Data Processing Agreement

You (the customer) are the controller. mySMTP ApS, Refshalevej 163 A, DK-1432 København, Denmark, VAT no.: 29849439, is the processor. Contact for data protection matters: dpo@mysmtp.com.

Collection, parsing, normalization, deduplication, storage and delivery of feedback loop and complaint reports relating to your email sending, for the purpose of deliverability monitoring and suppression. Duration: the term of your subscription plus the retention periods below.

• Data subjects: recipients of your email who file a complaint, and your authorized users.
• Personal data: recipient addresses and header data present in raw reports, a SHA-256 hash of the normalized recipient address in complaint events, complaint timestamp, mailbox provider, sending IP and domain, and campaign/stream identifiers.
• No special categories of data are intentionally processed. Do not submit special-category data to Floopr.

• Process personal data only on your documented instructions, including for transfers, unless required by EU or member state law.
• Ensure persons authorized to process data are bound by confidentiality.
• Implement the technical and organizational measures in section 6.
• Assist you with data subject requests, DPIAs and prior consultations, taking into account the nature of processing.
• Notify you without undue delay after becoming aware of a personal data breach.
• At your choice, delete or return personal data at the end of the service, subject to legal retention obligations.
• Make available all information necessary to demonstrate compliance and allow audits or inspections, once per year or after a breach, on reasonable notice.

You give general authorization for the subprocessors below. We will give at least 30 days' notice of any intended addition or replacement, and you may object on reasonable data protection grounds.

• mySMTP ApS (own infrastructure) — Complaint intake mail servers and the raw-report mailbox, operated by Floopr's operator rather than a third party (EU)
• Lovable / Cloud hosting — Application hosting and edge delivery (EU / global CDN)
• Supabase — Managed database, authentication and storage (EU region)
• Stripe Payments Europe, Ltd. — Subscription billing and invoicing (Ireland / US (SCCs))
• Transactional email provider — Account, alert and billing emails (EU)

• TLS in transit and encryption at rest for all stored complaint data.
• Recipient identifiers pseudonymized before inclusion in normalized events and customer-facing APIs; raw reports treated as sensitive data with restricted access.
• Row-level authorization policies scope event rows to their attributed owner; public API keys are account-scoped and revocable.
• Least-privilege internal access, MFA on administrative accounts, and audit logging.
• Backups with 35-day rolling retention, restore testing, and documented incident response.
• Segregated environments for development, staging and production.

Processing takes place in the EU. Any transfer outside the EEA is covered by the EU Standard Contractual Clauses (Module 2 or 3 as applicable) together with a transfer impact assessment and supplementary measures.

• Raw FBL / complaint reports (ARF, provider payloads) — 30 days. Held only by Floopr's intake service (operated by mySMTP, EU) and never stored in the application database.
• Normalized complaint events (hashed recipient identifier, provider, timestamp, campaign/stream IDs) — Per plan: Free Test 1 month, Signal 6 months, Scanner 12 months, Watch Tower 36 months. Normalized events store a SHA-256 hash. After a subscription ends, the last paid plan's window applies.
• Aggregated metrics and reputation trends — 24 months. Aggregate only — no recipient-level data.
• Account, profile and billing records — Duration of contract + 5 years. Retained to meet EU bookkeeping and tax obligations.
• Application and access logs — 90 days. Security monitoring and abuse prevention.
• Backups — 35 days rolling. Deletions propagate on the next backup cycle.

In case of conflict, this DPA prevails over the Terms of Service with respect to processing of personal data. See also the Privacy Policy. A countersigned copy is available on request from dpo@mysmtp.com.