Privacy Policy

Introduction

Railsware Products Studio LLC, a company incorporated in the State of Delaware, the United States of America, having its business address at 117 E Colorado Blvd, Suite 600, Office 650, Pasadena, CA 91105 (“Railsware”, “us”, “our”, or “we”), focuses on assuring that the mailtrap.io website (the “Site”) and the Mailtrap application (the “Service”), as well as the general ecosystem, provides a safe environment for everyone who visits our Site (“Site Visitors”), and exploits the Service.

For the purpose of this Privacy Policy Customer shall mean a business-to-business customer, professional or public institution who orders the Service and is identified in the relevant billing statements, invoices and/or online subscription process as the customer (“Customer”). Authorized End User shall mean any end user associated with Customer’s organization for whom Customer establishes access credentials to the Service (“Authorized End User”).

We need to collect, process, and store some Personal Information (as defined in Section 2.1 below) and Navigational Information (as defined in Section 2.2 below) in order to provide our Customers, Authorized End Users and the Site Visitors with the ability to review the Site content, allow for use the Service, enable to make online payments, submit support requests and product ideas for our consideration.

We are dedicated to protecting our Customers, Authorized End Users and the Site Visitors’ privacy. This Privacy Policy (herein the “Policy”) applies to the Site and the Service, and administers the ways we collect, process and store data. The Policy has a direct reference to the Terms of Service and applies to it. It also explains how our Customers, Authorized End Users and the Site Visitors can exercise their rights to obtain, access, erase, use, or rectify their Personal Information that was of their own free will submitted to us.

When our Customers, Authorized End Users and the Site Visitors browse the Site, subscribe to the Service plan, use the Service, leave support requests, submit product ideas, fill out a survey, add comments to the blog posts, or perform an online payment, they give their consent and fully agree to the Policy under which Railsware collects, processes, uses, stores and discloses Personal Information. If our Customers, Authorized End Users and/or the Site Visitors do not agree with the terms and conditions stated in this Policy, they should not browse the Site, subscribe to the Service plan, use the Service, make online payment, submit support requests and product ideas, and perform other activities, which may result in supplying us with their Personal Information and Navigational Information.

Railsware is not established in the European Union, but it processes and stores Personal Information and Navigational Information of its Customers, Authorized End Users and the Site Visitors who are EU citizens, and browse the Site or subscribe to a free or paid Service subscription plan, submit support requests, make online payment, and perform other activities, that may result in supplying us with their Personal Information and Navigational Information.

1. Service User and Site Visitor Data We Process

1.1 Data Provided to Us

When our Authorized End Users and the Site Visitors register an account with the Service (the “Account”), subscribe to the Service, make an online payment, participate in a survey, subscribe to the Service free or paid plan, email us or in any other way submit their Personal Information to us, Railsware may collect, process and store the following Personal Information: first and last name, email and posting address.

We do not store banking card details on any of our internal resources/databases, instead, Customers and Authorized End Users share it directly with the Payment Card Industry Data Security Standard-compliant service providers for further processing. When receiving an online payment, we collect and store Customers subscription ID. We also collect and process Authorized End Users’ Personal Information, which they add to the billing settings in their Account, which may include first and last name, company name, shipping and billing address(es), tax and/or VAT number, and phone number.

Our Authorized End Users and the Site Visitors will know when we gather their data through the Site or Service, as they will provide their Personal Information on one of the Site’s web pages and perform an action that will authorize it to be sent to us.

We will keep a record of our Customers, Authorized End Users and the Site Visitors’ purchases, marketing-, sales- and support-related communication and replies, and general Service usage statistics in order to provide them with the support services.

To provide technical support, investigate abuse and security incidents, and operate the Service, we may access the User Content. Such access is logged, limited to what is necessary for the relevant purpose, and consistent with the Data Processing Addendum. To protect the security, integrity, and reliability of the Service and to detect, prevent, and investigate spam, phishing, and other abuse, we may analyze the content of emails sent through the Service using automated tools, including AI-based content analysis carried out by us or our authorized sub-processors. AI-assisted analysis is applied only to emails flagged by our internal abuse-detection systems, is limited to what is necessary for abuse prevention and security purposes, and is performed in accordance with this Policy and the Data Processing Addendum.

1.2 Data We Collect Automatically

Railsware may collect information through our Site and the Service. The data we gather from Authorized End Users and the Site Visitors’ device: its type, IP address, the browser they are using, OS (operating system), as well as the referral site from which they entered the Site. We may also monitor Authorized End Users and the Site Visitors’ online behavior, including the time of their visit, their online activity at the Site including the URL clickstream through the Site, the pages visited, the time spent viewing them, and the frequency of such visits. We gather this data automatically through commonly used data-gathering technologies, like cookies and web beacons in order to understand how Authorized End Users and the Site Visitors’ browse the Site and use the Service. This data helps us manage the Site and the Service, analyze general online behavior and usage trends, and provide targeted advertisements. We also collect demographic information about our Service Authorized End Users and the Site Visitors’ base that helps us tailor both the Site content and the Service functionality in order to meet their expectations and requirements.

Railsware may capture User Content visible in the Authorized End User’s interface at the time of the session and collect session-replay records in order to diagnose product issues, monitor the stability of the Service, as well as improve usability. Recordings are retained by the sub-processor for 30 days and are then automatically deleted.

When our Authorized End Users and the Site Visitors’ browse the Site or use the Service, we collect Personal Information and Navigational Information along with the unique user IDs. In addition, we aggregate extra data that refers to the usage flow, such as the start and the end of a web session, page views, purchase, and checkout. We may associate this data with the information we store within the analytics software to the Personal Information that You submitted to us. We do this to enhance our Service, Site content, and UX, as well as use this data to improve the Service functionality, our marketing communication, and analytics.

1.3 GitHub and Google Sign-in Authentication

Authorized End Users may log into our Site and/or the Service using either GitHub or Google Sign-in authentication system. When they use either GitHub, Office-365 account or Google Sign-in authentication, Authorized End Users give us access to their full name and email address. This data is stored by us in compliance with the Policy.

1.4 Usage of reCaptcha

Railsware uses reCaptcha versions 2 (checkbox) and 3 (invisible) to protect the Site and the Service from spam and abuse. reCaptcha version 2 is embedded on the Service email sign-up, forgot password, and resend confirmation instructions Site pages. The invisible reCaptcha version 2 and version 3 is placed on the Service add new card billing page. So, when an Authorized End User signs up using an email, resets a password, and adds bank card details to the payment service provider, Google processes the necessary information in order to differentiate a human being from a bot.

2. Types of Information

2.1 Personal Information

Under ‘Personal Information’ we understand any data that our Authorized End Users and the Site Visitors of their own free will provide us with, such as their first and last name, phone number, their email address, company name, posting, and billing address, as well as any other information that refers to them or to their workplace (business). We also collect the Authorized End User ID that is assigned to their browser, and the Customer ID that is associated with the use of the Service and Account. Personal Information also refers to other information that is available on the internet, such as from Facebook, LinkedIn, Twitter, and Google, and includes any other publicly available data that our Customers, Authorized End Users and the Site Visitors previously agreed to share and that is available from other service providers.

2.2 Navigational Information

‘Navigational Information’ refers to Authorized End Users and the Site Visitors’ computer and their visits to the Site and Service such as their IP address, geographical location, browser type, referral source, length of visit, and pages viewed. For more information, please visit the Navigational Information web page.

2.3 Sensitive Information

Railsware does not intentionally collect, and the Site Visitors and the Service Authorized End Users should not provide any information about their medical or health condition, race, and ethnic origin, political opinions, religious and philosophical beliefs, as well as bank card information, tax, and passport numbers, driver’s license or other similar personal identifiers.

When our Customers and Authorized End Users subscribe to the Service they shall be requested to share bank card numbers and billing information. Please be aware that Railsware does not store any payment details of our Customers, our Customers and Authorized End Users provide these details directly to our service providers, which are compliant with the Payment Card Industry Data Security Standard. The payment providers process Customers’ billing data in accordance with their privacy policies and security guidelines. To the best of our knowledge, our payment providers are compliant with the Payment Card Industry Data Security Standard and act according to the highest industry standards. To learn more about the way they process Customers’ data, Customers should refer to their privacy policies and security guidelines.

3. Use of the Information We Collect

3.1 Compliance with this Policy

Railsware uses the Personal Information it collects only in compliance and according to this Policy. Therefore, our Customers, Authorized End Users and the Site Visitors should read carefully this Policy and other agreements published on the Site and/or as part of the Service before proceeding with browsing the Site or using the Service.

3.2 How We Use Personal Information We Collect

We use Personal Information we collect from or about our Authorized End Users and the Site Visitors to:

Enhance user experience while browsing the Site and applying the Service for the commercial purposes;
Manage Site’s content and customize it according to the Site Visitors preferences;
Manage Site’s and Services’ security and system administration;
Create Accounts and provide information to a PCI-compliant service provider for payment processing;
Respond to customer support and other Site- or Service-related requests;
Communicate with the Service Authorized End Users, inform them about the important product- and company-related updates;
Contact the carefully-selected Service Authorized End Users to inform about other Railsware products and services that we think may be of interest to them;
Distribute other personalized marketing information;
Hold surveys, send out questionnaires that help us understand our Customers, Authorized End Users and Site Visitors’ requirements and expectations from the Service, the Site, support or any other services that we provide;
Put together and analyze the statistical data of the Site and the Service usage;
Detect, prevent, and investigate spam, phishing, and other abuse of the Site or the Service, including through automated analysis of the content of emails sent through the Service (which may involve AI-based tools), as a security measure necessary to operate and protect the Service;
Conduct an investigation of unauthorized access and use of the Site or the Service, fraud, breach and other illegitimate actions;
Issue invoices, take payment, and recover any amounts owed to us for the Service, including sending payment links, reminders and collection notices, and handling billing disputes, including after an Account has been closed or deleted.

3.3 Use of Bank Card Information

The bank card details Customers and Authorized End Users provide when registering for a paid Service subscription plan are neither stored nor processed by Railsware, but are disclosed by Customers and Authorized End Users to Payment Card Industry Data Security Standard compliant service providers, for processing. These third parties store Customers’ data in order to charge them on a monthly basis for the Service. The billing process will continue until Customers or their Authorized End Users request us to delete their Account, or when they cancel their subscription.

3.4 Service Providers

Railsware may employ other organizations and persons (“Agents”) to perform tasks or provide services to the Site Visitors or Service Authorized End Users and may need to share their Personal Information or Navigational Information with them to provide data, products, and services to them. These tasks and services may include marketing and support activities, analyzing different types of data, and providing advisory and legal services. In all the cases when Railsware shares information with such Agents, we will request for the agent to accept and strictly observe our Policy.

3.5 Personal Information Security

Railsware applies different security technologies, guidelines, and procedures to ensure complete security, as well as full confidentiality of the Personal Information our Customers, Authorized End Users and the Site Visitors provide. We also take measures to avoid unauthorized access to Personal Information and electronic communication systems. Your Personal Information is securely stored on servers and protected from unauthorized usage, leak, and exposure. The transfer of any sensitive data, if applicable, to an authorized third party happens through the use of encryption (such as the Secure Socket Layer protocol and the Transport Layer Security) which guarantees the complete safety and security of Your data.

For any questions that relate to the security of Personal Information, please email us at privacy@mailtrap.io

3.6 Links and Third-Party Sites

The Site includes links to third-party websites. These websites may offer certain services to end-users. Railsware does not take any responsibility for its content, services, administrators, practices, and policies, and does not endorse them. Railsware also does not bear any responsibility for the privacy of information that our Customers, Authorized End Users and the Site Visitors submit on these resources, since this Policy does not apply to them. We recommend our Customers, Authorized End Users and the Site Visitors familiarize themselves with the Policy and other legal documents before submitting or sharing any personal information with them.

3.7 Third-Party Services

The Site includes third-party systems that allow for support requests or product-related idea submission, as well as adding comments to articles published on the Site blog. The system, which accepts support requests and product ideas, provides us with the name and email of a user who submitted it so that our team can take action and respond to these messages. The system, which enables users with the right to publish comments performs Personal Information collection, storing, and processing on its side, giving us the right to monitor the comments that appear on the Site’s blog.

3.8 Data Retention

Railsware will retain Authorized End Users and Site Visitors’ Personal Information for the period required to fulfill the obligations it took as the Service provider and the Site owner, or unless a longer period of time is required by law for tax, legal, or other regulatory reasons. The paragraphs below describe how we handle deletion requests and the periods for which we retain each category of Personal Information. Railsware will delete Personal Information at the earliest date per request from our Authorized End Users or Site Visitors, subject to the retention periods described in this Section, and except where we are required to retain it for tax, accounting, legal or other regulatory reasons, or where retention is necessary to issue and settle an outstanding invoice, recover amounts owed to us, or handle a related dispute.

The Service comprises several functionalities, and the Personal Information we hold, and the periods for which we hold it, differ between them. Email testing captures emails that an Authorized End User sends from a development or staging environment into a test inbox, and stores the message together with its metadata, including sender and recipient addresses, subject line, body and attachments. Email sending transmits transactional and commercial emails to real recipients on the Customer’s instructions, and stores the message together with its recipient addresses and the associated delivery data. We take appropriate measures to protect the security of that content. The retention periods applicable to each functionality are set out below.

For email testing, when a Service Authorized End User clears their Mailtrap inbox, the deleted data is completely removed from the Service. We do not store any email message-related information in logs.

Deletion of Accounts. When an Authorized End User or Customer requests deletion of an Account, access to the Account is revoked immediately. Directly identifying Personal Information is deleted without undue delay or, where a record cannot technically be deleted, the identifying values within it are irreversibly replaced with non-identifying values. A limited subset of account and usage data from which direct identifiers have been removed is then retained for up to 90 days from the date of the deletion request. Within that subset, account, organisation, user and domain identifiers are replaced with randomly generated values, and no table linking those values back to any other system is retained, so the records cannot be re-linked to Authorized End Users. At the end of the 90-day period the detailed records are irreversibly aggregated into statistical records that no longer relate to an identifiable person, and the underlying detailed records are deleted. The aggregated records are no longer Personal Information and are retained without a time limit.

We retain that limited subset only in order to detect, investigate and prevent spam, phishing, fraud and other abuse of the Service, to improve our anti-abuse systems, and to analyse service usage. We do not use Personal Information retained on this basis for marketing, advertising, or profiling.

Where, at the time of a deletion request, we believe an Account shows indicators of abuse, we may analyse the content of emails sent from that Account, including by automated and AI-assisted means, in order to produce a summary of the abuse signals identified. The underlying content is deleted once that analysis is complete. Only the summary is retained, and it is produced so that it does not identify individual senders or recipients.

Deleted Accounts analytics. The pseudonymised subset described above is held in a separate analytics environment. It does not include the content of emails, recipient addresses or contact lists, sender, owner or user names and email addresses, IP addresses, or identifiers issued by our payment providers. We use it to understand why customers stop using the Service and to study patterns of abuse and misuse, and after the 90-day period only in aggregated, anonymous form.

We retain Personal Information for the following periods, by category:

Account registration and profile data, including first and last name, email address and postal address – for as long as the Account remains active; on a deletion request, deleted or irreversibly redacted without undue delay.

Billing and subscription records, including subscription ID and the billing details we hold – for as long as required for tax, accounting, audit and other legal or regulatory purposes under applicable law.

Account, usage and behavioural data, including sending statistics, login records, plan and seat information, trust and abuse scores and anti-spam alerts – for as long as the Account remains active, and for up to 90 days following a deletion request, after which it is irreversibly aggregated.

Abuse summaries generated as described above – for up to 90 days following a deletion request, after which it is irreversibly aggregated.

For testing functionality – content of emails created, sent, forwarded or received through the Service – deleted when the Authorized End User clears the inbox, or on Account deletion;

For sending functionality – content of emails created and email logs – deleted upon the deletion request within the retention period of no more than 30 days;

Server and application logs – no more than 30 days;

Irreversibly aggregated data or anonymised statistical records – retained without a time limit, as they no longer constitute Personal Information.

Where a longer retention period is required by law, or where Personal Information is necessary for the establishment, exercise or defence of legal claims, we retain that Personal Information for the longer period and delete it once the requirement or claim has ended.

3.9 Сompelled Disclosure

Railsware reserves the right to disclose Personal Information to public authorities in accordance with a legal liability to perform their duties, such as customs and tax authorities, financial investigation units, judicial administration and other parties if the EU or the Railsware’s representative member state law allows to exercise such disclosure in the public interest, including protection of our Customers, Authorized End Users and Site Visitors and other people’s safety.

3.10 Legal Basis for Processing

Where the GDPR, the UK GDPR or a comparable data protection law applies to our processing of Personal Information as a controller, we rely on the following legal bases:

Performance of a contract, or steps taken at your request before entering into a contract: to create and administer Accounts, provide and support the Service, and process payments and invoices.

Our legitimate interests: to secure and administer the Site and the Service; to detect, investigate and prevent spam, phishing, fraud and other abuse, including through the automated and AI-assisted analysis described in Sections 1.1 and 3.8; to retain the limited post-deletion subset described in Section 3.8; to analyse usage, product performance and customer churn; to improve the Site, the Service and our communications; and to establish, exercise or defend legal claims. Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms, and you may object to the processing as described in Section 4.1.

Compliance with a legal obligation: to meet our tax, accounting, regulatory and law-enforcement obligations, including as described in Section 3.9.

Consent: for direct marketing communications where consent is required, for non-essential cookies and similar technologies, and for any other processing for which we specifically ask for your consent. You may withdraw consent at any time as described in Sections 4.1 and 4.2. Withdrawing consent does not affect processing carried out before withdrawal, and does not affect processing that we carry out on a legal basis other than consent.

Where we act as a processor on behalf of a Customer, the Customer determines the purposes and legal basis for the processing, and our obligations are set out in the Data Processing Addendum.

4. Data Subject Rights

4.1 Site Visitor and Service Authorized End User Rights

Our Site Visitors and Service Authorized End Users have the following rights:

To request access to their Personal Information;
To remove consent from being contacted by email, phone and other means of communication;
To request for all Personal Information that was received from them to be deleted from all our records, subject to the limited exceptions described in Section 3.8 and to Personal Information that we are required or permitted by law to retain, including in order to detect security incidents and to protect against malicious, deceptive, fraudulent or illegal activity;
To request that we update, correct or remove any omissions in their Personal Information that we store;
To opt out from all kinds of direct marketing and other communication;
To object the processing of their Personal Information, or ask us to restrict the processing of their Personal Information, or request portability of their Personal Information;
To withdraw their consent from collection and processing of your Personal Information at any time. Withdrawing their consent will not affect the lawfulness of any processing we conducted prior to their withdrawal, nor will it affect the processing of their Personal Information conducted in reliance on lawful processing grounds other than consent;
To complain to a data protection authority about our collection and use of their Personal Information. Contact details for data protection authorities in the EEA, Switzerland, and certain non-European countries (including the USA and Canada) are available here.

Exercising Your right to data deletion. When we receive a request to delete an Account, we revoke access to the Account immediately and delete or irreversibly redact the directly identifying Personal Information we hold. We then retain the limited pseudonymised subset of account and behavioural data described in Section 3.8 for up to 90 days, solely in order to detect and investigate abuse, protect the security of the Service, and analyse customer churn, after which that subset is aggregated into anonymous form and the detailed records are deleted. Personal Information that we are required by law to keep, for example for tax, accounting or audit purposes, is retained for the period the law requires. We do not retain your email content for these purposes.

Exercising Your right to object. Because we rely on our legitimate interests, and not on your consent, for the abuse and security analysis described in Sections 1.1 and 3.8 and for the retention described above, you have the right to object to that processing at any time under Article 21 of the GDPR. If you object, we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. Where you object to direct marketing, we will stop that processing in every case. To object, email us at privacy@mailtrap.io describing what you object to, and we will respond without undue delay.

If You are a California resident, please visit our Do not Sell or Share My Personal Information page to learn more about Your privacy rights.

In order to exercise any of these rights, please email us at privacy@mailtrap.io. We will provide a response to their request as soon as possible, informing them about the steps we have taken to ensure that their rights are exercised.

4.2 Opting Out from Our Communication

Our Authorized End Users and Site Visitors may opt out of our marketing communications by pressing the ‘unsubscribe’ link, which is located at the bottom of our email, or sending us unsubscribe request to privacy@mailtrap.io.

Our Authorized End Users cannot unsubscribe from our transactional emailing (which also includes Welcome, Forgot password, Confirmation, Billing plan-related emails, invoicing, as well as Critical Service updates), and other information that refers to their Account.

Before enabling Service’s email forwarding functionality, we ask a recipient to provide consent to receive all forwarded by certain Service user emails.

4.3 Children’s Information

Our Site and the Service are not intended for children’s use. We do not knowingly accumulate any data from children under the age of 16. If any of our Customers, Authorized End Users or Site Visitors believe that we might have gathered some information from children under the age of 16, please let us know at privacy@mailtrap.io and we will delete this data from our databases and other applicable resources, if any.

5. International Transfer of Information

5.1 The International Transfer

To perform our operations, we may transfer and access Personal Information from around the world, including the United States, the EU, and other countries. While transferring the data, we take the necessary measures to safeguard the activity in general, and the Data Subjects in particular to ensure an appropriate level of protection for their fundamental rights. The Policy shall apply even if Personal Information is transferred or accessed from other countries.

We use third-party services (as described in this Policy), which may be based in other countries that may not have equivalent Privacy and Data Protection laws to the country in which our Authorized End Users and the Site Visitors reside. When we share information about our Authorized End Users or Site Visitors residing in the European Economic Area and Switzerland, European Commission-approved standard contractual data protection clauses, or other appropriate legal mechanisms to safeguard the transfer.

6. Data Privacy Framework

6.1 Adherence to Data Privacy Framework

Railsware Products Studio LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

Railsware Products Studio LLC has been certified by the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.

Railsware Products Studio LLC has been certified by the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

6.2 Complaints mechanism

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Railsware Products Studio LLC commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Railsware Products Studio LLC commits to resolve DPF Principles-related complaints about our collection and use of Your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Railsware Products Studio LLC to: privacy@mailtrap.io. Railsware Products Studio LLC may be subject to the investigatory and enforcement powers of the FTC.

6.3 Binding arbitration

Under certain conditions You have the possibility to invoke binding arbitration for complaints regarding Data Privacy Framework compliance not resolved by any of the other Data Privacy Framework mechanisms. Please find more details on this here – https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

6.4 Transfers to third parties

In case Railsware Products Studio LLC transfers any personal information that is subject to Data Privacy Framework, to the third parties, Railsware Products Studio LLC shall remain liable under the DPF Principles if such third parties process such Personal Information in a manner inconsistent with the DPF Principles, unless Railsware Products Studio LLC proves that it is not responsible for the event giving rise to the damage.

7. Sub-processors

Railsware uses a range of third-party sub-processors that are authorized to process the Service Authorized End Users and the Site Visitors data, and help us deliver the Service functionality, as well as the accompanying support services in full.

8. General Clauses

Entity Name	Purpose	Location
Amazon Webservices, Inc.	Infrastructure	The United States
Google Inc.	Infrastructure	The United States
Meta Platforms, Inc.	Marketing Analytics	The United States
X Corp.	Marketing Analytics	The United States
LinkedIn Ireland Unlimited Co	Marketing Analytics	Ireland
HubSpot, Inc.	Marketing Analytics	The United States
HelpScout PBC	Customer Support	The United States
Slack Technologies Inc	Communication	The United States
Typeform SL	Customer Feedback	Spain
Microsoft, Inc. (Clarity)	Product Analytics and Session Replay	The United States
E-HAWK LLC	Risk assessment	The United States
SorryApp Ltd	Mailtrap status notices for customers	The United Kingdom
Igil Webs SRL (FirstPromoter)	Marketing analytics	Romania
Cordnet OU	Usage feedback collection	Estonia
Reply App Inc.	Communication	The United States
Calendly LLC	Communication	The United States
Zapier Inc.	Infrastructure	The United States
Taxamo Checkout Ltd (Pipedrive)	CRM	Ireland
Stripe, Inc.	Payment processing	The United States
Civilized Discourse Construction Kit, Inc.	Mailtrap Community infrastructure	The United States
OpenAI OpCo, LLC	AI-assisted email content analysis for abuse prevention and security	The United States
Stripe, Inc.	Payment processing	The United States
Supabase Pte. Ltd	Infrastructure	Singapore

8.1 Changes to the Policy

We reserve the right to review and make amendments to this Policy. When the changes are made, we will publish the new version of the Policy on our Site and update the ‘effective’ date, which is indicated in the top left corner of this Policy, to the day when the latest amendments were published on the Site.

8.2 Contact us

For any additional questions or inquiries about the Policy, please send an email to privacy@mailtrap.io