Privacy Policy

Overview

At Mailzzy, accessible from mailzzy.com, one of our main priorities is the privacy of our visitors. As a technology company, we’re providing this Global Privacy Statement (“Privacy Statement”) to explain how we, SoftSages LLC (doing business as SoftSages Technology), and our product Mailzzy (collectively “Mailzzy,” “we,” “us,” or “our”), collect, use, share, or otherwise process information that we collect through our services. These services include, as applicable, our websites, mobile applications, social media pages, marketing activities, and other activities described in this Privacy Statement, or when other businesses provide us your personal information (collectively, the “Services”). This Privacy Statement is global, meaning it applies to all Mailzzy Services. We may provide additional or supplemental privacy statements for certain products or services.

For privacy requests and complaints, email privacy@mailzzy.com. For any other questions about our Privacy Policy, contact us at support@mailzzy.com

This Privacy Policy applies to the Mailzzy website, the Mailzzy platform and mobile apps, and the integrations and connectors described below. It does not apply to information collected offline or through channels other than the Mailzzy Services.

Consent

By using our website, you hereby consent to our Privacy Policy and agree to its terms.

Information we collect

Personal information: This can include your name, email address, phone number, company name, job title, and any other information you voluntarily provide by filling in any forms on our website or by corresponding with us by email, live chat, phone or otherwise. This includes information you provide when you register to use our services and when you contact us for any reason. When you register for our services, we will ask for a range of information we need to collect in order to set up your account and engage one or more of our upstream email service or SMS service providers to handle your emails or SMS. If you contact us, we may keep a record of any information contained in the correspondence.

If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.

Data from connected stores

When you connect a store or platform to Mailzzy for example a Shopify store we import personal data about your customers so we can build and maintain contact records in your account. This includes their name, email address, phone number, postal address, and their email marketing consent status.

We also import order and checkout details — the items purchased, amounts, order status, and abandoned-cart contents — to send the order-based and abandoned-cart emails and the product recommendations you configure. We import only the data needed for the features you have enabled.

Marketing consent. We apply each customer’s email marketing consent status from your store. Customers who have not consented are imported as unsubscribed and do not receive marketing emails from your account, and we keep that status in sync when it changes in your store.

We process this data only to provide the Mailzzy service to you: creating and updating contact records, segmenting your audience, and sending the campaigns and automations you configure. We do not use it for our own marketing, we do not sell or share it, and we do not use it to build profiles across our customers.

Our role. For this data you are the controller and Mailzzy is your processor. The terms on which we process it are set out in the Data Protection and Processing Terms section of our Terms of Use, which forms part of your agreement with us.

Retention and deletion. We retain this data for as long as your connection and your account remain active. You can delete individual contacts or your entire contact list at any time. Disconnecting a store stops further syncing but does not by itself delete contacts already imported — delete them from your contact list if you want them removed.

Uninstalling the app. If you uninstall the Mailzzy app from your store, we delete all contacts and other data imported from that store, together with the store connection itself, once the platform notifies us of the uninstall. Where the platform sends us an erasure request on an individual customer’s behalf, we erase that customer’s record and prevent it from being re-imported. Backup copies containing deleted data are removed within 30 days.

Automated decision-making. Mailzzy does not make automated decisions that produce legal effects, or similarly significant effects, concerning individuals. Features such as audience segmentation and send-time optimisation only decide which marketing message an individual receives and when it is sent.

AI assistant connectors

Mailzzy offers a connector, built on the Model Context Protocol (MCP), that lets you use Mailzzy from an AI assistant you choose, such as ChatGPT or Claude. After you sign in to Mailzzy and approve the connection on our consent screen, the assistant can act on your behalf within your Mailzzy account: reading contacts, segments, templates, campaigns, automations, sending domains and reports, and, when you ask it to, creating, updating or deleting those items, sending campaigns, test emails and transactional emails, and copying an image from a public web address into your account. The connector can only reach the Mailzzy account you signed in with.

Information we collect. When an assistant registers to connect, we store its name and the web address it returns you to after sign-in. We use the IP address of the registration request to limit abuse, and we record it in our security logs. When you connect, we store an authorization record for your account and issue access tokens. Each time the assistant uses a connector tool, we record who made the request, your account, the tool used, the time, the outcome, and the details the assistant supplied (for example the contact details it asked us to create, or the recipients of an email it asked us to send). We do not record the results the tools return.

Information returned to your assistant. What the assistant receives depends on what you ask it to do, and can include your contacts' names, email addresses and subscription status, the recipients, subjects and delivery outcomes of emails sent from your account, and campaign performance figures. Contact phone numbers and postal addresses are not returned.

How we use it. We use this information only to operate the connector: to authenticate you, to carry out the actions you request, to enforce usage limits, to keep a security record of actions taken through the connector, and to investigate problems. We do not use it for advertising, and we do not sell it. For your contacts' data you remain the controller and Mailzzy is your processor, as described in the Data Protection and Processing Terms section of our Terms of Use.

Who receives it. Information the connector returns is sent to the AI assistant provider you chose to connect (for example OpenAI for ChatGPT, or Anthropic for Claude). That provider handles it under its own terms and privacy policy, which we do not control, so please review them before connecting. We do not share connector data with any other third party, apart from the sub-processors and service providers listed in this policy.

Retention. Access tokens expire after one hour. Refresh tokens expire after 90 days without use. Expired and revoked authorizations, and assistant registrations that no longer have an active connection, are deleted automatically, usually within a day. Records of connector tool use are kept with your account for as long as it remains active, and copies in our security logs are kept for up to 400 days.

Your choices. Connecting an assistant is optional, and nothing is shared with it until you sign in and approve the connection. You can disconnect at any time by removing the Mailzzy connector in your assistant's settings, after which it can no longer renew its access and any access already granted ends within one hour. To have us revoke every connection to your account, or to ask about the records described in this section, email privacy@mailzzy.com.

Connected social accounts

You can connect your Facebook, Instagram or LinkedIn account to Mailzzy to publish posts to your own profile or to Pages you manage. Connecting is optional, and nothing is posted until you create or schedule a post.

Information we collect. When you connect, we store the access token the platform issues (and a refresh token where the platform provides one), your account or member ID, your display name and profile picture, and, for Pages you manage, each Page's ID, name and logo. We also store the posts and images you create in Mailzzy and the publishing status the platform returns.

How we use it. We use this information only to show you the profiles and Pages you can post to, to publish the posts you create or schedule, and to show you whether each post was published. We do not read your feed, messages, connections or followers, we do not use this data for advertising, and we do not sell or share it.

Who receives it. Post content and images are sent to the platform you choose (Meta for Facebook and Instagram, LinkedIn for LinkedIn) and are published under that platform's own terms and privacy policy. Images you attach are stored in our media storage at a web address the platform can fetch.

Security and retention. Access and refresh tokens are encrypted at rest. We keep them only while the account stays connected.

Disconnecting. You can disconnect an account at any time from Integrations in Mailzzy. We then revoke our access where the platform supports it and delete the stored tokens and Page details. Posts already published stay on the platform until you delete them there. You can also remove Mailzzy's access from the platform directly, for LinkedIn under Settings → Data privacy → Permitted services.

How we use your information

We use the information we collect in various ways, including:

• Provide, operate, and maintain our website

• Improve, personalize, and expand our website

• Understand and analyze how you use our website

• Develop new products, services, features, and functionality

• Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes.

• To send you newsletters about our service and notify you about any changes to the service via email and/or SMS;

• Find and prevent fraud

• To comply with legal and regulatory obligations.

Log Files

Mailzzy follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and are a part of hosting services' analytics. The information collected by log files includes internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users' movement on the website, and gathering demographic information.

Cookies and Web Beacons

Like any other website, Mailzzy uses "cookies". These cookies are used to store information including visitors' preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users' experience by customizing our web page content based on visitors browser type and/or other information.

Third-Party Privacy Policies

This section applies to the mailzzy.com marketing website only. Pages on our marketing website may link to websites we do not operate, and Mailzzy’s Privacy Policy does not apply to those websites. We advise you to consult their respective privacy policies for more detailed information, including their practices and instructions about how to opt out of certain options. The Mailzzy platform itself does not serve third-party advertising, and we do not disclose platform or contact data to advertising networks or ad servers.

You can choose to disable cookies through your individual browser options. To know more detailed information about cookie management with specific web browsers, it can be found on the browsers' respective websites.

Sale and Sharing of Personal Information

Mailzzy does not sell your personal information, and does not sell or share the personal data you import into your account. We do not disclose personal data to advertisers and we do not use it for cross-context behavioral advertising.

We disclose personal data only to the sub-processors listed below, who process it on our behalf, under contract, and solely to provide the Mailzzy service — and where we are required to disclose it by law or legal process.

Sub-processors and Service Providers

We engage a limited set of vendors to help us deliver the Mailzzy service. Each is bound by contract to process personal data only on our documented instructions and to protect it to a standard consistent with this policy. Our current sub-processors are:

• Amazon Web Services (AWS) — cloud infrastructure, database hosting, storage and backups for the Mailzzy platform. Processes all account and contact data we hold. Primary processing region: United States.

• Netcore Cloud (Pepipost) — email delivery infrastructure. Processes recipient name and email address, message content, and delivery and engagement events.

• Unlayer — embedded email and landing-page template editor. Processes the campaign content you create and any personal data you place into it.

• Google — authentication, website analytics and related platform services. Processes account identifiers and website usage data.

• Stripe — subscription billing and payment processing. Processes billing contact and payment details. Mailzzy does not store full card numbers.

• Cloudflare (R2) — storage and delivery of images you upload for emails, templates and social posts.

Sub-processors may process personal data outside your country of residence; where they do, we rely on appropriate safeguards for that transfer. We will update this list before we add or replace a sub-processor, and our Terms of Use set out how we notify customers of those changes.

How we protect your data

Encryption. Data is encrypted in transit using TLS. Data at rest is encrypted on every production database instance, and our backups inherit the same encryption.

Access control. We operate a role- and resource-based permission model on the principle of least privilege, with per-tenant data isolation. Access to personal data is logged, including the client IP address of each request. Accounts can be protected with multi-factor authentication using an authenticator app (TOTP) or a security key (WebAuthn/FIDO2), in addition to password complexity and password-reuse controls.

Independent assessment. Mailzzy is certified under the State of Texas TX-RAMP program at Level 1, certification ID TX1858654, valid until 25 August 2029.

Incident response. We maintain a formal incident response plan. Where a personal data breach affects data you have entrusted to us, we will notify you without undue delay and in any event within 72 hours of becoming aware of it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

CCPA Privacy Rights (Do Not Sell My Personal Information)

Under the CCPA, among other rights, California consumers have the right to:

Request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that a business has collected about consumers.

Request that a business delete any personal data about the consumer that a business has collected.

Request that a business that sells a consumer's personal data, not sell the consumer's personal data.

If you make a request, we have one month to respond to you. To exercise any of these rights, or to complain about how we have handled your personal information, email privacy@mailzzy.com.

User-Initiated Account Deletion

You may request deletion of your Mailzzy account and associated personal data at any time by contacting us at privacy@mailzzy.com or through your account settings, where available. Once a deletion request is submitted, your account will enter a 30-day cooling-off period, during which the account will be deactivated but not yet permanently deleted. This period allows you to cancel the deletion request and restore your account by signing in or contacting support before the 30 days elapse.

If no action is taken to cancel the request within this period, your account and associated data will be permanently deleted from our active systems, subject to any legal, tax, or backup-retention obligations described elsewhere in this policy. Please note that some information may be retained in backup archives for a limited period even after deletion, and certain records may be kept where required by law.

Children's Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.

Mailzzy does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.

Data Retention for Inactive Accounts

In accordance with our Terms of Use, we retain account data for as long as an account remains active. Accounts that have not been accessed or used for a continuous period of 24 months (two years) may be flagged as inactive. If your account is deemed inactive, we will attempt to notify you at the email address on file, and you will have 30 days from the date of that notice to sign in or otherwise use your account to keep it active. If no action is taken within this period, the account and its associated data may be permanently deleted from our active systems, subject to any legal, tax, or backup-retention obligations described elsewhere in this policy.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Thus, we advise you to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page. These changes are effective immediately after they are posted on this page.

Contact us

For privacy requests and complaints, email privacy@mailzzy.com. For any other questions about our Privacy Policy, contact us at support@mailzzy.com