Privacy Policy

01Two different roles

We handle personal data in two capacities, and your rights differ between them.

As a controller — for our own customers

When you create an account we decide what to collect and why: your name, email address, billing details, and how you use the service. For this data we are the controller and this policy governs it.

As a processor — for your recipients

When you send a message, the recipient address and the message content are your data. You decide who to send to and what to say; we only act on your instructions. For that data you are the controller and we are the processor.

02What we collect

Account data

• name, email address, and company name if given;
• a hashed password, or an identifier from a federated sign-in;
• billing contact details and tax identifiers;
• support correspondence.

Card details are handled by our payment processor and never reach our servers. We hold only the last four digits, the card type and the expiry so you can recognise the card on an invoice.

Sending data

• the domains you add and the DNS records published for them;
• message metadata — identifiers, timestamps, sender, recipient address, size, the sending IP, the status and the response the receiving server returned;
• message content, transiently, for as long as delivery and troubleshooting require;
• engagement events where you have enabled tracking: opens and clicks, with the time and the user agent or IP that generated them.

Technical data

• API and SMTP access logs, including the IP address used;
• security logs — sign-in attempts, key creation and rotation.

03Why we hold it

We do not sell personal data, and we do not use the content of your messages for any purpose other than delivering them and helping you diagnose what happened to them.

04How long we keep it

Suppression records are the deliberate exception. When someone unsubscribes or complains we keep a minimal record — the address, hashed, and the date — so the opt-out can continue to be honoured. Deleting it would mean being unable to respect a choice the person already made.

05Who else sees it

We share personal data only with:

• receiving mail providers — delivering a message necessarily discloses the sender, the recipient and the content to the recipient's mail provider;
• subprocessors, listed below, under contract;
• authorities, where we are legally required to. Where we are permitted to tell you about such a request, we will;
• a buyer, if the business is sold, on notice to you.

06Subprocessors

We use a small number of providers to operate the service. The current list, and the function each performs, is available on request from privacy@bookmyspot.us and is provided as an appendix to the Data Processing Addendum.

Customers with a signed DPA are notified before a new subprocessor is added, with an opportunity to object.

07International transfers

Email is global by nature: a message addressed to a recipient abroad is transmitted to that country, and that transfer is intrinsic to the service you asked for.

Where we transfer personal data out of the UK or the EEA to a country without an adequacy decision, we rely on the appropriate safeguards — ordinarily the Standard Contractual Clauses, together with an assessment of the destination.

08Security

• TLS in transit, including opportunistic TLS on outbound mail and enforced TLS to providers that support it;
• encryption at rest for message content and credentials;
• API keys and SMTP credentials stored hashed, shown once at creation;
• access to production limited to the staff who need it, logged;
• separation of customer data by tenant, enforced at the data layer.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to you, we will notify you and the relevant supervisory authority within the time the law requires.

09Your rights

Where we are the controller — that is, for your own account data — you can ask us to:

• give you a copy of the data we hold about you;
• correct it if it is wrong;
• delete it, where we have no overriding obligation to keep it;
• restrict or object to a particular use;
• provide it in a portable format;
• stop sending you marketing, at any time.

Write to privacy@bookmyspot.us. We respond within one month. You may also complain to your local data protection authority.

10If you received an email sent through us

We transmitted that message; we did not decide to send it to you, and we do not hold a relationship with you. The sender is the controller of your data.

Use the unsubscribe link in the message — it works without a login and is honoured promptly. To have your data deleted entirely, contact the sender, whose identity is in the message. If you cannot reach them, or the message breaches our rules, write to abuse@bookmyspot.us with the full headers and we will act on it.

11Cookies

This marketing site sets no tracking cookies and embeds no third-party advertising or analytics scripts. A single local preference is stored in your browser to remember your light or dark setting; it never leaves your device and is not readable by us.

The dashboard sets a session cookie, which is strictly necessary to keep you signed in.

Open and click tracking, where a customer enables it, applies to the messages that customer sends — not to this website.

12Contact

BookMySpot, [registered address].
Privacy enquiries: privacy@bookmyspot.us
Abuse reports: abuse@bookmyspot.us