This Privacy Policy explains how personal data is processed when you use agdir.email (the website, the dashboard, the API and the MCP server). agdir.email is developed and supported by Agdir and provided by Agdir Drift AS, Norway (“we”, “us”). It also forms part of the data processing agreement in our Terms of Service.
1. Our two roles
- Controller — for data about our customers and users: your account, team membership, sign-in, billing, support and the security of the Service.
- Processor — for the email our customers send through the Service and the data about its recipients (“Customer Data”). The customer that sends the email is the controller. If you received an email sent through agdir.email and have questions about it, please contact the sender; we will help them answer you.
2. Data we process as controller
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: email address, name and profile picture (from Google or GitHub when you sign in with them) | Create and run your account, sign you in | Contract, Art. 6(1)(b) |
| Team data: team names, roles, invitations (the invitee’s email address) | Let teams collaborate | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f), for invitees |
| Session and security data: IP address, browser user agent, sign-in attempts, audit entries (for example who paused or unpaused a team) | Keep accounts secure, prevent abuse, investigate incidents | Legitimate interest, Art. 6(1)(f) |
| Usage data: number of emails sent, bounce and complaint rates, API usage | Enforce plan limits, protect deliverability, bill overage | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Billing data: billing name, address, VAT number, plan, invoices and payment status (card details are handled by Stripe, not stored by us) | Charge for paid plans, bookkeeping | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Correspondence: emails to support and service messages we send you | Support, notices about your account (for example a paused team or a failing webhook) | Contract, Art. 6(1)(b) |
We do not sell personal data, do not use it for advertising and do not send you marketing without your consent.
3. Data we process on behalf of customers
When a customer sends email through the Service we process, on their instructions: sender and recipient addresses (to, cc, bcc, reply-to), subject, content, attachments, headers and tags; delivery events (sent, delivered, bounced, complained and, if the customer enables tracking, opened and clicked, which can include IP address and user agent); suppression lists; and webhook payloads sent to the customer’s endpoints. We use this data only to deliver email and show the customer its logs, and to protect the Service against abuse.
4. How long we keep data
- Email content, logs and events are kept for the log period of the customer’s plan (3 days on Free, 30 days on Pro and Scale) and then deleted automatically, together with the webhook messages and delivery attempts about them. Emails that are scheduled or still waiting to be sent are kept until they have been sent. Attachments are stored for at most 30 days.
- Suppression lists are kept until the customer removes an address or closes the account, because their purpose is to prevent sending to the address again.
- Account and team data are kept while the account is active and deleted within 90 days after it is closed.
- Billing records are kept for 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act (bokføringsloven).
- Sign-in sessions (with IP address and browser) expire after 30 days and are then deleted.
- Security and audit logs (for example who paused a team) are kept for 12 months.
5. Where data is processed and sub-processors
Customer Data is stored and processed in the EU/EEA. We use these sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Email sending (SES), event queues, attachment storage | EU — Stockholm (eu-north-1) |
| Hetzner Online GmbH | Servers and databases for the website, dashboard and API | EU — Germany |
| Stripe Payments Europe Ltd. | Payments and invoicing (controller data only) | EU — Ireland; may transfer to the USA |
| Google Ireland Ltd. / GitHub, Inc. | Sign-in (“Continue with Google/GitHub”) | EU / USA |
Where data is transferred outside the EU/EEA (for example by Stripe or GitHub), the transfer is based on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. If you connect Cloudflare for one-click DNS setup, we use the token you provide only to create DNS records in your own Cloudflare account. We will announce changes to our sub-processors in advance.
6. Cookies and local storage
We use only what is strictly necessary for the Service, so no consent banner is needed. We do not use analytics or advertising cookies.
better-auth.session_token(and related Better Auth cookies) — keeps you signed in.agdir_team— remembers the team you selected in the dashboard.agdir_lang— remembers your language choice.theme(local storage in your browser) — remembers light or dark mode.
7. Security
All traffic is encrypted with TLS. Access to production systems is restricted to authorised personnel. API keys are stored as hashes, DKIM private keys are encrypted at rest, webhooks are signed, and sending is monitored for abuse.
8. Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. Where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact support@agdir.email; we answer within one month. For Customer Data, please contact the customer that sent the email — we forward requests we receive to them. You may also complain to the Norwegian Data Protection Authority, Datatilsynet, or the supervisory authority where you live.
9. Changes
We may update this Privacy Policy. The date at the top shows the latest version; we notify customers by email or in the dashboard about material changes.
10. Contact
Agdir Drift AS — support@agdir.email.