Data handling
This page is our data-handling disclosure. In short: your contacts and everything about them are stored only in your AWS account. Our account holds the configuration needed to run the service for you, and no contact data. Supervillain Software Group is the processor of your contacts’ data; you’re the controller. See Processing details.
Collection
Section titled “Collection”Your contacts’ data, which you send us through the API or an import, or which SES reports about your emails:
- email addresses, custom fields and tags,
- consent records: where, when and how each contact agreed, and optionally their IP address,
- engagement: sends, deliveries, opens, clicks, bounces, complaints and unsubscribes, and the score worked out from them,
- during a Mailchimp import, the members and activity you ask us to read.
Your account’s data, which we need to run the service:
- your company name, the admin email you registered with, your AWS account ID, Region and sending domain,
- your console users’ email addresses and sign-in methods (your staff, not your contacts),
- hashes of your API keys, and the keys that encrypt your unsubscribe links,
- your AWS Marketplace subscription and billing records,
- setup-help requests from the console: who asked, what they ticked and their notes, emailed to us,
- IDs-only records of security-relevant actions, such as a key created or revoked, a failed sign-in or an admin change.
We don’t use cookies for tracking, and our websites load nothing from other companies.
Storage
Section titled “Storage”| Data | Where | Encryption |
|---|---|---|
| Contacts, consent, engagement, campaigns, send records, settings | Your DynamoDB tables, in your account and Region | AWS-owned keys, or your own KMS key |
| Event archive, CSV uploads, exports | Your S3 buckets | SSE-S3, or your own KMS key |
| Mailchimp credentials during an import | Your SSM Parameter Store | SecureString |
| Work waiting to be done: batches to send, SES events to apply, imports to run | Our SQS queues, shared by all clients: IDs only, never an address or content | SSE-SQS |
| Your account’s data | Our DynamoDB registry, Secrets Manager and Cognito, in the United States | Our customer-managed KMS keys (the registry and secrets); AWS-managed encryption (Cognito) |
| Logs | Our CloudWatch Logs: IDs and counts only | Our customer-managed KMS keys |
Contact data passes through our functions in memory while we send your emails, write your events back and run your imports. We don’t store it in our account: not in a database, queue, log, trace or backup. Our queues carry only IDs, and SES events are cut down to IDs, timestamps and flags on our event bus before they’re queued. Everything travels over TLS. See Security for how this is enforced and how you can check it.
We use your contacts’ data only to do what you ask through the service: send your campaigns and tests, record their results, run your imports and exports, and answer your API requests. If you buy setup help, our people do the work in its statement of work through your console and API, with an API key you create and revoke, and keep no copy of your contacts. We use your account’s data to run, bill, secure and support the service. We never sell data, use it for advertising or profiling, or use it to train models, and we never email your contacts on our own behalf.
Sharing
Section titled “Sharing”We don’t sell your data or share it for advertising. Our sub-processors are Amazon Web Services, which runs our service, and Google, which runs our email: see Sub-processors. We read from Mailchimp only when you connect it for an import. If a law ever required us to disclose data, we’d tell you first unless the law forbids it; and because your contacts are stored in your account, not ours, a request for them would have to go to you.
Retention
Section titled “Retention”In your account, you control retention. The template sets these defaults:
| Data | Kept |
|---|---|
| Contacts and campaigns | Until you delete or erase them |
| Send records | 400 days, then removed automatically |
| Raw SES event archive | ArchiveRetentionDays, 400 days by default |
| CSV uploads and exports | 7 days |
| Idempotency records | 24 hours |
| Mailchimp credentials | Until you commit or cancel the import |
In our account:
| Data | Kept |
|---|---|
| Logs (IDs and counts only) | 14 days |
| Queue messages, and messages set aside by flood protection (IDs only) | Until they’re processed, at most 14 days |
| API request log for the console (no bodies or addresses) | 14 days |
| Security audit records (IDs only, our system data) | 400 days, in a tamper-protected Object Lock bucket |
| Our AWS CloudTrail logs | 400 days, with Object Lock |
| Your account’s registry entry, API-key hashes and console users | While you’re a customer. They’re deleted 30 days after you disconnect, or 30 days after read-only mode ends when a contract isn’t renewed, apart from license and billing records we must keep by law. |
Backup
Section titled “Backup”- Your tables have point-in-time recovery and deletion protection, and are kept if you delete the stack. Recovery happens in your account, under your control.
- Your buckets are kept if you delete the stack. The optional CloudTrail bucket is versioned, with 400-day Object Lock.
- Our registry has point-in-time recovery. It holds no contact data, so neither do its backups.
- We keep no copies of your contacts, so there’s no backup of them on our side to restore, leak or delete.
Deletion
Section titled “Deletion”- To erase one contact, use
DELETE /contacts/{id}. - To remove everything, disconnect, then delete the stack and its retained tables and buckets in your account. We delete your registry entry and console users 30 days after you disconnect.
Questions about this page go to support.