Data Processing Agreement

This Data Processing Agreement (DPA) is part of the Shipmail Terms of Service. It applies automatically to every organization that uses Shipmail to process personal data, from the moment the organization is created. No signature is needed. If you need a countersigned copy for your records, email us and we will send one.

In this DPA, you are the controller and Shipmail is the processor within the meaning of Article 28 of the General Data Protection Regulation (GDPR). The service is operated by Shipmail, established in the European Union.

Subject matter: hosting, sending, receiving, storing, and searching business email, together with calendars, contacts, newsletters, booking pages, the API, the optional AI Assistant, and automatic calendar-event detection in incoming mail, on by default, while AI features are on for your organization.

Duration: for as long as your organization exists on Shipmail, plus the deletion period described below.

Nature and purpose: providing the service you subscribed to, exactly as described in the documentation and configured by you and your team.

• Content of email messages, attachments, calendar events, contacts, and newsletters.
• Message metadata: sender and recipient addresses, subjects, dates, headers, and delivery events.
• Names, email addresses, and settings of your team members.
• Technical data such as IP addresses, client identifiers, and API request logs.

Data subjects include your team members, the people you correspond with, your customers and newsletter subscribers, and anyone else mentioned in the data you store.

We process personal data only on your documented instructions. Your instructions are the Terms of Service, this DPA, the settings you configure, and the actions you and your team take in the product and through the API. We do not use the content of your mailboxes for our own purposes. Product analytics, advertising measurement, and crash diagnostics are described in the privacy policy, where Shipmail acts as controller.

If a law of the European Union or of a member state requires us to process your data differently, we tell you before we do so, unless that law forbids it. If we think one of your instructions breaks the GDPR, we tell you.

Everyone who works on Shipmail is bound by confidentiality. Access to production systems is limited to the people who operate the service, and we access your data only to run the service, investigate an issue you report, meet a legal obligation, or deal with a security incident or abuse of the service.

• Every connection is encrypted with TLS. IMAP, SMTP, JMAP, and the web interface all require encrypted connections.
• Messages and attachments are stored encrypted at rest, and backups are encrypted before they leave our servers. Shipmail's servers can decrypt stored mail to provide search, filtering and the assistant, so it is not end-to-end encrypted. A person at Shipmail reads the content of your email only with your permission, when the law requires it, or to deal with an active security incident or abuse of the service.
• Two-factor authentication with an authenticator app, brute-force protection, and an audit log of security-relevant changes.
• Encrypted backups with a limited retention period.
• Least-privilege access to infrastructure and separate credentials for mail data and administration.

The security page describes these measures in more detail. We keep them under review and improve them over time. We will not lower the level of protection during the term of this DPA.

• Security at Shipmail

• Hetzner (Germany): hosting of the application and the mail servers, and our own server that runs the open-source model for calendar suggestions.
• Neon* (United States): PostgreSQL database hosting, in an EU region.
• Amazon Web Services* (United States): outbound email relay and encrypted storage of mail data, in EU regions.
• Cloudflare* (United States): edge network and encrypted backup storage.
• Upstash* (United States): short-lived rate-limit counters.
• Resend* (United States): Shipmail's own transactional email, such as magic links and billing notices. Your mailbox email does not go through Resend.
• Stripe* (United States): payment processing.
• Sentry* (United States): crash and performance diagnostics.
• PostHog* (United States): product analytics and masked session replay.
• Crisp (France): customer-support chat.
• OpenAI* (United States): the optional AI Assistant and AI writing help in the composer (improve or shorten a draft), only after a user has enabled AI features, and an automated check of each newsletter issue's and welcome email's subject and content before it goes out, for phishing, malware, scams and abuse. The check never receives your subscribers, and OpenAI keeps it at most 30 days for abuse monitoring. OpenAI does not use your data to train its models.
• Google* and Zoom* (United States): optional calendar address suggestions and conferencing links, only if you connect them.

We use the following providers to run Shipmail. Our core application, database, and mail infrastructure run in the European Union, in Germany. Providers marked with an asterisk are established outside the EU and may process limited data there; see the section on international transfers.

You authorize the subprocessors listed above. Each one is bound by a written contract that imposes data protection obligations at least as protective as this DPA, and we remain responsible to you for their work.

If we want to add or replace a subprocessor, we email your organization owner at least 30 days before the change and update this page. If you object on reasonable data protection grounds and we cannot offer an alternative, you can cancel your subscription before the change takes effect.

Our core mail infrastructure and database stay in the European Union. Backups are encrypted before upload and stored in European regions. Requests to OpenAI for the AI features described above are a transfer to the United States. Where a subprocessor established outside the EU processes personal data, the transfer is covered by an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for providers certified under it, or by the Commission's Standard Contractual Clauses together with any additional safeguards those clauses require.

• Data subject requests: the dashboard and API let you export, correct, and delete data yourself. If a data subject contacts us directly about your data, we forward the request to you and do not answer on your behalf.
• Security incidents: if we become aware of a personal data breach affecting your data, we notify your organization owner without undue delay and no later than 72 hours after becoming aware of it, with what we know about the nature of the breach, the data concerned, the likely consequences, and the measures taken.
• Impact assessments: we answer reasonable written questions to help you carry out a data protection impact assessment or a consultation with a supervisory authority.

On request, we give you the information you need to show that we meet Article 28 GDPR, starting with this DPA, the privacy policy, and the security page. If that is not enough, you or an independent auditor you mandate can audit our processing once per year, or after a personal data breach or a request from a supervisory authority. Give us at least 30 days' notice, agree the scope with us in advance, keep findings confidential, and bear the cost of the audit.

You can export every mailbox at any time as a ZIP of .eml files with folders, calendars, contacts, and checksums, from the dashboard or the API. If you cancel, your mailboxes are suspended at the end of the billing period and nothing is deleted. After 30 days a suspended mailbox is archived and is restored in full if you subscribe again.

If you delete your organization, we delete your data within 30 days. Encrypted backups are deleted within 90 days. Audit logs are kept longer for security purposes. They are no longer linked to your organization, but can still contain IP addresses and the email addresses or domain names involved in an action. We keep data beyond these periods only where a law of the European Union or of a member state requires it.

• Export and delete your data

The liability provisions of the Terms of Service apply to this DPA. If this DPA conflicts with the Terms of Service or the privacy policy on the processing of personal data, this DPA prevails.

We may update this DPA. Material changes will be communicated by email at least 30 days before they take effect.

• Terms of Service
• Privacy Policy

Questions about this DPA, or need a countersigned copy? Email us at support [at] shipmail.to.