Privacy overview

When an account is created, the service records details such as a name, email address, organization name, role, and account activity. Passwords are stored as hashes rather than plain text.

If passkeys are enabled, the browser and authenticator create a credential. A private key stays with the authenticator or a synced passkey provider; the service stores the corresponding public key credential information and a short-lived sign-in challenge.

Your smartest.email workspace is hosted in the European Union. Sending an email involves delivery infrastructure and the recipient's mail provider, which may be in another country. EU hosting does not mean every data flow remains in the EU or, by itself, establish GDPR compliance.

The General Data Protection Regulation (GDPR) applies to personal data such as identifiable subscriber email addresses. Organizations using a workspace decide whom to contact and why; they need an appropriate legal basis, clear information for contacts, and a way to honor applicable rights. Direct marketing email is also subject to applicable electronic marketing rules. See the European Commission's GDPR guidance and our data protection overview.

Organizations can add or import contact email addresses, names, tags, custom fields, and subscription status. Website signup forms can also collect visitor-provided fields and an explicit marketing consent choice. The service records the consent wording, signup site origin, and time for accepted signups. Campaigns can contain subject lines, sender details, templates, message content, selected audiences, schedules, and sending domain settings.

The organization using the workspace decides which contacts to include and what to send. It is responsible for its collection notices and permissions. The draft terms set out responsible-sending expectations.

The Enterprise contact form asks for contact and organization details, expected usage, and any notes you choose to provide. Your submission includes your agreement to be contacted about the inquiry. It is sent to the website's contact intake service so the team can respond.

The final notice must identify the operator and providers handling these inquiries, their retention period, and any international transfers.

The current web app stores access and refresh tokens in your browser's localStorage after sign-in. The frontend removes those tokens when you sign out and may remove them when a session is rejected. A passkey sign-in uses the same application session tokens after authentication.

People with access to the browser profile or device may be able to use a session that remains signed in. Sign out on shared devices and protect your browser profile.

To deliver campaigns and show results, the platform records send and delivery outcomes, bounces, unsubscribe activity, and engagement events. Campaign HTML can include a small image used to record an open, and campaign links can pass through a tracking redirect to record a click before reaching the destination.

These events are associated with a campaign and contact so the sending organization can see campaign results. Opens and clicks are imperfect indicators: email clients, privacy tools, and automated systems can affect the counts.

Data is used to authenticate members, operate the workspace, prepare and deliver messages, enforce permissions and sending controls, show reports, and investigate service faults or abuse.

Recipient addresses and message content necessarily travel through sending infrastructure and destination mail systems to deliver a campaign. Authorized members of the sending organization can access workspace data according to their permissions. The final notice must identify the service operator, relevant providers, and any international data transfers.

The service stores account, contact, form, campaign, and event records to operate the workspace. The exact retention and deletion schedule has not been finalized for this public notice. The planned tier comparison contains product targets, not a verified promise about current operational retention.

Access controls and authentication checks are part of the current product. No security measure eliminates every risk, and final security, backup, and incident information should be reviewed before an external launch.

Campaign recipients can use the unsubscribe link in a message to stop future campaign sends to that address and can object to direct marketing. Workspace members can edit some account and audience details through the product.

Depending on the circumstances, people may have rights to access, correct, erase, restrict, or receive their personal data, and to object to certain uses or withdraw consent. The European Commission explains these rights. The final privacy notice must provide the legal service operator's contact route, the applicable legal bases, retention periods, and information about complaints to a supervisory authority before external publication.