Privacy Policy

This policy covers visitors to our website, the people who create or administer a Climails account ("Customers" or "you"), and, in part, the individuals whose personal data Customers upload and send to ("Contacts").

For Contact data, the Customer is the controller and decides why and how the data is processed; Climails processes it only on the Customer's instructions, as described in our Data Processing Agreement. Contacts who wish to exercise their rights should contact the Customer who messaged them, and we will assist that Customer as required.

Account and profile data you provide when you sign up or use the Service: name, business name, email address, password (stored only as a salted hash), phone number, role and preferences.

Billing data: billing contact, address, tax identifiers and the brand and last digits of your payment method. Full card numbers are handled by our payment processor and are never stored on our servers.

Contact data you upload or sync to send campaigns: recipient names, email addresses, phone numbers, messaging identifiers, and any custom fields, segments and consent records you add.

Usage, delivery and engagement metadata generated by the Service: sends, deliveries, opens, clicks, bounces, complaints, unsubscribes, log and diagnostic data, IP address, device and browser information, and cookies (see our Cookie Policy).

Support and communications data: the messages you send us and records of our correspondence.

To provide, operate and secure the Service, authenticate users and deliver the messages you send — to perform our contract with you.

To bill you, keep records and meet tax, accounting and other legal obligations.

To monitor deliverability and abuse, prevent fraud and spam, improve and develop the Service, and provide support and security — based on our legitimate interest in running a safe and reliable platform, balanced against your rights.

To send you service and, where lawful, product communications. Where the law requires it, marketing to you is based on your consent, which you can withdraw at any time.

We process Contact data only to deliver, measure and support the campaigns you create. We do not sell Contact data, we do not share it with other Customers, and we never use your Contacts to send our own marketing.

You are responsible for having a lawful basis and any required consent to message your Contacts, and for honouring their privacy rights and unsubscribe requests, as set out in our Terms of Service and Anti-Spam Policy.

We share personal data with vetted sub-processors that help us run the Service — including cloud hosting and infrastructure, sending and deliverability infrastructure, payment processing, error monitoring and analytics. Each is bound by a contract requiring confidentiality and adequate security and limiting use to providing services to us.

We may disclose data where required by law, to enforce our agreements, to protect the rights, safety and property of users or the public, or in connection with a merger, acquisition or sale of assets — in which case we will require the recipient to honour this policy.

We maintain a current list of sub-processors and give notice of material changes; email [email protected] to request it.

We may process and store personal data in countries other than your own. Where we transfer personal data across borders, we rely on appropriate safeguards required by applicable law, such as standard contractual clauses and equivalent mechanisms, so the data stays protected.

On higher tiers we offer data-residency options that keep primary storage in a region you choose.

We keep account data for as long as your account is active and as needed to provide the Service. After your account is closed we delete or anonymise personal data within a reasonable period, except where we must retain it to meet legal, tax, accounting or dispute-resolution obligations.

Contact data and campaign content stay under your control and are deleted on your instruction or after account closure. Residual copies may persist in encrypted backups for a limited period before they are overwritten.

We use encryption in transit (TLS) and at rest, secrets protected by a key-management service, role-based access controls, least-privilege administration, multi-factor authentication, audit logging, network isolation and regular testing of our safeguards.

No method of transmission or storage is completely secure, but we work continuously to protect personal data and to detect and respond to incidents. If a personal data breach affects you, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to access your personal data and to have it corrected, deleted, restricted or ported, to object to certain processing, and to withdraw consent at any time without affecting prior processing.

You can exercise many of these rights directly in the application, including through our data-subject request tooling, or by emailing [email protected]. We respond within the time limits set by applicable law, normally within one month.

Depending on your jurisdiction, you may also have the right to lodge a complaint with the data protection authority that oversees you. We would appreciate the chance to address your concern first.

Our website and application use cookies and similar technologies, and the emails you send through Climails can include open- and click-tracking. See our Cookie Policy for details and your choices.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children under the minimum age set by applicable law. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. We will post the new version with an updated date and, for material changes, give additional notice.

For any privacy question or request, contact our privacy team at [email protected] or our Data Protection Officer at [email protected].