Last updated: October 20, 2026

Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between you, the customer, and [LEGAL NAME] ("PennyPost", "we", "us"). It applies automatically when you accept the Terms, so there's nothing to sign. If you'd like a countersigned copy for your records, email hello@usepennypost.com and we'll send one.

If this DPA and the Terms disagree about personal data, this DPA wins. If the Standard Contractual Clauses apply and disagree with this DPA, the Clauses win.

1. Words used here

Customer Personal Data is personal data we process for you as your processor when we provide PennyPost. Most of it is about your app's users and your other contacts: who they are, what they do in your app, and the emails you send them.
Data Protection Law means the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and US state privacy laws such as the California Consumer Privacy Act, as far as each one applies.
Sub-processor means a company we use that processes Customer Personal Data.
Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss or change of Customer Personal Data, or to its unauthorised disclosure or access.
Standard Contractual Clauses or SCCs means the clauses the European Commission approved in Implementing Decision (EU) 2021/914 of 4 June 2021.
Other words, such as controller, processor, data subject, personal data and processing, mean what they mean in the GDPR.

2. Roles

You're the controller of Customer Personal Data, or a processor acting for your own client. We're your processor, or your sub-processor in that second case.
Annex 1 describes the processing: what data, about whom, why, and for how long.
This DPA doesn't cover the data we control ourselves, such as your PennyPost account, billing and our own emails to you. The Privacy policy covers those.
We use a small part of Customer Personal Data as an independent controller, only to keep email sending safe and lawful. When an address hard-bounces, or its owner marks an email as spam, we add it to a suppression list that stops every PennyPost customer from emailing it. We use bounce and complaint reports to find and stop abuse. We also keep what the law requires us to keep.

3. Your instructions

We process Customer Personal Data only on your documented instructions, including on transfers to other countries, unless the law requires otherwise. In that case we'll tell you first, unless that law forbids it.
Your instructions are the Terms and this DPA, the settings you choose in PennyPost, and the way you use the app and the API. Anything beyond that needs our written agreement.
If we think an instruction breaks Data Protection Law, we'll tell you.
We don't sell Customer Personal Data, use it for advertising, or use it to train AI models.

4. Your responsibilities

You're responsible for having a legal basis for the data you send us, and for telling your users about it. In particular:

Your privacy policy says that you record page views and key actions and send email through a provider, and, if you've turned on open and click tracking, that your emails track opens and clicks.
Where the law asks for consent, you get it. For visitors in the EU and the UK, that usually includes consent before the snippet sends or stores anything from their device. Add data-consent="required" to the snippet's script tag, then call pennypost("consent", true) or pennypost("consent", false) with your banner's answer. Until the answer is yes, nothing is sent or stored on the device.
Open and click tracking starts off for each new app. If you don't have consent for it, leave it off (or turn it off in Setup). "Came back" is measured from your app's own events either way.
You sign your users' email addresses on your server, keep your identity secret and API keys private, and call pennypost("reset") when a user signs out.
You don't put personal data in your app's page paths. We drop query strings and anything after a #, but we keep the path.
You don't send us special categories of personal data (such as health, religion or sex life), data about criminal convictions, or payment card numbers.

5. Confidentiality

Everyone at PennyPost who can access Customer Personal Data is bound by a duty of confidentiality. They access it only when they need to: to run PennyPost, to help you when you ask, or to look into abuse or a security problem.

6. Security

We keep the technical and organisational measures in Annex 2, which is our Security page. They're designed to give a level of security that fits the risk, as Article 32 of the GDPR requires. We may change them, as long as the overall protection doesn't go down.

7. Sub-processors

You give us general authorisation to use sub-processors. You approve the ones on our Subprocessors page when you accept this DPA.
Before we add or replace a sub-processor, we'll update that page and email your account's address at least 14 days ahead.
You can object by email within those 14 days, on reasonable data protection grounds. We'll try to resolve it with you, for example by not using that provider for your data. If we can't, you can close your account before the change applies, and we'll refund what you've paid for any time after that date.
Each sub-processor is bound by a written contract with data protection duties that protect Customer Personal Data at least as well as this DPA does, as far as they apply to the service it provides. We stay responsible to you for our sub-processors' work.

8. Helping you

Requests from people. If someone asks us directly to see, correct, delete or move their data, we'll pass the request to you, and we won't answer it ourselves unless you ask us to. In PennyPost you can see a person's data, edit it and unsubscribe them. To export or delete one person's data, email us with the app and their address. We'll do it within 14 days, so you can answer within the month the GDPR gives you.
Assessments. We'll give you the information you reasonably need, as far as you don't already have it, for a data protection impact assessment or a consultation with a supervisory authority.
Your other duties. We'll help you meet your duties under Articles 32 to 36 of the GDPR (security, breach notices, impact assessments and prior consultation), taking into account how we process the data and what we know.

9. Security Incidents

If we become aware of a Security Incident, we'll tell you without undue delay, and within 48 hours of becoming aware of it.
We'll email your account's address. As far as we know at the time, we'll say what happened, what data and roughly how many people it affects, its likely consequences, what we've done and will do about it, and who you can talk to. We'll send more as we learn it.
We'll take reasonable steps to contain the incident and limit the harm.
Telling you about a Security Incident isn't an admission of fault.

10. Deleting and returning data

Getting a copy. Before you leave, you can ask us for a copy of Customer Personal Data. Within 30 days we'll send it as CSV or JSON files.
Deletion. When you delete your account on the Account page, we delete Customer Personal Data from our database straight away. If you ask us by email to close it, we'll do it within 30 days.
What stays. Copies in our providers' logs expire on their own schedule. Older bounce and complaint reports that are no longer linked to an email record don't have a fixed limit yet, and we'll delete them on request. Suppression list entries stay (section 2), and so does anything the law requires us to keep. This DPA keeps protecting whatever stays.

11. Audits

We'll make available the information you need to show that we meet Article 28 of the GDPR: this DPA, the Security and Subprocessors pages, and answers to your questions.
Once a year, or after a Security Incident, you can send us a reasonable security questionnaire, and we'll answer it within 30 days.
If that isn't enough to show we comply, or a supervisory authority requires it, you or an independent auditor bound by confidentiality can audit our compliance with this DPA. Give us at least 30 days' notice, keep it to business hours and to what's needed, and pay its cost. An audit can't give access to other customers' data. We'll take part in it and contribute what's needed.
Audits under Clause 8.9 of the SCCs follow this section.

12. Transfers outside Europe

We store and process Customer Personal Data in the United States: our database and email sending run in Amazon Web Services' US East (N. Virginia) region. Some sub-processors may process it in other countries. The Subprocessors page has the details.
When a transfer of Customer Personal Data from you to us is a restricted transfer under the GDPR, the UK GDPR or the FADP, the SCCs apply to it as set out in section 13.
For onward transfers to sub-processors, we rely on a transfer mechanism the law accepts, such as the SCCs or a sub-processor's certification under the EU-US Data Privacy Framework.
If a mechanism we rely on stops being valid, we'll work with you to put a valid one in place.

13. Standard Contractual Clauses

EU. The SCCs are part of this DPA, filled in as follows:

Module 2 (controller to processor) applies when you're a controller, and Module 3 (processor to processor) when you're a processor.
You're the data exporter and we're the data importer.
Clause 7 (the docking clause) doesn't apply.
Clause 9: option 2 (general written authorisation) applies, with at least 14 days' notice, as in section 7.
Clause 11: the optional wording doesn't apply.
Clause 13: the supervisory authority is the one that Clause 13(a) makes competent for you as data exporter.
Clause 17: option 1 applies, and the law is the law of Ireland.
Clause 18: disputes go to the courts of Ireland.
Annex I is Annex 1 below, Annex II is Annex 2 (our Security page), and Annex III is our Subprocessors page.
Accepting the Terms counts as signing the SCCs and their annexes, on the date you accept them.

UK. For transfers from the UK, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) is part of this DPA. Annex 1 fills in its Table 1. The choices above fill in Table 2. Annexes 1 and 2 and our Subprocessors page fill in Table 3. For Table 4, neither party may end the Addendum under its Section 19.

Switzerland. For transfers that the FADP governs, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR include the FADP, and "Member State" in Clause 18(c) doesn't stop people in Switzerland from bringing claims where they normally live.

14. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we're your service provider or processor. We won't sell or share Customer Personal Data, as those laws define those words. We won't keep, use or disclose it for any purpose other than providing PennyPost to you, or outside our direct business relationship with you, except as those laws allow. We won't combine it with personal data from other sources except as those laws allow. If we can no longer meet these duties, we'll tell you.

15. Liability, term and changes

Each party's liability under this DPA is subject to the limits in the Terms, except where the SCCs or Data Protection Law don't allow that.
This DPA lasts as long as we process Customer Personal Data for you.
We may update this DPA to follow changes in the law or in PennyPost. If a change matters, we'll email you at least 14 days before it applies. No change will lower the protection this DPA gives Customer Personal Data.

Annex 1: Details of the processing

The parties

Data exporter: you, the customer, as named in your PennyPost account. Contact: your account's email address. Role: controller (Module 2), or processor for your own client (Module 3). Activities: using PennyPost to see where your app's users stall and to email them.
Data importer: [LEGAL NAME], [POSTAL ADDRESS]. Contact: hello@usepennypost.com. Role: processor (Module 2) or sub-processor (Module 3). Activities: providing PennyPost.

Subject matter and duration. Providing PennyPost to you, for as long as the Terms last and until the data is deleted under section 10.

Nature and purpose. PennyPost records what your users do in your app (page views and key actions), works out where each new user stalls, and sends your emails at those moments from your domain. It records delivery, opens and clicks, and measures who came back, including by holding back a comparison group that gets no email. It also stores your contacts and sends your other emails, such as campaigns and workflows.

People the data is about. Your app's users, and other contacts you add to PennyPost, such as newsletter subscribers.

Personal data

Email address, and first and last name.
Tags and custom fields you add.
Page paths opened in your app, without query strings or anything after a #.
Key actions (event names) and the details you send with them, up to 2 KB each.
Time zone, such as Europe/Berlin.
Status and dates: subscribed, confirmed, unsubscribed, last seen in your app, last seen on a key page.
Workflow progress, and whether the person was in the comparison group and came back.
Emails sent: the address, the status, the mailbox provider, and when each one was sent, delivered, first opened, first clicked, bounced or marked as spam. Opens and clicks are only recorded while tracking is on.
Reports from receiving mail servers about bounces, complaints, delays and rejections.
IP addresses and request details in our host's server logs, and IP addresses or email addresses in short-lived rate-limit counters.

Special categories of data. None. You agree not to send them (section 4).

How often. Continuously, while you use PennyPost.

How long

Page views and key actions: 180 days, then deleted automatically.
The record of each email sent: 180 days, then deleted, with only totals kept.
Contacts, workflow progress and comparison results: until you close your account, or until you ask us to delete them.
Bounce, complaint, delay and rejection reports: until you close your account, with the exception in section 10.
Rate-limit counters: up to two days.
Suppression list entries: as section 2 describes.

Transfers to sub-processors. The same subject matter, nature and duration, for the part of the work each one does. See the Subprocessors page.

Competent supervisory authority. As Clause 13 of the SCCs sets out.

Annex 2: Security measures

Our Security page is this annex. In short:

HTTPS only, with HSTS; database connections over TLS; database storage encrypted at rest by MongoDB Atlas.
Resend keys, Resend webhook secrets and rotated identity secrets encrypted by us with AES-256-GCM.
Passwords stored as scrypt hashes; API keys, PostHog and Segment ingest tokens and password reset tokens stored as SHA-256 hashes.
Snippet data accepted only with an HMAC-SHA256 signature of the user's email address, made on your server with your app's identity secret, which you can rotate.
A valid session or API key needed for every dashboard page and API route; each customer's data kept apart by workspace; the admin area limited to the people who run PennyPost.
Page paths without query strings, no IP addresses or browser details stored with page views, opens or clicks, event details capped at 2 KB, and automatic deletion after 180 days.
A consent mode in the snippet, and open and click tracking that starts off for each new app, with a switch per app.
Signed links in emails, signed webhooks and background jobs, and rate limits on logins, signups, public forms and the APIs.
Security Incident notice within 48 hours (section 9).

Contact

[LEGAL NAME]
[POSTAL ADDRESS]
hello@usepennypost.com