Privacy Policy
How DUST 4 Business, s.r.o. processes personal data as controller of postfly account data and as processor of the mail Customers send through postfly.
Effective from: 15 September 2026
If you received an email sent through postfly, DUST 4 Business is not the controller of your data. The postfly Customer who sent it — not DUST 4 Business — decides why and how your data is used, and is the controller you should contact. DUST 4 Business only processes that message on the Customer's instructions, as its processor; see the Data Processing Agreement and Section 9 below.
1. Controller and contact
For the personal data described in this policy, the controller is DUST 4 Business, s.r.o., Bratislavská 31, 010 01 Žilina, Slovakia. For any request about your personal data, write to privacy@postfly.app.
The controller has not appointed a data protection officer; all personal-data requests go to privacy@postfly.app.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account: email, time zone, 2FA secret and backup codes (encrypted) | Operating the Account you sign in with; securing it | Performance of the contract with the Customer |
| Sessions: IP address, user agent | Keeping you signed in; detecting hijacked or abusive sessions | Legitimate interest — security of the Service |
| Audit events: actor, action, IP address, user agent | Accountability, incident investigation, abuse response | Legitimate interest — security and accountability; legal obligation where the law requires records to be kept |
| API keys | Authenticating a Customer's use of the API and SMTP | Performance of the contract with the Customer |
| Customer messages sent through the Service: sender/recipient addresses (including a message's visible To/Cc recipients, stored with each message), subject, bodies, headers, delivery status, bounce/SMTP responses, message events, attachments, suppression-list entries | Sending the Customer's mail, showing delivery status, honoring bounces and complaints — see Section 9 | Performance of the contract between DUST 4 Business and the Customer, on whose instructions this data is processed |
3. Recipients and processors
We do not sell personal data. It is shared only with the processors that keep the Service running, each acting on our instructions and under a data-processing agreement or its provider's standard equivalent:
- Contabo GmbH (Germany) — hosts the application server that runs the Service.
- Cloudflare, Inc. (United States) — DNS, reverse proxy and TLS for postfly.app.
- Hetzner Online GmbH (Germany) — off-site storage for GPG-encrypted backups.
- The Spamhaus Project — receives DNS queries about sending IP addresses and domains as part of anti-spam checks; it does not receive message content.
Outbound mail is delivered directly by our own mail server (Postfix), not through a third-party sending relay. A Customer's own webhooks are configured and controlled by that Customer, who chooses where their event data is sent — see the Webhooks.
4. International transfers
Contabo and Hetzner process data in Germany, inside the EU. Cloudflare is a United States company, certified under the EU-U.S. Data Privacy Framework. Where it processes personal data outside the EU/EEA, the transfer relies on the EU-U.S. Data Privacy Framework adequacy decision, alternatively standard contractual clauses under Cloudflare's Customer DPA.
5. Retention
- Account data, sessions and audit events: kept for 180 days.
- Message content (subject, bodies, headers): erased 30 days after the message reaches its final delivery state.
- The message record and its events: erased 90 days after the message reaches its final delivery state.
- Attachment content: deleted once the message has sent, at the latest after 7 days.
- Webhook delivery attempts: kept for 7 days.
- Suppression-list entries (bounces, complaints): kept until the Customer removes the entry.
- Expired sessions: removed 7 days after they expire.
- Local backups of the database: 14 days. Off-site database backups: 14 days. Off-site configuration backups: 7 daily, 4 weekly, 3 monthly generations.
These are the retention periods DUST 4 Business has decided on for the data it holds; automated enforcement of the message-content and message-record periods above is being built and is not necessarily live yet — this page states the policy, not a claim that every period is already enforced automatically.
6. Your rights
Subject to the conditions the GDPR sets for each right, you may ask us to: give you access to your personal data; rectify it; erase it; restrict its processing; receive it in a portable format; and object to processing based on our legitimate interest. Send a request to privacy@postfly.app.
7. Right to lodge a complaint
You may lodge a complaint with the Slovak data protection authority, the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), or with the supervisory authority of your own EU/EEA member state.
8. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
9. Data the Service sends on a Customer's behalf
When a postfly Customer sends a message to one of its recipients, DUST 4 Business processes that recipient's data (address, and whatever the Customer put in the message) strictly on that Customer's instructions. For that data, the Customer is the controller and DUST 4 Business is the processor — the terms of that processing are in the Data Processing Agreement. If you are such a recipient and have a question about a message you received, contact the Customer who sent it; if it looks like spam or abuse, you can also report it to abuse@postfly.app.