Privacy Policy

Effective Date: June 1, 2026     Last Updated: June 1, 2026

SMTP Provider (operated by the team behind smtpprovider.com and smtpprovider.app) ("SMTP Provider", "we", "us", or "our") is committed to protecting the privacy of our users and their customers. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Shopify email marketing application and related services (collectively, the "Services") through smtpprovider.app and smtpprovider.com.

This Privacy Policy is published in accordance with the Information Technology Act 2000, the Information Technology (Amendment) Act 2008, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and is intended to comply with applicable data protection laws including the GDPR.

By using our Services, you agree to the collection and use of information as described in this Privacy Policy.

1. Who We Are

SMTP Provider operates as an email marketing service provider for Shopify merchants. In terms of data protection law:

• For data relating to Merchants and their account usage: SMTP Provider is the Data Controller.
• For data relating to a Merchant's Subscribers (end customers): SMTP Provider acts as a Data Processor on behalf of the Merchant, who is the Data Controller.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, business name, Shopify store URL, and billing information when you sign up.
• Communication data: messages, support tickets, and feedback you send to us.
• Campaign content: email templates, campaign text, images, and other content you create or upload.

2.2 Information We Collect Automatically

• Usage data: features used, pages visited, actions taken within the app, session duration, and interaction logs.
• Device and browser information: IP address, browser type and version, device type, operating system.
• Email analytics: delivery status, open rates, click rates, bounce rates, and unsubscribe events.
• Cookies and tracking technologies: as described in our Cookie Policy section below.

2.3 Subscriber Data (Processed on Your Behalf)

When you use our Services to send emails, we process data about your subscribers, which may include:

• Email addresses and subscriber names.
• Subscriber preferences and opt-in/opt-out status.
• Purchase history and Shopify customer data synced from your store.
• Email engagement data, including opens, clicks, and bounces related to your campaigns.

As a Merchant, you are responsible for ensuring you have a valid legal basis for collecting and processing your subscribers' data and for maintaining appropriate consent records.

2.4 Information from Third Parties

• Shopify provides us with store data, customer data as authorized by you, and billing information as part of the app integration.
• We may receive information from analytics providers, advertising partners, and service providers who help us operate our platform.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and improving the Services: operating, maintaining, and enhancing our email marketing platform.
• Account management: creating and managing your account, verifying identity, and processing payments.
• Email delivery: transmitting campaigns and transactional emails on your behalf through our SMTP infrastructure.
• Analytics and reporting: generating campaign performance reports and delivering them to your dashboard.
• Customer support: responding to your inquiries, resolving technical issues, and providing onboarding assistance.
• Legal compliance: meeting our obligations under applicable laws and enforcing our Terms and Conditions.
• Communications: sending you product updates, service announcements, and marketing communications. You may opt out of marketing communications at any time.
• Security and fraud prevention: monitoring for suspicious activity, preventing abuse, and protecting the integrity of our platform.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data on the following legal bases:

• Contract performance: to provide the Services as described in our Terms and Conditions.
• Legitimate interests: to improve our Services, ensure security, and conduct analytics, where these interests are not overridden by your rights.
• Legal obligation: to comply with applicable laws and regulations.
• Consent: for specific marketing communications or optional data uses, where we have obtained your consent.

5. Information Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• Service providers: with trusted third-party companies that help us operate the Services, such as email infrastructure providers, cloud hosting, analytics tools, and payment processors. These parties are contractually bound to handle your data securely and only as instructed.
• Shopify: as required by our integration with the Shopify platform, including for billing and app distribution.
• Legal requirements: when required by law, court order, or governmental authority, or to protect the rights, property, or safety of SMTP Provider, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, where the receiving party agrees to be bound by this Privacy Policy.
• With your consent: for any other purpose where you have given explicit permission.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Services. Specifically:

• Account data is retained for the duration of your account and for up to 90 days after account deletion, for backup and dispute resolution purposes.
• Subscriber data and email campaign data are retained for the duration of your use of the Services.
• Analytics data may be retained in aggregated, anonymized form indefinitely.
• Billing records are retained as required by Indian tax and financial laws, typically 7 years.

You may request deletion of your personal data at any time by contacting us at privacy@smtpprovider.com. We will process such requests in accordance with applicable law.

7. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit using SSL/TLS protocols.
• Secure storage of sensitive data with access controls and auditing.
• Regular security assessments and vulnerability management.
• Employee data access policies and confidentiality agreements.

While we take reasonable steps to safeguard your data, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

8. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and application for the following purposes:

• Essential cookies: required for the platform to function properly, such as authentication and session management.
• Analytical cookies: to understand how users interact with our Services, such as Google Analytics.
• Preference cookies: to remember your settings and preferences.
• Marketing cookies: to measure the effectiveness of marketing campaigns. These are used only on our marketing website, not within the app.

You can control cookie settings through your browser. Disabling certain cookies may affect the functionality of our Services. For full details, see our Cookie Policy.

9. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data, also known as the right to be forgotten.
• Right to restriction: request that we limit the processing of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at privacy@smtpprovider.com. We will respond within 30 days of receiving your request.

10. International Data Transfers

SMTP Provider is based in India. If you access our Services from outside India, your information may be transferred to and processed in India and potentially other countries where our service providers operate. These countries may have data protection laws that differ from those in your country.

For transfers from the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or other lawful transfer mechanisms approved under the GDPR.

11. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us at privacy@smtpprovider.com and we will take steps to delete such information.

12. Third-Party Links

Our Services may contain links to third-party websites or services that are not operated by us. We have no control over the content or privacy practices of those sites and are not responsible for their policies. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page and, where required by law, notify you by email or in-app notification. Your continued use of the Services after such changes constitutes your acceptance of the updated policy.

14. Contact and Grievance Officer

If you have questions about this Privacy Policy, wish to exercise your rights, or have a privacy complaint, please contact our Grievance Officer as required under Indian law:

• Email: privacy@smtpprovider.com
• Phone: +91 8335850000
• Address: Unit No. 304, South City Businesspark, 770, Anandpur, Kolkata - 700107, West Bengal, India

We aim to resolve all privacy concerns within 30 days of receipt.