EuroMail is a transactional email service operated by kalle.works Oy (Finnish business ID 3133717-5), Elisantie 2, 02970 Espoo, Finland ("we", "us", "our"). Effective Date: 2026-02-18 Last Updated: 2026-10-09
This Privacy Policy describes how EuroMail collects, uses, and protects personal data when you use our transactional email service. We are committed to GDPR compliance and EU data residency.
1. Data Controller
kalle.works Oy, operating as EuroMail, acts as the data controller for account and billing data, and as the data processor for email content sent through the service on behalf of our customers.
Contact:
- Entity: kalle.works Oy (Finnish business ID 3133717-5)
- Email: [email protected]
- Address: Elisantie 2, 02970 Espoo, Finland
2. Data We Collect
2.1 Account Data (Controller)
When you create an account, we collect:
- Email address - for authentication and service communications
- Password - stored as an argon2 hash (we never store plaintext passwords)
- Billing email - for invoicing (if different from account email)
- Stripe customer ID - to manage your subscription
2.2 API Usage Data (Controller)
When you use our API, we collect:
- API key prefix - for authentication (full keys are hashed with argon2)
- Request metadata - IP address, timestamp, endpoint, response code
- Audit logs - account changes, domain additions, API key creation/revocation
2.3 Email Data (Processor)
When you send emails through EuroMail, we process on your behalf:
- Sender and recipient addresses
- Email subject and body content
- Attachments (temporarily, for delivery)
- Template data (variables used for template rendering)
- Delivery events - queued, delivered, bounced, complained, opened, clicked
When you receive email through EuroMail (inbound routes and agent mailboxes), we also process the received message and these checks on its sender: the sending server's IP address, the name the server announced when it connected, the server's reverse DNS name when that name resolves back to the same IP address, the mail service that name belongs to, the country of the server's IP address, and the SPF, DKIM and DMARC results. We look up the country in a local copy of DB-IP's IP-to-country database on our own servers, and we do not send any IP address to DB-IP. We make the DNS lookups for these checks through our own resolver on the same servers. It starts from the DNS root and asks the nameservers responsible for each name directly, so no public resolver sees the lookups. We store these details with the message. They are also part of the webhook payloads we send to your endpoints, and we keep those payloads in a webhook delivery log (see Section 4). When we refuse a delivery to one of your inbound addresses, we keep a short record of it so you can see what was turned away: the recipient, the sender address, the sending server's IP address and the reason. We keep the 200 most recent such records per account.
We act as a data processor for this data under Article 28 of the GDPR. See our Data Processing Agreement for full terms.
2.4 Automatically Collected Data
- Server logs - IP addresses, request timestamps, user agent
- Performance metrics - anonymized, aggregated service metrics
- Error reports from our web pages - when a page on euromail.dev, dashboard.euromail.dev or app.euromail.dev fails, our self-hosted monitoring (OpsBeaver) receives the error message and stack, the page's path, the browser and operating system versions and the device type. Nothing is stored on your device for this.
- Usage statistics, only with your consent - page addresses without query values, the referring site and campaign parameters, time on page, scroll depth, page load timings, the domains of outbound links, a random session identifier kept in your browser tab, and a daily and weekly pseudonymous visitor hash computed from your IP address and browser. The IP address is not stored, and the salt behind the hash is deleted when the day or week is over. See Section 9 to give or withdraw consent.
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) | Data |
|---|---|---|
| Provide the service | Contract performance (Art. 6(1)(b)) | Account data, email data |
| Process payments | Contract performance (Art. 6(1)(b)) | Billing email, Stripe customer ID |
| Prevent abuse | Legitimate interest (Art. 6(1)(f)) | IP addresses, rate limit data |
| Service communications | Contract performance (Art. 6(1)(b)) | Account email |
| Security monitoring | Legitimate interest (Art. 6(1)(f)) | Audit logs, server logs |
| Keep our web pages working | Legitimate interest (Art. 6(1)(f)) | Error reports from our web pages |
| Understand how the website is used | Consent (Art. 6(1)(a)) | Usage statistics, Flarelytics page views, signup attribution |
| Ask for product feedback | Legitimate interest (Art. 6(1)(f)) | Account email and name, when the account last sent email, and your answers |
Now and then we ask account holders how euromail is working for them. We ask by email when an account stops sending, or with a question in the dashboard. We ask at most once every 90 days and never attach an offer to the question. You can turn these questions off with the link in any feedback email or in your dashboard settings. This does not affect emails about your account, billing and security.
We do not:
- Sell your data to third parties
- Use email content for advertising or profiling
- Train AI/ML models on your email content
- Send email content to external AI providers
4. Data Retention
| Data Type | Retention Period | Justification |
|---|---|---|
| Email body content (HTML/text) | 30 days (configurable), enforced by a daily purge job | Delivery verification and troubleshooting |
| Email delivery record (recipient, subject, headers, template data) | Up to 7 months (configurable), pruned when its monthly partition is dropped | Delivery reporting and analytics |
| Email events (opens, clicks, bounces, deliveries) | 90 days (configurable), enforced by a daily purge job | Delivery reporting and analytics |
| Inbound email content (subject, headers, body) | 30 days (configurable), enforced by a daily purge job | Contract performance |
| Agent mailbox attachments | Deleted with their message (see below) | Contract performance |
| Agent mailbox messages, including their sender checks | Until you delete them or the account is deleted | Contract performance |
| Refused inbound deliveries (recipient, sender address, sending server's IP address, reason) | The 200 most recent per account | Contract performance |
| Webhook delivery log (the payloads sent to your endpoints, including received email and its sender checks) | Not yet covered by an automated purge | Troubleshooting webhook delivery |
| Bounce/suppression records | Duration of account | Deliverability management |
| Audit logs | 365 days (configurable), enforced by a daily purge job, or immediately on account deletion | Security and compliance |
| Account data | Duration of account + 7 days | Service provision |
| Server logs | 90 days | Security monitoring |
| Web page error reports and usage statistics (raw events) | 90 days | Keep the pages working; usage statistics |
| Aggregated usage statistics and grouped errors | 400 days (a grouped error: 400 days after it was last seen) | Trends across releases |
| Billing records, including the customer record at Stripe | 7 years, also after the account is deleted | Finnish accounting law (Kirjanpitolaki) |
Email body content (the HTML and text of a sent message) is nulled 30 days after sending by a daily purge job. The delivery record itself — recipient address, subject, headers, and any template data supplied with the send — is not part of that purge and survives until its monthly partition is dropped, which can take up to seven months depending on when in the month the message was sent.
Email events, inbound email content, and audit logs are each removed automatically by a daily purge job on the schedule in the table above. A data subject erasure request also removes email events and inbound email content tied to a specific address immediately, ahead of the scheduled purge; audit logs are kept as an accountability record until either their retention period elapses or the account itself is deleted, whichever comes first.
Attachments of agent mailbox messages are stored in object storage, separately from the message. A message can be deleted by you, by an erasure request for its sender or recipient, or together with the whole account. In each case its attachments are queued for deletion in the same step and removed from object storage. If the storage is unavailable, the deletion is retried. A daily check also removes any attachment whose message no longer exists.
The current retention status for your account, including whether any purge is running behind its stated schedule, is available at Dashboard > GDPR.
5. Data Residency and Transfers
EuroMail's email databases, queues, object storage and AI inference are hosted in Finland (Hetzner Online GmbH, hel1 datacenter in Helsinki).
Messages are delivered to the receiving mail servers you address, which may be outside the EU/EEA. Ancillary services also receive limited data: for example, Stripe processes billing email and payment details in the USA. Section 8 lists each subprocessor, the data it receives, its location and the applicable safeguards. AI classification and weekly insights use the Finland-hosted inference service without an external AI fallback.
6. Your Rights (GDPR Articles 15-22)
As a data subject, you have the right to:
| Right | How to Exercise |
|---|---|
| Access (Art. 15) | Dashboard settings or GET /v1/account |
| Data portability (Art. 20) | GET /v1/account/export (machine-readable JSON) |
| Rectification (Art. 16) | Dashboard settings or contact us |
| Erasure (Art. 17) | Dashboard settings, DELETE /v1/account, or contact us. Erased after a seven-day window in which the deletion can be cancelled |
| Restrict processing (Art. 18) | Contact [email protected] |
| Object to processing (Art. 21) | Contact [email protected]. For feedback questions, use the link in the email or your dashboard settings |
| Withdraw consent | Contact [email protected] |
| Lodge a complaint | Finnish Data Protection Ombudsman (tietosuoja.fi) |
We respond to all data subject requests within 30 days.
To export your data, use the GET /v1/account/export endpoint. It returns every record we hold for the account as one JSON document, including account details, domains, templates, webhooks, the delivery record and events of every sent email, suppressions, contacts and lists, newsletters, received email, agent mailbox messages and the audit log. Email bodies are included for as long as we retain them. Passwords, keys and other secrets are not included.
7. Security Measures
We implement the following technical and organizational measures:
- Encryption in transit - TLS for all API connections, STARTTLS for SMTP
- Encryption at rest - PostgreSQL with encrypted storage volumes
- Password hashing - argon2 with per-user salts
- API key security - SHA-256 prefix lookup, argon2 full key hashing, constant-time comparison
- Access control - Tenant isolation, per-account data separation
- CSRF protection - Double-submit cookie pattern on dashboard
- Security headers - CSP, HSTS, X-Frame-Options, X-Content-Type-Options
- Webhook signatures - HMAC-SHA256 with timestamp validation
- Audit logging - All account changes logged with timestamps
- Rate limiting - Multi-layer protection against abuse
- Vulnerability management - Automated dependency auditing via
cargo audit
8. Subprocessors
We use the following subprocessors:
| Subprocessor | Purpose | Data Shared | Location | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (compute, database, Redis, object storage) | All account and email data | Finland (Helsinki, hel1 datacenter) | EU company (Germany), ISO 27001, data centers in EU/EEA |
| Stripe, Inc. | Payment processing | Billing email, payment details, Stripe customer ID | USA | EU SCCs, PCI DSS Level 1 |
| GitHub, Inc. | Source code hosting, CI/CD, container registry | No customer data — internal source code and build artifacts only | USA | EU SCCs |
| Cloudflare, Inc. | Bot and abuse protection (Turnstile challenge) on account registration | Visitor IP address and browser signals used to verify the challenge | USA | EU SCCs |
| Flarelytics | Privacy-first web analytics (pageviews, scroll depth) on the public website, loaded only with your consent — no cookies | IP address, referrer, page URL | Cloudflare global edge network | No cookies; IP address not persisted in identifiable form |
| Helpparibotti | Support chat widget on the public website and in the dashboard | Chat messages, IP address; in the dashboard also the signed-in person's email, their name if set in Settings, the company name, plan and monthly usage | Finland | — |
AI classification and weekly insights run on EuroMail's self-hosted inference service in Finland. External AI providers are disabled. Previously saved Anthropic API keys are ignored and can be removed from the dashboard.
We notify customers of changes to subprocessors via email to the account address. Customers may object to new subprocessors as described in our DPA.
9. Cookies and browser storage
These are strictly necessary and need no consent:
| Name | Where | Purpose | Duration |
|---|---|---|---|
session (cookie) | Dashboard | Session authentication | Browser session |
csrf_token (cookie) | Dashboard | CSRF protection | Browser session |
em_consent (cookie) | euromail.dev and its subdomains | Remembers your choice about usage statistics | 1 year |
euromail-release-reload-at (sessionStorage) | Dashboard | The time of the last automatic page reload after an update, so the page never reloads more than once a minute | Until you close the tab |
These are used only if you allow usage statistics:
| Name | Where | Purpose | Duration |
|---|---|---|---|
opsbeaver.session (sessionStorage) | All our web pages | A random session identifier and the time of your last activity, so that page views of one visit belong together | Until you close the tab; replaced after 30 minutes of inactivity |
em_attrib (sessionStorage) | Public website | Which page and campaign you arrived from, attached to your account if you register | Until you close the tab |
With your consent, the public website also loads Flarelytics, which counts page views without storing anything in your browser. If you withdraw, statistics stop at once and the attribution record is removed; a Flarelytics counter already loaded on the open page stops at the next page.
We do not use advertising cookies or third-party tracking cookies. Error reports from our web pages (Section 2.4) are sent without consent, because they keep the service working, and store nothing on your device; you can object to them under Article 21 by contacting [email protected].
You can change your choice at any time:
10. Children's Privacy
EuroMail is a B2B service and is not directed at individuals under 16. We do not knowingly collect data from children.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify account holders via email at least 30 days before material changes take effect.
12. Contact
For privacy inquiries, data subject requests, or complaints:
- Email: [email protected]
- Supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi
Version history
-
2026-10-13: An account is now erased seven days after termination, the same deletion window that already applied to deletion requests. The customer record at Stripe is kept for seven years under Finnish accounting law. The account export now contains every record held for the account, and attachments of deleted agent mailbox messages are removed from object storage.
-
2026-10-09: External AI processing is disabled in the updated software. Classification and weekly insights use self-hosted inference in Finland, and weekly insights no longer include account names. Anthropic has been removed from the current subprocessor list.
-
2026-10-07 (later the same day): the DNS lookups for received email moved to our own resolver, so Cloudflare's public DNS resolver is no longer a subprocessor. Section 2.3 explains how we make the lookups.
-
2026-10-07: Section 2.3 now describes what we record about the senders of received email, including refused deliveries and the webhook delivery log. Cloudflare's public DNS resolver is listed as a subprocessor. It has handled the SPF lookups on received email since 2026-05-02, the DKIM and DMARC lookups since 2026-10-06, and the reverse DNS lookups since 2026-10-07. The retention table now lists agent mailbox messages, refused deliveries and the webhook delivery log, and Anthropic's row includes intent classification of agent mailbox messages.
-
2026-09-26: the support chat widget in the dashboard receives your email, your name if you set it in Settings, and your company name, plan and usage, so support knows who is asking.
-
2026-09-25: error reports from our web pages described; usage statistics, Flarelytics and signup attribution now wait for your consent, which you can give or withdraw in Section 9.
-
2026-09-03: hosting provider corrected to Hetzner Online GmbH; Anthropic, Cloudflare, Flarelytics and Helpparibotti added to the subprocessor list; retention table aligned with the automated purge jobs.
-
2026-06-30: previous version. Earlier texts are available on request.