Privacy Policy
Floopr processes feedback loop and complaint signals on behalf of email senders. This policy explains what we collect, why, on which lawful basis, and how long we keep it.
Last updated: 1 October 2026
1. Controller and contact
mySMTP ApS (trading as Floopr.io), Refshalevej 163 A, DK-1432 København, Denmark, VAT no.: 29849439, is the controller for website visitors and account holders. Contact: privacy@mysmtp.com — data protection contact: dpo@mysmtp.com.
2. Two distinct roles
- Controller — for your account, profile, billing and support data, and for our own website analytics.
- Processor — for the complaint and feedback loop data we ingest, normalize and deliver back to you. You remain the controller of that data; our Data Processing Agreement governs it.
3. Data we process
- Account data: name, work email, company, country, VAT ID, billing email, authentication metadata.
- Billing data: subscription plan, invoices and payment status (card details are handled by Stripe, never by Floopr).
- Complaint / FBL data: provider, complaint timestamp, sending IP and domain, campaign and stream identifiers, message and header metadata, and a SHA-256 hash of the normalized recipient address. Raw reports can contain the original recipient and header data during their retention period.
- Technical data: IP address, user agent, request and error logs for security and reliability.
4. Purposes and lawful basis (GDPR Art. 6)
- Providing the service and your account — performance of a contract, Art. 6(1)(b).
- Processing complaint and FBL data on your instructions — Art. 6(1)(b)/(f) for you as controller; we act under Art. 28 as processor.
- Security, abuse prevention, fraud and service integrity — legitimate interest, Art. 6(1)(f).
- Invoicing, accounting and tax records — legal obligation, Art. 6(1)(c).
- Product analytics and marketing cookies — consent, Art. 6(1)(a), withdrawable at any time.
5. Retention schedule
We keep personal data no longer than necessary. Raw reports and normalized complaint events are deleted automatically by scheduled jobs on the schedule below; the other periods are the maximum we keep those records.
| Data | Retention | Notes |
|---|---|---|
| Raw FBL / complaint reports (ARF, provider payloads) | 30 days | Held only by Floopr's intake service (operated by mySMTP, EU) and never stored in the application database. |
| Normalized complaint events (hashed recipient identifier, provider, timestamp, campaign/stream IDs) | Per plan: Free Test 1 month, Signal 6 months, Scanner 12 months, Watch Tower 36 months | Normalized events store a SHA-256 hash. After a subscription ends, the last paid plan's window applies. |
| Aggregated metrics and reputation trends | 24 months | Aggregate only — no recipient-level data. |
| Account, profile and billing records | Duration of contract + 5 years | Retained to meet EU bookkeeping and tax obligations. |
| Application and access logs | 90 days | Security monitoring and abuse prevention. |
| Backups | 35 days rolling | Deletions propagate on the next backup cycle. |
6. Subprocessors and transfers
- mySMTP ApS (own infrastructure) — Complaint intake mail servers and the raw-report mailbox, operated by Floopr's operator rather than a third party (EU)
- Lovable / Cloud hosting — Application hosting and edge delivery (EU / global CDN)
- Supabase — Managed database, authentication and storage (EU region)
- Stripe Payments Europe, Ltd. — Subscription billing and invoicing (Ireland / US (SCCs))
- Transactional email provider — Account, alert and billing emails (EU)
Data is hosted in the EU. Where a subprocessor processes data outside the EEA, transfers rely on the EU Standard Contractual Clauses together with supplementary measures.
7. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. Requests: privacy@mysmtp.com. You may also lodge a complaint with Datatilsynet (Danish Data Protection Agency) or your local supervisory authority.
8. Security
Encryption in transit and at rest, least-privilege access, row-level authorization on all customer data, hashed recipient identifiers, audit logging and documented incident response with notification to affected controllers without undue delay and within 72 hours where required.