1. Who we are

This Privacy Policy describes how Notify ("Notify," "we," "us," or "our") collects, uses, shares, and retains information when you use the Notify website, dashboard, API, and related services (the "Service"). Notify is a transactional email API. Our Terms of Service and Acceptable Use Policy also apply.

For privacy questions or requests, contact privacy@notify.cx. Legal notices may also be sent to legal@notify.cx.

2. Roles: your account vs email you send

When you create an account and use the dashboard, we decide how to process your account and billing data (we act as a controller for that information under UK GDPR where it applies).

When you send email through the API (recipients, subjects, content, and related metadata), you determine what is sent and why. In that case you are typically the controller of recipient and message data, and Notify processes it on your instructions to deliver and log mail. You are responsible for having a lawful basis and any notices or consents required for the people you email.

3. Information we collect

Account and profile

Email address, password (handled by our auth provider), and optional profile details you submit (for example name, company size, use case, or how you found Notify).
If you sign in with Google or GitHub, we receive basic profile information those providers share (such as email, name, and avatar).
Account settings, domains you verify, webhook URLs, and API keys you create.

Billing

Subscription plan, status, and related billing records. Payment card details are processed by Stripe; we do not store full card numbers on our servers.

Email content and delivery data

Data needed to send and track mail you initiate: from and to addresses, subject, message body (including HTML you submit), timestamps, message IDs, delivery status, bounce/complaint events, and related metadata.
Domain and DNS verification records you configure for sending.
Suppression or blocklist entries associated with delivery failures or abuse prevention where applicable.

Usage, security, and product data

API and dashboard usage (including approximate volumes, errors, and product events we record to operate and improve the Service).
Technical logs such as IP address (or a hash of it at signup for abuse checks), user agent, and request metadata.
reCAPTCHA tokens during signup to reduce automated abuse (processed with Google).

Website analytics

We use Google Analytics on the marketing site to understand traffic and page performance. Analytics may use cookies or similar identifiers. Browser settings and consent tools (where offered) may limit this.

4. How we use information

We use information to:

Provide, operate, and secure the Service (including sending email via our infrastructure providers).
Authenticate users, manage API keys, and enforce plan limits.
Process payments and prevent fraud or abuse.
Show logs, usage, and delivery events in your dashboard.
Deliver transactional product emails (for example welcome or account notices).
Respond to support requests and investigate incidents.
Understand product health and improve the Service (for example aggregate usage and error rates).
Comply with law and enforce our Terms and Acceptable Use Policy.

We do not sell your personal data. We do not use the content of emails you send through Notify to build advertising profiles or to train third-party AI models.

5. How we share information

We share information with service providers that help us run Notify, only as needed for their role. Current categories include:

Hosting and application delivery — for example Vercel, which hosts the website and API.
Database and authentication — Supabase for account data, sessions, and application storage.
Email delivery — Amazon SES (and related AWS services) to transmit mail and receive delivery events.
Payments — Stripe for subscriptions and invoices.
Security and analytics — Google for reCAPTCHA and Google Analytics on the marketing site.

We may also disclose information if required by law, to protect Notify or others from fraud or security threats, or in connection with a merger, acquisition, or sale of assets (with appropriate safeguards).

When you configure webhooks, we send delivery events to the endpoints you specify. Those endpoints are under your control and subject to your policies.

6. Cookies and similar technologies

We use cookies and similar technologies that are necessary to keep you signed in and operate the dashboard (session cookies managed through our auth provider). The marketing site may use Google Analytics cookies as described above. You can control cookies through your browser; blocking necessary cookies may prevent login or other features from working.

7. Retention

Account data is kept while your account is active and for a reasonable period afterward if needed for billing, disputes, abuse prevention, or legal obligations.
Email logs in the dashboard: Free plans can view the last 48 hours of logs; Pro and Scale plans have permanent log visibility as described on our pricing page. We may retain underlying log or delivery records longer where needed for abuse investigation, security, or legal compliance, even if they are not shown in the Free dashboard view.
Billing records are retained as required for accounting and tax purposes (via us and Stripe).

If you want your account deleted, contact privacy@notify.cx. We will delete or anonymize personal data we control where we are not required to keep it. Message content you sent may already have been delivered to recipients or mailbox providers outside our control.

8. Security

We take practical steps to protect data appropriate for a small software service: the Service is served over HTTPS; account access uses authenticated sessions; API access uses API keys you create; and our application data is stored with managed cloud providers (including Supabase and AWS) that provide their own physical and infrastructure security.

We are not claiming certification under SOC 2, ISO 27001, or similar frameworks at this time, and we do not promise that any system is perfectly secure. You are responsible for protecting your password and API keys, and for configuring domains and webhooks carefully. If you believe your account has been compromised, contact us promptly.

9. International transfers

We and our providers may process data in the United Kingdom, European Economic Area, United States, and other countries where those providers operate. Where required, we rely on appropriate transfer mechanisms offered by those providers (such as standard contractual clauses) or other lawful bases.

10. Your rights

Depending on where you live (including under UK GDPR), you may have rights to access, correct, delete, or restrict certain personal data we hold about you as a Notify account holder, to object to certain processing, and to data portability. You may also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

To exercise these rights for your Notify account data, email privacy@notify.cx. We may need to verify your identity first. Requests about recipient data contained in emails you sent should usually be directed to you as the sender; we can assist where we hold that data as your processor.

11. Children

The Service is for users 18 and older. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will take appropriate steps.

12. Changes

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. For material changes, we may also notify you by email or in the Service. Continued use after the effective date means you accept the updated policy.

13. Contact

Privacy requests: privacy@notify.cx. General legal: legal@notify.cx.