Privacy Policy
How Postbag handles personal data for account holders and for the people who submit forms built by our customers. Operated by Md Afiur Rahman.
Last updated: · Markdown
Postbag processes two different kinds of personal data, for two different people: account holders, who sign up to use Postbag, and form submitters, visitors who fill in a form built by one of our customers. This policy covers both, separately.
Account holders
What we collect
Your name and email address; a password hash, or an identity from Google or GitHub if you sign in that way; your API keys (stored as hashes, never in plaintext); usage logs; and the IP address and country of your requests, resolved via Cloudflare.
Why we process it
To provide the service — create your account, run your forms, deliver your submissions — to keep it secure (rate limiting, abuse prevention), and to send transactional email such as delivery notifications and security alerts.
Legal bases
Performance of a contract (running your account) and our legitimate interest in keeping the service secure and reliable.
Retention
For as long as your account is active, plus 30 days after closure, to allow recovery from an accidental deletion.
Your rights
Access, rectification, erasure, portability and objection. Email [email protected] and we'll act on it.
Cookies
The dashboard sets one session cookie so you stay signed in. This marketing site sets no cookies at all — no analytics, no trackers; the only client-side storage it uses is your light/dark theme preference.
Who sees it
Account data is visible to Md Afiur Rahman as operator, and to the sub-processors listed on our sub-processors page — hosting, email delivery and, on paid plans, payment processing.
International transfers
Md Afiur Rahman operates Postbag from Dhaka 1209, Bangladesh. Data is hosted in Germany (Hetzner Online, Nuremberg — European Union). All data in transit is encrypted with TLS, and access to production systems is limited to the operator.
Children
Postbag is not directed at, and we do not knowingly collect data from, anyone under 16.
EU representative
We have not appointed an EU representative under Article 27 of the GDPR. Postbag is operated by one person processing personal data at a small scale, which we believe falls within the Article 27(2) exemption; we'll revisit this if that changes. If you have concerns, contact us directly.
Form submitters
If you filled in a form built by one of our customers, Postbag is the processor; the site that showed you the form is the controller, and is generally who you should contact first.
What arrives
Whatever fields the form submits, plus the IP address, user agent, country and timestamp of the submission.
Where it goes
Wherever the site owner configured — typically their email, and possibly other systems they've connected.
Retention
90 days on the site owner's Free plan; longer on paid plans (up to 730 days). The site owner can delete a submission at any time.
We never sell it
We do not sell submission data, and we do not use it for anything except delivering it the way the site owner configured.
Exercising your rights
Contact the website that showed you the form first — they are the controller. If you contact us instead, at [email protected], we'll forward your request to them.
Contact
[email protected] · Dhaka 1209, Bangladesh