Privacy Policy

1. Who this covers

This policy explains what Campaign Monster ("we", "us") collects when you use Campaign Monster, and — because Campaign Monster is a tool for emailing your own contacts — it also explains what happens to the contact data you upload about other people.

2. What we collect

About you, the account holder:

• Your email address and password (stored securely, hashed — we never see your plaintext password)
• Your organization name and role (admin or member)
• Usage data: how many verifications and sends you've used against your monthly quota

About the contacts you upload:

• Email address, and optionally name and company, from whatever file or paste you upload
• Verification status and result (deliverable, risky, undeliverable, pending) once checked
• Campaign activity for that address: which campaigns it was sent, whether it unsubscribed, bounced, or was reported as spam

3. How we use it

We use this data only to run the Service for you, specifically to:

• Authenticate you and keep your organization's data separate from every other customer's
• Send the email addresses you upload to our verification provider (ZeroBounce) to check deliverability
• Send the campaign emails you compose, through our sending provider (Amazon SES), to the recipients you choose
• Enforce unsubscribe requests and suppress those addresses from future sends
• Enforce your plan's monthly quota

4. We do not sell your data

We do not sell, rent, or trade your account data or your contacts' data to anyone, for any purpose. We don't use your uploaded contact lists for our own marketing, and we don't share them with other customers. The only outside parties who ever see contact data are the service providers described below, and only to the extent needed to run the feature you used.

5. Third-party service providers

We rely on a small number of providers to operate the Service:

• Supabase — hosts our database and handles authentication
• ZeroBounce — receives the email addresses you submit for verification
• Amazon SES — sends the campaign emails you compose, and reports back bounces/complaints
• Vercel — hosts the application itself

Each of these providers processes data only as needed to provide their service to us, under their own security and privacy commitments.

6. Your responsibility for contacts you upload

If you upload someone else's email address, you are the party responsible for having a lawful basis to hold and email that data — we act as a processor of the contact data you provide, not as the party who decided to collect it. See our Terms of Service for more on this.

7. Data retention and deletion

We keep account and contact data for as long as your account is active. If you delete a contact list, it's removed from your account; unsubscribe records are kept indefinitely even after a contact is otherwise deleted, since that's what prevents that address from being emailed again by mistake. If you close your account, contact us at swaroop.indus@gmail.com and we'll delete your account data within a reasonable period, except where we're required to retain something (e.g. billing records) for legal or accounting reasons.

8. Security

Access to your data is protected by row-level security at the database layer, meaning your organization's contacts and campaigns are only ever queryable by your own account and members you've invited. Passwords are hashed, not stored in plaintext. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, standard precautions to protect your data.

9. Your choices

You can access, export, or delete your contact lists at any time from within the app. You can request a copy of your account data, or ask us to delete it, by writing to swaroop.indus@gmail.com.

10. Changes to this policy

If we make a material change to how we handle your data, we'll make a reasonable effort to notify you before it takes effect.

11. Contact

Questions about this policy: swaroop.indus@gmail.com · +1 410-670-0167 · [ADDRESS].