Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between T1M LLC, which operates Ravenpost (“we”, “us”), and the customer who uses Ravenpost’s email features (“you”). It applies whenever we process personal data on your behalf in those features — the contacts you upload or collect, and what happens to the email you send them — and you accept it by using them. Where it differs from the Terms of Service, this DPA wins for that processing. It is effective from October 29, 2026.

1. Roles and parties

You are the controller of the personal data of the people on your lists, and we are your processor; if you keep a list for somebody else — an agency for its client — you are their processor and we are your sub-processor. We are a controller only of our own customers’ account data and of our own product news, as our Privacy Policy describes. The data exporter is you; the data importer is T1M LLC, 30 N Gould St #46732, Sheridan, WY 82801, United States, reachable at support@ravenpo.st.

2. The processing

• Subject matter — keeping your email contact lists and sending the campaigns you create to them, through our own sending (Amazon SES) or an email provider you connect.
• Duration — while you use the email features, and afterwards until the data is deleted under section 10.
• Nature and purpose — storing, organising and segmenting your contacts; hosting your subscribe forms and sending their confirmation emails; rendering and sending your messages; receiving delivery, bounce, complaint, open, click and unsubscribe notifications and recording them against the contact and the campaign; keeping addresses that unsubscribed, bounced or complained from being sent to again; and showing you reports.
• Personal data — email address; first and last name; the lists and tags a contact is on and up to 20 fields of your own from an upload; subscription status, how and when the contact was added and, for a form sign-up, when it was confirmed; for each campaign, whether the message was delivered, bounced or reported as spam, when it was first opened and clicked, and which links were clicked; and the bounce or complaint reason the receiving server or mailbox provider gave. We do not store recipients’ IP addresses or device details from opens and clicks.
• Data subjects — the people on your lists: your subscribers, customers, users and anybody else you email.
• Special categories — none. Do not upload health, religious, political, biometric or other special-category data, or data about children, into contacts, their fields or your campaigns.

3. Your instructions

We process your contacts’ personal data only on your documented instructions: the Terms of Service, this DPA, and what you do in Ravenpost — importing, organising, sending, deleting. We tell you if we believe an instruction breaks data protection law. You are responsible for the lawfulness of the data and of your instructions: a lawful basis for each person on your lists, the notices you owe them, and keeping to our Acceptable Use Policy.

4. Confidentiality

Only the people who operate Ravenpost can reach your contacts’ data, only to run, secure and support the service, and each is bound to keep it confidential.

5. Security measures

• Every connection — to our dashboard, our API, our link pages, Amazon SES and the providers you connect — is encrypted in transit (HTTPS).
• Our servers take no web traffic directly: every request reaches them through Cloudflare’s network. The only other way in is SSH with a key, for the people who operate the service, and the database is not reachable from the internet at all.
• The API keys and signing secrets of the email providers you connect are encrypted with AES-256-GCM before they are stored, and are never returned to a browser or shown in our administration tools.
• Every request is authenticated and checked against the workspace it addresses, so one customer’s lists cannot be reached from another customer’s session; sending a campaign, uploading a list and connecting a provider are limited to a workspace’s owners and admins.
• Unsubscribe and confirmation links carry signed tokens; the notifications providers send us are accepted only with the secret in their address and, where the provider signs them, a valid signature.
• We keep only what the processing needs: no recipient IP addresses or device details, per-message send records for 90 days, unconfirmed form sign-ups for a week, and server logs for 14 days.
• The database is backed up nightly on our servers, and each backup is kept for seven days.
• Administrative access to production is limited to the people who operate the service and is checked on our servers for every request.

6. Sub-processors

You authorise us to use the sub-processors below. Each is bound by a written agreement with data protection terms no less protective than this DPA, and we remain responsible to you for them.

At least 14 days before a new sub-processor starts processing your contacts’ data, we update this list and tell your workspace’s owners by email. If you object on reasonable data protection grounds and we cannot address the objection, you may stop using the email features and cancel your mail pack.

An email provider you connect yourself (Resend, Postmark, SendGrid, Mailgun or your own Amazon SES account) is not our sub-processor: you choose it and contract with it, and we pass it your messages and the recipients’ addresses on your instruction.

7. International transfers

Your contacts’ data is stored and processed in the European Union: our servers and database are in Frankfurt, Germany, and our own sending runs in Ireland. T1M LLC is a company in the United States, and the people who operate the service may reach the data from outside the EU; Cloudflare’s network may carry it outside the EU too.

Where this is a transfer of personal data from the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 apply and are incorporated into this DPA by reference — Module Two (controller to processor) and, where you are yourself a processor, Module Three (processor to processor) — with these choices: clause 7 does not apply; under clause 9, option 2 (general written authorisation) applies with the notice in section 6; the optional wording in clause 11 does not apply; under clause 17, the clauses are governed by the law of Ireland; under clause 18, disputes go to the courts of Ireland. Annex I is sections 1 and 2 of this DPA, Annex II is section 5 and Annex III is section 6. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner applies on top of them; for transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Federal Data Protection and Information Commissioner is the supervisory authority. Our sub-processors transfer data under their own Standard Contractual Clauses or another mechanism the law recognises.

If you are subject to Türkiye’s KVKK (Law No. 6698), we will sign the standard contract for transfers abroad published by the Personal Data Protection Authority on request; the party transferring the data notifies the Authority of it within five business days.

8. Helping you with people’s rights

The dashboard lets you find, correct, unsubscribe and delete any contact, which answers most requests from the people on your lists. If you need more, we help on request. If a request about your contacts reaches us, we pass it to you and do not answer it ourselves — except a request to stop receiving your email, which we act on at once by unsubscribing the person from your list, because the law expects an opt-out to work.

We also give you the information we hold that you need for a data protection impact assessment or a consultation with a supervisory authority about this processing.

9. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your contacts’ data, with what we know at the time — what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we have done and will do about it — and we keep you informed as we learn more. Notice goes to your workspace’s owners by email.

10. Deletion and return

• Deleting a contact removes it from your list at once. The records of messages already sent to it, which name its address, expire 90 days after they were made.
• Deleting a workspace removes all of its email data — contacts, lists, segments, forms, campaigns and their records — at once.
• Deleted data leaves our nightly backups within seven days. Delivery notifications waiting in our queue at Amazon are deleted once processed, and after 14 days at the latest.
• One thing stays: an address that bounced permanently on our own sending is kept on our platform-wide suppression list — the address, the receiving server’s reason and how often it bounced — because it does not exist and no customer’s email should be sent to it again. It is not linked to your workspace. Amazon SES may keep such addresses on its own suppression list for the same reason.
• Asked before deletion, we send you your contacts as a CSV file.

11. Audits

We make available the information you need to check that we keep to this DPA: this document, the description of our measures above, and written answers to a reasonable security questionnaire once a year. Where the law or a supervisory authority requires an inspection beyond that, we allow one on 30 days’ notice, during business hours, at your cost, by an auditor bound to confidentiality, and limited to the systems that process your data.

12. Liability and term

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow them to be limited. This DPA lasts as long as we process personal data on your behalf.

Contact

Questions about this DPA, or a request it describes? Email support@ravenpo.st, or write to T1M LLC, 30 N Gould St #46732, Sheridan, WY 82801, United States.