1. Controller vs. processor
Supromail is a messaging and hosted business-email service operated by Leatra Technologies LTD. We are the controller of personal data used to operate our relationship with you, such as account, billing, support, and security information.
When you use Supromail to send, receive, store, or route Customer Data, we generally act as your processor. Customer Data includes message content, hosted mailbox content, recipient details, and other data you submit. We process it on your documented instructions and to provide, secure, and support the Service. You are responsible for giving required notices, establishing a lawful basis, and responding to requests from people whose data you provide.
If you are a message recipient, normally contact the Supromail customer that contacted you. We will assist that customer where required by law and our agreement with the customer.
2. Information we collect
We collect information you provide, information generated through use of the Service, and limited information from third parties involved in providing the Service.
| Category | Examples |
|---|---|
| Account and workspace information | Name, email address, company or workspace name, account settings, and authorized users. |
| Service configuration | Domains, connected sending resources, routing settings, webhook endpoints, and credentials or tokens you choose to connect. |
| Customer Data | Message content, hosted mailbox content, recipient details, and data you send, receive, store, or route. |
| Usage and security information | Service activity, delivery and routing records, device and browser information, IP address, authentication events, and diagnostic logs. |
| Support communications | Information supplied for help, including the support chat form's required email address and optional name. |
| Payment information | Checkout and payment status supplied by the provider; card details are handled by that provider. |
We may receive recipient details and message content from customers, limited transaction status from payment providers, and information needed to operate customer-selected third-party channels.
3. How we use information
We use personal data to provide, maintain, and support the Service; authenticate users and administer subscriptions; send service, account, billing, and security communications; prevent fraud and abuse; investigate incidents and enforce our agreements; comply with legal obligations; and improve reliability using aggregated or de-identified information where appropriate.
Where we are the controller, legal grounds may include contract performance, legitimate interests in operating and securing the Service, legal obligations, and consent where required. When we process Customer Data for a customer, that customer is responsible for the applicable legal ground.
4. Retention
We retain personal data only as long as needed for the purposes in this policy, unless a longer period is required or permitted by law.
| Data | Retention approach |
|---|---|
| Delivery and message-history records | For the applicable Service plan, subject to rolling history limits. |
| Hosted mailbox content | While the mailbox exists, subject to storage allowance, until you delete it or the applicable account is deleted. |
| Temporary mailbox export archives | Available for up to 24 hours; stored in Cloudflare R2 and scheduled for deletion through the hosted Service's export lifecycle. |
| Account, access, and security records | During the account relationship and at least 90 days where needed for security, audit, abuse prevention, and dispute handling. |
| Support communications | Generally 90 days after closure. On workspace deletion, we remove the support contact and resolve conversations; the support portal removes resolved conversations after 90 days unless a longer period is necessary for an unresolved matter, security investigation, dispute, or legal obligation. |
| Payment and transaction status | Only as needed to administer a subscription, address a transaction issue, and meet legal obligations. |
When you delete an account or Customer Data, the Service removes it from active systems under the applicable deletion process. Limited copies may remain in protected recovery systems until overwritten, and information may be retained for a legal obligation, dispute, or agreement enforcement.
5. Your rights and choices
Depending on where you live and our role for the relevant data, you may have rights to request access, correction, deletion, restriction, portability, objection to some processing, and withdrawal of consent where processing is based on consent.
You can update certain account and workspace information in the Service. You may request access to or deletion of account information by contacting us. We may need to verify your identity and authority. When we process Customer Data for a customer, we may direct you to that customer or act on its instructions.
7. International data transfers
Our hosted production infrastructure is in Germany, so personal data processed through the hosted Service may be processed there. We take account of applicable data-protection requirements when personal data is transferred across borders.
8. Security
We use measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. See the Security page for a high-level summary and reporting contacts.
9. Sensitive data
Do not use the Service for protected health information, payment-card data, government identifiers, biometric data, or other highly sensitive or regulated personal data unless we have agreed in writing that the intended use is supported.
10. Children's privacy
The Service is not directed to anyone under 18. Do not create an account or provide personal data through the Service if you are under 18. If you believe a child has provided personal data, contact us and we will take appropriate steps to address the report.
11. Changes to this policy
We may update this policy as the Service or applicable law changes. We will post the revised policy here and update the Last updated date. If a change materially affects how we process personal data, we will provide additional notice where required.
12. Contact us
For privacy questions or requests, contact [email protected]. For legal matters, contact [email protected]. For Service support, contact [email protected].
Leatra Technologies LTD
House R5, B1A Road, T.A Gardens, Warewa, Ogun State,
Nigeria