Privacy policy

Who we are

PuffinMail (puffinmail.co) is an email marketing service for online stores, operated by Solaniq in Sydney, Australia ("we", "us"). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Questions: hello@puffinmail.co.

Two kinds of information

1. Information about you, our customer

When you sign up for or use PuffinMail, we collect:

• your name, email address and password (stored only as a secure hash);
• your business details: store name, website, platform and approximate list size;
• account settings, such as your sending domains and plan;
• technical information needed to keep accounts secure, such as sign-in times, IP address and browser type;
• messages you send us.

We use it to provide and secure your account, to contact you about the service, and to meet our legal obligations.

2. Your subscribers' information

When you use PuffinMail, you give us information about your subscribers and customers: typically email addresses, names, and store activity such as carts and orders for automated emails. You decide what to send us and why. We handle it only on your instructions and only to provide the service: storing your lists, sending your emails, processing unsubscribes, bounces and complaints, and reporting results to you.

You're responsible for having a lawful basis to collect and email that information (see ourAcceptable Use Policy). We don't sell it, rent it, combine it with other customers' data, or use it to market to your subscribers ourselves.

Where your information is stored

PuffinMail runs on Amazon Web Services in the Sydney (ap-southeast-2) region. Your account data, lists and email history are stored there. Emails are delivered through Amazon Simple Email Service in the same region.

Who we share it with

We use a small number of service providers to run PuffinMail, each bound to protect the information:

• Amazon Web Services: hosting and email delivery (Sydney region);
• Google Workspace: our own business email, for correspondence with you;
• Google sign-in, if you choose "Continue with Google": Google shares your name, email address and profile picture with us so you can sign in without a password;
• Google reCAPTCHA: protects our sign-up and sign-in forms from automated abuse. It collects information about your device and how you use the page, under Google'sPrivacy Policy.
• Google Analytics: tells us how people find and use this website and how many start a trial. It receives pseudonymous usage data (pages viewed, the link that brought you here, device and browser type, approximate location), never your email address or the contents of your account.

We may also disclose information if the law requires it, or to protect the security of our service, our customers or the public, for example when investigating spam or abuse. We don't disclose personal information to overseas recipients, except where a provider needs to process it for one of these purposes.

AI apps you connect

You can connect an AI app, such as Claude or ChatGPT, to your PuffinMail account (Settings → AI agents), by signing in and approving it or with an access token you create. The app then receives what you or it asks PuffinMail for: your email results (sends, opens, clicks, revenue), and the names and numbers of your campaigns, automations, segments and sign-up forms. It never receives who your subscribers are or their email addresses. If you allow drafts, it can create draft campaigns, segments and automations in your account; it can't send, schedule, turn on or delete anything.

The app is one you choose, and its provider handles what it receives under its own terms and privacy policy. We record each request (which tool, when, and whether it worked, not what was asked or answered) for 90 days, to show you how a connection is used and to prevent abuse. You can disconnect an app at any time under Settings → AI agents.

Cookies and tracking

This website and the PuffinMail sign-up and sign-in pages use Google Analytics, which sets first-party cookies to count visits and trial sign-ups. We use it to understand which pages and campaigns bring people to PuffinMail; it isn't used to show you ads. You can opt out with your browser's privacy settings or Google'sopt-out add-on. Inside your account, we don't use analytics, apart from noting once that a free trial has started (with the plan chosen). The PuffinMail account area (my.puffinmail.co) uses an essential session cookie to keep you signed in, and its sign-up and sign-in pages load Google reCAPTCHA, which may set its own cookies for security. Emails sent through PuffinMail may include open and click tracking so you can see your results. You can turn this off, and recipients can unsubscribe from any email.

Security

We protect information with encryption in transit (HTTPS/TLS), hashed passwords, encrypted storage of sensitive credentials, access limited to people who need it, and regular security updates. No system is perfectly secure. If a data breach is likely to cause serious harm, we'll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

How long we keep it

We keep your account information while your account is open. After you close your account, we delete or anonymise your account data and lists within 90 days, unless we need to keep some records longer to meet legal obligations, for example tax records. Suppression records (people who unsubscribed or complained) may be kept so they aren't emailed again.

Access, correction and complaints

You can ask to access or correct the personal information we hold about you by emailinghello@puffinmail.co. We'll respond within 30 days. If you're a subscriber of one of our customers, contact that business first: they control their list. We'll help them respond.

If you have a privacy complaint, email us and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We'll update this page when our practices change, and tell customers by email about significant changes. The date at the top shows when it was last updated.