Privacy Policy

This policy is effective as of September 20, 2026 and applies to the wepamail website, the wepamail web application and the wepamail iOS application.

wepamail (“we”, “us”) is the controller of the account data described below and the processor of the contact data you upload. You can reach our privacy team at any time at support@wepamail.com.

We collect only what the product needs in order to work:

• Account data — your name, email address, password (stored only as a salted hash), and the team members you invite together with their role.
• Contact details you choose to give us — phone number and business details such as company name, mailing address and the physical postal address that bulk-email law requires in your footer.
• Email lists and contacts you upload — the email addresses, names, tags and any custom fields in the lists you import or collect through your signup forms.
• Campaign and sending activity — campaigns, templates, automations, segments, sending domains and their verification state, plus per-message delivery events (sent, delivered, opened, clicked, bounced, complained, unsubscribed).
• Device and usage data — IP address, browser or app version, device type, pages and screens used, actions taken, and crash or error diagnostics.
• Payment and billing data — plan, usage counters, invoice history, and the billing identifiers returned by our payment processor. We never receive or store full card numbers.
• Support communications — the messages you send us and our replies.

We do not collect location data beyond what an IP address implies, we do not use advertising identifiers, and we do not track you across other companies' apps or websites.

• To create and operate your account, authenticate you and keep you signed in.
• To send the campaigns and automations you configure, and to produce the reporting that tells you how they performed.
• To verify your sending domains and protect deliverability for every sender on the platform, including automatically pausing sending when bounce or complaint rates exceed safe thresholds.
• To bill you for your plan and any usage above your included allowance.
• To secure the platform, investigate abuse and comply with anti-spam and bulk-sender obligations.
• To provide support and to diagnose and fix faults.

Our legal bases are performance of our contract with you, our legitimate interest in security and platform reputation, compliance with legal obligations (including keeping unsubscribe and complaint records), and, where required, your consent.

You decide which contacts to upload and you must have permission to email each of them. We process those contacts only to deliver the messages you configure and to produce your reporting. We never email your contacts on our own behalf, never sell or rent your lists, and never use them to enrich anyone else's data. Opens are measured with a small tracking image and clicks by wrapping links; you can turn tracking off per campaign.

We use a small, fixed set of vendors, each bound by contract to process data only on our instructions:

• Supabase — authentication, database and file storage for all application data (hosted in the United States).
• Amazon Web Services (Amazon SES and supporting services) — our outbound email sending infrastructure and the delivery, bounce and complaint notifications it returns.
• Cloudflare — application hosting, content delivery and protection against abuse.
• Stripe — subscription billing and payment processing. Stripe receives your billing details directly and acts as an independent controller for payment data.
• Our own in-product analytics and error reporting — page and action counters plus crash diagnostics used to keep the app working. We do not use third-party advertising or cross-site tracking services.

An up-to-date list of processors, including any replacement vendor, is available on request.

Data is stored and processed in the United States. Where data originates in the European Economic Area or the United Kingdom, transfers rely on Standard Contractual Clauses with our processors.

• Account data: for as long as your account is open, then deleted within 30 days of account deletion.
• Contacts, lists, campaigns, templates and automations: deleted immediately when you delete them, or when you delete your account.
• Engagement events: up to 24 months, then reduced to aggregate totals.
• Suppression records (unsubscribes, hard bounces, spam complaints): kept indefinitely and retained after account deletion in a minimal form (email address and reason) — deleting them would allow a person who opted out to be emailed again.
• Invoices and tax records: retained for as long as tax and accounting law requires, typically seven years.
• Security and error logs: up to 12 months.

Data is encrypted in transit (TLS) and at rest. Every account's records are isolated at the database level with row-level security so one customer can never read another's contacts or reporting. Access to production data is restricted to the personnel who need it, and passwords are never stored in readable form.

You may access, correct, export or delete your personal data. Most of this is available directly in the app: your profile and business details under Settings, a full export of contacts and reporting from the relevant screen, and permanent account deletion under Settings → Danger zone (see /delete-account). Depending on where you live, you may also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your supervisory authority. We do not sell personal information and we do not engage in automated decision-making that has a legal effect on you.

If you received an email sent through wepamail and want to be removed, use the unsubscribe link in that message or contact the sender who holds the list; we will pass on any request we cannot action ourselves.

wepamail is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.

Write to support@wepamail.com with any privacy question or request. We acknowledge requests within 5 business days and answer within 30 days.

We will announce material changes in the app or by email before they take effect and update the effective date above.