Privacy Policy

StellarMail handles two categories of personal data, and our legal responsibilities are genuinely different for each. Reading this policy correctly depends on keeping them apart.

"Controller", "processor", "sub-processor", "personal data", and "data subject" have the meanings given in the EU General Data Protection Regulation ("GDPR"). Equivalent concepts under Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial legislation apply where relevant.

What we collect

• Identity and account data - full name, email address, hashed password or third-party identity provider identifier (for example, Google sign-in), tenant name, and account role.
• Billing data - subscription tier, invoices, payment status, and the billing identifiers held by our payment processor. We do not store full payment card numbers.
• Configuration data - sending domains you verify, DNS authentication records, API keys (stored hashed), templates, and site or form configuration.
• Usage and technical data - quota consumption, campaign counts, API request logs, IP addresses, browser user agent, timestamps, and error diagnostics.
• Support communications - messages you send us and our replies.

Why we process it, and our lawful basis

• Performance of a contract - to create and operate your account, authenticate you, deliver the service, enforce quotas, and bill you.
• Legitimate interests - to secure the platform, detect and investigate abuse and fraud, monitor deliverability and sending reputation, and improve the product. We consider these interests balanced against your rights, and you may object under section 7.
• Legal obligation - to retain financial records, and to respond to lawful requests from regulators including the CRTC and privacy authorities.
• Consent - for optional product announcements and marketing email from us, which you may withdraw at any time without affecting the service.

How long we keep it

Account data is retained while your account is active and for up to 12 months after closure, except where a longer period is required: financial and tax records are kept for 7 years, and abuse investigation records (including evidence of AUP violations) are kept as long as necessary to defend against regulatory action or claims.

Our application uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use third-party advertising cookies and we do not sell personal data or share it for cross-context behavioural advertising.

Separately, campaigns sent through the platform may include open-tracking pixels and click -tracking links. That tracking is configured by our customer for their campaigns; where it applies to you as a recipient, see section 9.

We do not sell personal data. We disclose it only to the sub-processors listed in section 5, to professional advisers under confidentiality, to an acquirer in connection with a merger or asset sale (subject to this policy), and to law enforcement, regulators, or upstream providers where legally required or reasonably necessary to investigate abuse of the platform.

The following sub-processors may process personal data - customer account data, subscriber data, or both - in the course of delivering StellarMail. Each is engaged under a written agreement imposing data protection obligations no less protective than those we owe our customers.

We will update this list before engaging a new sub-processor that processes subscriber data. Customers may object to a new sub-processor on reasonable data protection grounds by writing to privacy@stellarbyte.ca; if we cannot accommodate the objection, the customer may terminate the affected service.

We are based in Canada, and our sub-processors operate in Canada, the United States, and the European Union. Personal data may therefore be transferred outside your jurisdiction and be subject to lawful access requests by the courts and authorities of those countries.

Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's adequacy decision for Canada in respect of PIPEDA-covered organisations, and on Standard Contractual Clauses (with the UK Addendum where applicable) for transfers to sub-processors that adequacy does not cover.

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of or objection to processing, portability of data you provided to us, and withdrawal of consent where consent is the basis we rely on.

Send requests to privacy@stellarbyte.ca. We respond within 30 days, and may need to verify your identity first. You also have the right to complain to a supervisory authority - in Canada, the Office of the Privacy Commissioner of Canada; in the EEA or UK, your local data protection authority.

We apply row-level security and per-tenant isolation in our database, encrypt data in transit with TLS and at rest at the storage layer, store API keys and passwords only in hashed form, restrict administrative access on a need-to-know basis, and log administrative actions. No system is perfectly secure, and we do not claim otherwise.

If we become aware of a personal data breach affecting subscriber data we process for a customer, we will notify that customer without undue delay and provide the information they reasonably need to meet their own notification obligations. Where we are the controller, we notify affected individuals and the competent authority as required by law.

When you upload contacts, collect signups through our forms or collection widget, or send a campaign, we process your subscribers' personal data solely as your processor and only on your documented instructions - which, in practice, are the actions you take in the application and through the API.

What we process on your behalf

• Subscriber email addresses, names, and any custom attributes you choose to store;
• Subscription status, list membership, and consent metadata you supply or we collect through double opt-in;
• Delivery events from Amazon SES - deliveries, bounces, complaints - and, where you have enabled it, open and click events with associated timestamps, IP addresses, and user agent strings;
• Suppression records for unsubscribes, hard bounces, and spam complaints.

Our processor commitments

• We process subscriber data only on your instructions, and not for our own purposes;
• We do not sell subscriber data, do not use it to build our own marketing lists, and do not use it to train models;
• Personnel with access are bound by confidentiality obligations;
• We engage sub-processors only under written terms, as listed in section 5, and remain responsible for their performance;
• We assist you, taking into account the nature of the processing, in responding to data subject requests, in security, and in breach notification and impact assessments;
• On termination, we delete or return subscriber data at your choice, subject to suppression records described below and to legal retention requirements;
• We make available the information reasonably necessary to demonstrate compliance.

Your responsibilities as controller

You warrant that you have a lawful basis and, where required, valid consent for every subscriber whose data you load into the platform, that you have given them the transparency notices the law requires, and that your instructions to us will not cause us to breach applicable data protection law. Sourcing rules are set out in the Acceptable Use Policy.

This section, together with the Terms of Service, is intended to operate as a data processing agreement under GDPR Article 28. Customers requiring a separately executed DPA or Standard Contractual Clauses may request one at privacy@stellarbyte.ca.

The business that sent you the message is the controller of your data and is your first point of contact for access, correction, or erasure requests. We do not have the relationship with you that would let us answer for them.

That said, we will always act on the following directly: use the unsubscribe link in any message to stop mail from that sender immediately, or write to abuse@stellarbyte.ca to report unsolicited mail or to have your address suppressed across the platform. We investigate every report, and we act on our customers when reports are substantiated.

StellarMail is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@stellarbyte.ca and we will delete it.

We may update this policy; material changes will be posted here with a revised effective date and, where they affect subscriber data processing, notified to account owners.

Privacy enquiries: privacy@stellarbyte.ca. Postal address: Stellar Byte Technology Corp., 329 Howe St, Unit #456, Vancouver, BC V6C 3N2, Canada.