Privacy Policy
Effective: September 22, 2026 · Version 4.0
This document was written by our engineering team for structural reference and is not the authoritative legal text. It is not binding until reviewed and approved by our legal counsel. For a signed copy of the current version or to negotiate terms, please contact privacy@cpaas.io.
1. Data we collect
- Account data: name, work email, phone, employer
- Usage data: dashboard clicks, API calls (minus payload), IP, browser
- Customer content data: messages, contacts, templates — processed on your behalf as our customer
- Cookies: session cookie for auth, analytics with your consent
2. Why we collect it
To provide the Service, secure it against abuse, bill you accurately, respond to support, and improve reliability.
3. Sub-processors
We use a limited number of sub-processors (AWS, Twilio, Meta, Postmark, Sentry, Stripe). Full list at cpaas.io/subprocessors.
4. Data residency
US-East by default. EU (eu-central-1) and AU (ap-southeast-2) available on Enterprise plans.
5. Your rights
Access, rectify, erase, port, restrict, or object under GDPR and CCPA. Email privacy@cpaas.io.
6. Retention
Account data retained for the life of the account + 12 months. Audit logs 7 years. Messages 90 days hot + indefinite cold storage unless you configure otherwise.
7. Security
See our security documentation. TLS 1.2+, AES-256, SOC 2 Type II.
8. Contact
Data Protection Officer: dpo@cpaas.io. For postal correspondence, contact us at privacy@cpaas.io and we will provide the registered-office address for your jurisdiction.