Privacy Policy
Version 1.0 — Effective April 16, 2026
Who We Are
SpellSend is operated by MazzLabs Technology Services LLC, a Florida-based company. We act as a data processor for the email content you send through our Service, and as a data controller for the account information you provide to us.
What We Collect
Account Information (Controller)
- Name, email address, organization name
- Hashed password (we never see your plaintext password)
- MFA secrets (encrypted at rest with AES-256-GCM)
- API keys (hashed with SHA-256; raw keys shown only once at creation)
- Billing information (processed by our payment provider; we do not store card numbers)
Email Metadata (Processor)
- Sender and recipient email addresses
- Subject lines and message IDs
- Delivery status (sent, delivered, bounced, complained)
- Open and click events (when tracking is enabled)
- Email body content (stored temporarily for sending, retained per retention policy)
Usage & Security Data
- IP addresses (rate limiting, audit logs, security events)
- User agent strings (session tracking)
- Login timestamps and failed login attempts
- API request logs (for debugging and abuse detection)
How We Use It
- Deliver emails you send through the Service
- Provide analytics on delivery, opens, and clicks
- Prevent abuse (spam detection, rate limiting, suspension)
- Maintain security (brute force protection, audit logs)
- Comply with legal obligations (subpoenas, law enforcement requests)
Third Parties
We share data only with these processors, under data processing agreements:
| Provider | Purpose | Location |
|---|
| Amazon Web Services (SES) | Email delivery infrastructure | United States |
| Microsoft Azure | Email delivery infrastructure | United States |
| RackNerd | Server hosting | United States |
We do not sell or rent your data to anyone.
Data Retention
- Account information: retained while your account is active, deleted within 90 days of account termination
- Email metadata: 90 days by default (configurable per plan)
- Email bodies: 30 days by default
- Audit logs: 1 year
- Suppressions (bounces/complaints): indefinitely (for sender reputation)
Your Rights
Under GDPR, LGPD, and similar laws, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and data (subject to legal retention requirements)
- Export your data in a machine-readable format
- Object to processing for specific purposes
- Withdraw consent at any time
To exercise any of these rights, contact privacy@spellsend.xyz. We will respond within 30 days.
Security
- All data in transit is encrypted with TLS 1.2+
- Passwords are hashed with bcrypt (cost 12)
- MFA secrets are encrypted with AES-256-GCM
- Session tokens are hashed before storage
- Backups are encrypted and stored offsite
- Per-account brute force protection with automatic lockout
Cookies & Tracking
Our admin panel uses session tokens stored in browser storage. We do not use third-party advertising cookies or analytics trackers.
Email tracking pixels and click redirects are used only when the sender (you) enables them on outgoing emails. Recipients can block tracking pixels by disabling remote image loading in their email client.
Children's Privacy
SpellSend is not intended for users under 18. We do not knowingly collect data from minors.
International Transfers
Data is stored and processed in the United States. If you are in the European Economic Area or Brazil, your data will be transferred internationally. We rely on Standard Contractual Clauses where applicable.
Changes
We will notify you of material changes to this policy by email at least 30 days before they take effect.
Contact
Data Protection Officer: privacy@spellsend.xyz
General support: support@spellsend.xyz