Privacy Policy

THE DUG MEDIA LTD, a company incorporated in Cyprus (Limited Company).

Registered office: Georgiou Karaiskaki 11-13, 7560 Pervolia, Cyprus. VAT: CY60221313C.

Contact / rights requests: contact@smartletter.ai.

• Account data: email, name, hashed password, language.
• Site data: public content of the sites you connect (branding, articles, products), analyzed to generate your newsletters.
• Audience data: email addresses and names of subscribers you import or collect through our forms and lead magnets. You are the controller of that data; we process it on your behalf.
• Usage and engagement data: sends, opens, clicks, bounces, complaints, statistics.
• Payment data: handled by our provider Stripe; we do not store your card details.

• Providing the service / performance of a contract (GDPR art. 6(1)(b)): account creation, newsletter generation and sending, billing.
• Legitimate interest (art. 6(1)(f)): security, abuse prevention, product improvement, aggregate engagement measurement.
• Consent (art. 6(1)(a)): optional marketing communications from us; withdrawable at any time.
• Legal obligation (art. 6(1)(c)): accounting, responding to competent authorities.

Smartletter sends emails on behalf of its users, to lists those users own. Each user is responsible for obtaining opt-in consent from their own subscribers and for not using purchased or unsolicited lists.

Every email sent through Smartletter contains a working unsubscribe link (including a one-click unsubscribe mechanism, RFC 8058). Unsubscribes, hard bounces and spam complaints are automatically added to a suppression list and never contacted again.

We rely on sub-processors bound by confidentiality and security commitments:

• Amazon Web Services (Amazon SES) — email delivery, Europe (Paris) region.
• Supabase — database and authentication.
• Vercel — web application hosting.
• Cloudflare — DNS, CDN and background task execution.
• Stripe — payments and billing.
• AI model providers (via OpenRouter) — content generation, based on the data you submit.

Our sending and application infrastructure is located in the European Union where possible. Some sub-processors may process data outside the EEA; in that case transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent mechanism.

Account data is kept while the account is active, then deleted or anonymized within a reasonable period after closure. Audience data is kept while you use it and deleted at your request or on account closure. Billing data is retained as required by law.

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent. To exercise them: contact@smartletter.ai. You may also lodge a complaint with your competent supervisory authority.

We use cookies strictly necessary for operation (session, authentication) and, where applicable, aggregate analytics. We do not use third-party advertising cookies.

We implement appropriate technical and organizational measures: encryption in transit, per-workspace data isolation, access controls and logging. As no system is infallible, we cannot guarantee absolute security.

We may update this policy. For significant changes we will notify you by email or in-app. The last-updated date appears at the top of the page.