List Data Privacy Policy
Last updated: 5 October 2026
Contact data uploaded or sent through the API
Contact (list) data is kept until the customer deletes it or closes the account, then deleted within 30 days; encrypted in transit; backups encrypted.
All customer data is stored in the European Union.
Encryption
Encryption in transit: HTTPS/TLS for all web and API traffic; STARTTLS between Spotzee and Sendmux and on outbound mail whenever the receiving server supports it.
Encryption at rest: every backup is encrypted before it leaves our servers, plus storage-side encryption at the backup provider.
Retention
- Customer data
- Life of the account; customers can delete any record at any time; deleted or returned within 30 days after an account closes
- Delivery records
- With the customer's data, for the life of the account
- Service, application and security logs
- Rotated automatically and kept only as long as needed to run and secure the service
- Database backups
- 28 days (7 daily, 4 weekly)