Privacy

Privacy Notice

This notice explains the categories of data Postline may process and the controls available to customers.

Data categories

  • Account and technical-contact details
  • Sending domains and configuration
  • Recipient addresses and delivery metadata
  • Message content only when enabled or required for delivery
  • API, authentication, audit, abuse, and webhook logs

Operator and legal basis

The Postline service and account data controller is Individual Entrepreneur Mishagin Vyacheslav Vladimirovich (INN 390609456123; OGRNIP 324390000046940). For email data submitted by a customer, the customer normally determines the purpose and lawful basis and Postline acts as processor under the applicable Terms, order, and DPA.

Purpose and roles

Postline processes service-account data to operate and secure the platform. For email data submitted by a customer, the customer normally determines the purpose and Postline acts as a processor under the applicable agreement.

Current retention

  • Message records currently include recipient addresses, subject, and submitted text/HTML body and remain until project deletion, a verified deletion request, or an administrator cleanup. Plan retention labels are not yet an automated deletion guarantee.
  • Login codes stop working after 10 minutes and dashboard sessions after 30 days; only hashes are stored by the API.
  • The REST API rejects attachments. It accepts only In-Reply-To, References, List-Unsubscribe and List-Unsubscribe-Post custom headers (up to 8). Hosted mail is separate: the web client supports up to 20 attachments, 25 MiB total; the released desktop client has a 10 MiB sending limit. HTTP 202 and email.accepted mean acceptance into the processing pipeline; SMTP acceptance does not guarantee delivery or inbox placement.
  • Suppression entries remain while their delivery-safety or legal basis remains valid.

Security and transfers

TLS protects supported network paths; it is not end-to-end email encryption. Mailbox passwords and TOTP secrets are encrypted by the application. Message bodies are stored for processing and history; this is not a claim that every stored record or backup is encrypted.

Requests

Customers can request access, correction, export, or deletion through privacy@srs-postline.com. Postline may require identity and authority verification and may retain data where legally or operationally required.

Browser storage

The marketing site does not store cookies or local-storage identifiers. After successful dashboard login, the dashboard sets the essential postline_session cookie described in the Cookie Policy.