Privacy Policy

1. Who this policy covers

This Privacy Policy explains how Envoi handles data when you use our email and SMS marketing platform ("the Service"). It covers two kinds of data: information about you as an Envoi account holder, and the subscriber and contact data you bring into the Service to run your own messaging.

2. Information we collect

We collect the information needed to operate the Service:

• Account information — your name, email address, organization, and authentication details.
• Billing information — subscription and payment details, processed by Stripe. We do not store full card numbers.
• Content you create — email templates, campaigns, SMS messages, automations, and media you upload.
• Contact data you provide — the subscriber records, list membership, and events you import or collect through forms and integrations.
• Messaging and engagement data — send, delivery, open, click, reply, bounce, and unsubscribe events used for analytics.
• Usage and device data — logs, IP address, and telemetry used to operate, secure, and improve the Service.

3. Your contacts’ data belongs to you

The subscriber and contact data you load into Envoi is yours. For that data, you are the controller and Envoi acts as your processor: we process it on your instructions to send your messages, run your automations, and produce your analytics. We do not use your subscriber data to market our own products, and we do not sell it.

You are responsible for having a lawful basis and appropriate consent to collect and message your contacts.

4. How we use information

We use data to provide and operate the Service, deliver your email and SMS, generate analytics, provide support, maintain security, prevent abuse and fraud, and meet legal obligations. We do not sell personal information.

5. Tracking pixels and click tracking

To measure campaign performance, the Service can embed an open-tracking pixel in emails and rewrite links so clicks are recorded before redirecting to the destination. This produces the open and click metrics in your analytics. You are responsible for disclosing this tracking to your recipients where the law requires it.

6. Cookies and sessions

When you sign in to the Envoi dashboard, we use cookies to keep you authenticated and to remember essential preferences such as onboarding state. These are used to run the application, not to build advertising profiles.

7. Subprocessors

We share data only with the infrastructure and messaging providers required to operate the Service, under contractual safeguards. Our current subprocessors are:

• Stripe — subscription billing and payment processing.
• Resend — outbound email delivery.
• Telnyx and Twilio — SMS delivery and phone number provisioning.
• Vercel and Fly.io — application hosting and compute.
• Neon — the managed PostgreSQL database where your data is stored.
• Backblaze — object storage for uploaded media and assets.

8. Security and retention

We use technical and organizational controls — including encryption in transit, access controls, and scoped credentials — to protect data. No system is perfectly secure, and we cannot guarantee absolute security. We retain data for as long as your account is active or as needed to provide the Service, and longer only where required to meet legal obligations.

9. Data deletion and your choices

You can access, correct, export, and delete much of your data directly in the app, including individual contacts and campaigns. You may request deletion of your account and associated data by contacting us; we will delete or de-identify it within a reasonable period, except where retention is legally required. Recipients of your messages can unsubscribe or update their preferences at any time, and we honor those requests.

10. Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

11. Contact

For privacy requests or questions about this policy, contact privacy@envoi.email.