Privacy policy

1. Who is the data controller?

The service Mailcheer is published by GAM Communication LLC (a limited liability company incorporated under the laws of the State of Wyoming, United States), 1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States. For any questions about your data, write to [email protected].

Mailcheer operates in two distinct capacities under the General Data Protection Regulation (GDPR):

• Data controller for the data of our customers (those who create a Mailcheer account) — section 2.
• Data processor for the data of our customers' subscribers (the recipients of emails our customers send) — the customer is then the data controller — section 3.

2. Our customers' data (account holders)

Data collected

• Account: name, email address, password (stored as a hash, never in plain text), organization name.
• Billing: plan subscribed, invoice history, billing address. Payment data is entered directly with Stripe; Mailcheer never has access to it.
• Service usage: campaigns created, sending volumes, technical logs (IP address, browser, connection timestamps) necessary for security and operation.
• Exchanges: messages you send us (support).

Purposes and legal bases

• Provide the service, manage your account and your sends — performance of contract.
• Invoice and maintain our accounts — legal obligation.
• Secure the service, prevent abuse and spam — legitimate interest.
• Keep you informed of service updates (service emails) — performance of contract; any commercial communication is sent only with your consent, which you may withdraw at any time.

Retention periods

We commit to retaining your data for no longer than:

• Account data: for the full duration of your subscription, then 12 months after account closure, before deletion.
• Invoices and accounting documents: 10 years, the statutory period in France.
• Technical connection logs: 12 months.

3. Our customers' subscriber data

When you import contacts and send campaigns with Mailcheer, you are the data controller for that data, and Mailcheer acts as data processor (Article 28 of the GDPR), exclusively on your instructions. Specifically:

• We process your subscribers' data (email address, name, custom fields, subscription status, open, click, bounce and unsubscribe events) solely to deliver your sends and provide you with the statistics.
• We never use that data for our own purposes, sell it, or share it, except with the technical providers listed in section 5.
• You warrant that you have a valid legal basis (in practice, your subscribers' consent or an existing customer relationship) for each imported contact. See our terms and conditions on acceptable use.
• Every email sent through Mailcheer contains an unsubscribe link; unsubscribes are applied immediately and permanently.
• We help you respond to your subscribers' requests (access, rectification, erasure) through the service's tools, and we notify you without delay in the event of a data breach affecting them.
• When your account is closed, your subscribers' data is deleted within a maximum of 90 days, unless otherwise required by law.

A data processing agreement (DPA) formalizing these commitments can be provided upon simple request to [email protected].

4. Cookies

Mailcheer uses only strictly necessary cookies for the operation of the service: the session cookie that keeps you logged in to your workspace. These cookies are exempt from consent requirements. We place no advertising cookies or third-party trackers on this website.

5. Sub-processors and data location

To operate, Mailcheer relies on a limited number of technical providers, chosen for their GDPR compliance:

• Hetzner Online GmbH — application and database hosting (servers in Europe).
• Amazon Web Services EMEA SARL (Amazon SES) — email delivery, from the Ireland region (eu-west-1).
• Stripe, LLC — payment processing.
• Anthropic PBC — AI writing assistant (subject line suggestions, rephrasing, proofreading, drafting a first newsletter), in the United States. This provider receives only the content you submit to it when you request it: the text of your campaigns and your instructions. It never receives your subscriber lists or any data about your subscribers. Anthropic's commercial terms prohibit it from training its models on customer content.

Your data and that of your subscribers are hosted and processed within the European Union. There is one exception, and it depends on you: when you use the writing assistant, the content you submit to it is transferred to Anthropic in the United States. This transfer is governed by the European Commission's standard contractual clauses. If you do not want any transfer outside the Union, do not use the writing assistance features: the rest of the service works without them.

The publisher itself. Your data remains stored in Europe, with Hetzner. However, the publisher is a US company: when it accesses that data to operate the service and respond to you, this access counts as a transfer to a country outside the Union under Chapter V of the GDPR. No data is copied to the United States.

6. Security

We implement appropriate technical and organizational measures: encryption of communications (HTTPS), password hashing, data isolation between accounts, restricted server access, regular backups and access logging.

7. Your rights

Under the GDPR and the loi Informatique et Libertés, you have the right of access, rectification, erasure, restriction of processing, objection and data portability, as well as the right to define instructions regarding the fate of your data after your death.

To exercise them, write to [email protected]. We will respond within one month. If you are a subscriber of one of our customers, contact the sender of the email first; we will assist them in processing your request.

You may also lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), www.cnil.fr, or with the data protection authority of the country where you live — European law leaves that choice to you.

8. Updates to this policy

This policy may be updated to keep pace with changes to the service or regulations. The date at the top of the page indicates the current version; any substantial change will be notified to you by email.