Data Processing Agreement

Definitions

For the purposes of this Data Processing Agreement ("DPA"):

• Controller: The customer who uses Postflare to send emails on behalf of their end users. The Controller determines the purposes and means of processing personal data.
• Processor: Postflare, which processes personal data on behalf of the Controller to provide the email sending service.
• Sub-Processor: A third-party service provider engaged by Postflare to assist in processing personal data.
• Personal Data: Any information relating to an identified or identifiable natural person, as defined by GDPR Article 4(1).
• Data Subject: The individual whose personal data is processed (e.g., email recipients).
• Processing: Any operation performed on personal data, including collection, storage, transmission, and deletion.

Scope and Purpose

This DPA governs the processing of personal data by Postflare (Processor) on behalf of the customer (Controller) in connection with the provision of the Postflare email sending service.

Postflare processes personal data to:

• Deliver emails, including transactional messages and broadcasts, as instructed by the Controller via the API or dashboard
• Track email delivery status (sent, delivered, bounced, failed)
• Provide analytics and reporting on email sending activity
• Maintain logs for debugging and abuse prevention

Postflare does not process personal data for its own purposes beyond what is necessary to provide the Service.

Data Processing Details

Categories of Data Subjects

• Email recipients (end users of the Controller)
• Controller's account users (dashboard and API users)

Types of Personal Data Processed

• Recipient data: Email addresses of recipients
• Email metadata: Sender address, subject line, timestamps, delivery status, message IDs
• Email content: HTML and text content of sent and received emails, stored in Cloudflare R2
• Account data: Controller's user email addresses, organization name, API key metadata
• Technical data: IP addresses, user agent strings, request logs

Duration of Processing

Personal data is processed in connection with the service agreement. Postflare does not specify a fixed deletion period after termination; see Section 8 (Data Deletion).

Sub-Processors

Postflare engages the following sub-processors to provide the Service:

Sub-Processor Changes

We may notify the Controller before engaging a new sub-processor or making material changes to existing sub-processor arrangements. The Controller may contact us with an objection. If the objection cannot be reasonably resolved, the Controller may terminate the agreement.

All sub-processors are bound by data processing agreements that impose obligations no less protective than those in this DPA.

Security Measures

Postflare implements the following technical and organizational security measures:

Technical Measures

• Encryption in transit: Data transmitted between clients and Postflare services is encrypted using TLS
• Encryption at rest: Database and object storage data is encrypted using provider-managed encryption keys
• Access controls: Role-based access control for internal systems; API key authentication for customer access
• Isolation: Customer data is logically isolated within shared infrastructure

Organizational Measures

• Access to production systems is limited to authorized personnel on a need-to-know basis
• Regular security reviews of infrastructure and application code
• Incident response procedures for security events
• Secure development practices including code review and dependency scanning

Data Breach Notification

In the event of a personal data breach:

1. Notification timeline: Postflare will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach.

2. Notification content: The notification will include:

   • A description of the nature of the breach, including the categories and approximate number of data subjects and records affected
   • The name and contact details of the point of contact for further information
   • A description of the likely consequences of the breach
   • A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects

3. Cooperation: Postflare will cooperate with the Controller in investigating and remediating the breach, and in meeting the Controller's obligations to notify supervisory authorities and data subjects where required.

Data Subject Rights

Postflare will assist the Controller in fulfilling data subject requests, including:

• Access requests: Providing the Controller with the personal data held about a data subject
• Deletion requests: Assisting with the deletion of personal data associated with a specific data subject upon the Controller's instruction; data stored in Cloudflare R2 may require manual removal
• Export requests: Assisting with requests for personal data exports
• Rectification requests: Correcting inaccurate personal data upon the Controller's instruction

Data subjects should direct their requests to the Controller, not to Postflare directly.

Data Deletion

Postflare does not specify a fixed period for deleting personal data after termination of the service agreement. Email content and API request log bodies are stored in Cloudflare R2; account and email metadata are stored in Supabase PostgreSQL.

Audit Rights

The Controller has the right to audit Postflare's compliance with this DPA, subject to the following conditions:

• The Controller must provide at least 30 days' written notice before conducting an audit
• Audits will be conducted during normal business hours and will not unreasonably disrupt Postflare's operations
• The Controller bears the costs of the audit unless the audit reveals material non-compliance by Postflare
• Postflare may satisfy audit requests by providing relevant compliance certifications, audit reports, or other documentation

International Data Transfers

Postflare uses Cloudflare's global edge network, which means personal data may be processed in multiple jurisdictions, including countries outside the European Economic Area (EEA).

For transfers of personal data outside the EEA, Postflare relies on:

• Standard Contractual Clauses (SCCs) as approved by the European Commission
• Sub-processor data processing agreements that include appropriate transfer mechanisms
• Cloudflare's own data processing and international transfer agreements

The Controller acknowledges that the nature of edge computing means API requests are processed at the nearest Cloudflare data center to the request origin, which may be in any jurisdiction where Cloudflare operates.

Contact

For questions about this Data Processing Agreement, contact us at:

Email: legal@postflare.dev