level through scoped database queries, ensuring that every data request is filtered to your workspace.

8. Data Retention and Workspace Deletion

8.1 Workspace data: 30-day soft-delete grace

When you delete your workspace from the Danger Zone in workspace settings, your data enters a 30-day soft-delete grace period. During this period:

All workspace data is hidden from the application but preserved in our database.
Your Stripe subscription is automatically paused. You are not billed.
You may restore the workspace at any time within 30 days using the restoration link emailed to the workspace owner. The link is a single-use signed URL valid for 30 days.
If you cannot use the self-serve restoration link (lost email access, forgotten password), email privacy@goodpostal.com from any address you can prove ownership of. After identity verification, we will manually restore the workspace.

8.2 Permanent deletion on day 30

If no restoration occurs within 30 days, the following data is permanently deleted from our primary database and replicas:

Contacts, contact groups, contact group memberships, custom contact fields, subscription consent records, and contact import/export history
Email templates, template categories, template images, and uploaded media
Campaigns (drafts, scheduled, and sent records) and campaign analytics events (opens, clicks, bounces, complaints)
Sender identities and verified sending domains
Encrypted email sending service credentials (API keys, SMTP passwords, webhook signing secrets you provided for SendGrid, Mailgun, Postmark, Amazon SES, SMTP2GO, Mailtrap, or SMTP)
Subscription form embeds and form submission history
Webhook subscriptions and webhook delivery history
API keys (hashed identifiers) and API request metadata
Team member memberships and outstanding team invitations
Brand settings, design tokens, and custom tracking domains

At the same time, your Stripe subscription is cancelled. A final confirmation email is sent to the workspace owner. This action is irreversible.

8.3 Records retained beyond workspace deletion

A limited set of records is retained beyond workspace deletion because each category is subject to an independent legal, compliance, or operational obligation:

Billing records (invoices and payment history) are retained in Stripe and our tax and accounting systems for up to seven (7) years under our recordkeeping policy. The corresponding tenant rows in our application database (including the Stripe customer ID and subscription rows) are deleted with the workspace. Retained billing records do not contain workspace content, contacts, or email send data.
Server access logs (IP addresses, request timestamps, response codes) are retained for ninety (90) days for security, abuse-prevention, and debugging purposes.
Workspace deletion and restoration audit logs are retained for up to seven (7) years under our compliance, tax/accounting, security, and fraud-defense recordkeeping policies. Where the record documents a CCPA request, we retain request/response records as required by 11 CCR §7101. We may also retain limited records where reasonably necessary for security and integrity (CCPA §1798.105(d)(2)), to comply with a legal obligation (CCPA §1798.105(d)(8)), for tax and accounting records material to tax administration (26 CFR §1.6001-1), or for fraud investigation, abuse defense, and legal claims. These records capture the workspace name and slug at the time of the event, the workspace owner's email address at the time of deletion, the action taken (deleted, restored, or purged), the actor who performed the action (the workspace owner, a GoodPostal administrator, or our automated purge system), the IP address and browser user agent of the actor where available, and the date and time of the event. Audit log records are never used for marketing, analytics, advertising, or profiling.

Webhook event payloads from your sending service are retained for 90 days during normal operation and are deleted as part of the workspace purge if deletion occurs before that window.

8.4 Erasure requests (GDPR Article 17 / CCPA §1798.105)

The 30-day soft-delete grace is GoodPostal's standard product deletion flow. Verified GDPR Article 17 and CCPA §1798.105 (right to delete) requests are handled by our team within the legal response windows that apply to your jurisdiction: one month under GDPR (per Article 12), and the 45-day response window in CCPA §1798.130(a)(2). Verified Article 17 requests are processed without undue delay and may be processed through our standard 30-day soft-delete grace, subject to identity verification and any lawful retention exemptions (such as the billing-records exemption described in Section 8.3).

To open a request, email privacy@goodpostal.com with the subject "Privacy Rights Request." Include reasonable identity verification (a request from the email address on file, the workspace name, the approximate creation date, and the Stripe customer email if different). We will confirm completion in writing.

Operational dependencies (in-flight campaign sends, pending webhook deliveries, identity verification, and review of any retained-records exemptions) may affect timing. We will keep you informed of progress and complete the request within the applicable legal response window.

8.5 End Recipient erasure requests

If you are an End Recipient (someone whose email address is stored in a GoodPostal user's contact list because that user sent you an email), please direct erasure requests to the organization that emailed you. That organization is the data controller for your information. If you cannot reach them or they fail to respond within a reasonable time, you may forward the request to privacy@goodpostal.com and we will make reasonable efforts to assist by notifying the controller of their obligation.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access: request a copy of the personal data we hold about you.
Right to rectification: request correction of inaccurate or incomplete personal data.
Right to erasure: request deletion of your personal data (subject to legal retention requirements).
Right to restrict processing: request that we limit how we use your data.
Right to data portability: request your data in a structured, commonly used, machine-readable format (CSV or JSON).
Right to object: object to processing based on legitimate interests.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@goodpostal.com with the subject line "Privacy Rights Request." We will respond within the legal response window that applies to your jurisdiction: one month under GDPR (per Article 12), the 45-day response window in CCPA §1798.130(a)(2), and similar windows under other state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA). For workspace deletion specifically, see Section 8 above. Our standard erasure mechanism is the in-app workspace deletion with a 30-day soft-delete grace.

If you are an End Recipient (someone who received an email from a GoodPostal user), please direct your privacy requests to the organization that sent you the email. They are the data controller for your information. If you are unable to reach them, you may contact us and we will make reasonable efforts to assist.

10. CCPA/CPRA Rights (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to know: you may request the categories and specific pieces of personal information we have collected about you.
Right to delete: you may request deletion of your personal information, subject to certain exceptions (per CCPA Section 1798.105).
Right to correct: you may request correction of inaccurate personal information.
Right to opt-out of sale or sharing: GoodPostal does not sell or share your personal information as defined by the CCPA/CPRA.
Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, email us at privacy@goodpostal.com with the subject line "CCPA Request." We will verify your identity before processing your request. For the right to delete specifically, see Section 8. Your standard mechanism is the in-app workspace deletion with a 30-day soft-delete grace; verified CCPA §1798.105 requests are handled within the 45-day response window in CCPA §1798.130(a)(2).

11. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. In the United States, we do not knowingly collect personal information from children under 13, as required by the Children's Online Privacy Protection Act (COPPA). If we discover that we have collected personal information from a child under 16 (or under 13 in the United States), we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us immediately at support@goodpostal.com.

12. Cookies

We use cookies and similar technologies to operate the Service. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

13. Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

Encryption of data in transit (TLS/HTTPS for all connections)
Encryption of sensitive data at rest (AES-256 for sending service credentials)
Password hashing using bcrypt
Two-factor authentication (TOTP) support
Tenant-scoped database queries preventing cross-workspace data access
CSRF protection on all forms
Rate limiting on authentication endpoints
Regular security updates to application dependencies

No method of electronic storage or transmission is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee its absolute security.

14. International Data Transfers

GoodPostal is operated from the United States by Slate and Pixel LLC. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. For users who require a data processing agreement, please see our Data Processing Agreement.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

16. Contact Information

For privacy-related questions or to exercise your data rights, contact us:

General privacy inquiries: support@goodpostal.com
Privacy and erasure requests: privacy@goodpostal.com (for GDPR rights requests, CCPA rights requests, and workspace deletion / restoration support).
Subject line: "Privacy Inquiry," "Privacy Rights Request," or "CCPA Request"

GoodPostal does not sell or share your personal information as defined by the CCPA/CPRA. Because we do not sell or share personal information, no "Do Not Sell or Share" opt-out is required.