Skip to content

Postmetry

Privacy Policy

Who processes your data, which data, why, for how long, and what you can demand in return. A product that measures other companies' trackers does not profile the people who use it.

Updated on

1. Data controller

The personal data processed on this site and in the Postmetry service is processed by fstck, a French limited liability company (SARL), 60 rue François Ier, 75008 Paris, registered with the Paris Trade and Companies Register (RCS) under number 808 357 032.

We have not appointed a data protection officer: for any question or request, the contact address at the bottom of this page serves that role.

2. What we don't do

These commitments apply to the whole service, without exception:

  • we do not sell or rent any personal data, and we do not trade it with any broker;
  • we do not set any advertising tracker, any analytics cookie, any social network button;
  • we do not use any personal data to train a machine learning model;
  • we do not record your full IP address or your user agent in our own tables;
  • we never bring content you submit into the public corpus or into a comparison;
  • we do not disclose to anyone the addresses through which we receive the corpus's messages.

3. The data we process, situation by situation

3.1 You browse the site

Browsing asks nothing of you. Audience measurement relies on Plausible Analytics, a tool with no cookie and no persistent identifier: it counts page views and where they come from, and keeps no IP address. Your requests pass first through Cloudflare, which protects the site and sees the IP address of the connection. Our host may keep technical server logs, which contain the same address; they serve the security of the service and are kept for the period the law requires of the host.

3.2 You write to us

The contact form records your name, your email address, your company if you give it, the subject and the message, and the first two bytes of your IP address — enough to recognize a surge after the fact, not enough to identify you. This data is used to reply to you. It is kept for the length of the exchange, then for at most three years after the last contact.

3.3 You request a report with a free tool

The three free tools — the email audit, the suspicious email check, the tracking pixel diagnostic — work without an account. To send you a report, we record the email address you give and, for the audit, your name, your company, and the address you copy in if you give one. The diagnostic records your answers to the questionnaire — with no address unless you leave one — and the first two bytes of your IP address.

The message you submit or forward is archived as is, with the data it contains: your address, the sender's, the body of the message. It is attached to a technical account created for it, private, outside any public aggregate.

This data is used to produce the report, to send it to you and, for the diagnostic, to ask you once whether it was useful. We do not send you any other message without your explicit agreement, given by a box unchecked by default. Contact details are kept for at most three years after the last exchange. The submitted message and its report are kept for twelve months after the measurement, then deleted along with the technical account created for them: the report link then stops working. They are deleted earlier on simple request. The diagnostic's result link stops working after thirty days.

3.4 You request that a brand be added

When a brand missing from the catalog is requested, we record the domain and a counter. Nothing about who requested it: no address, no IP, no per-visit timestamp.

3.5 You open an account

The customer area records your email address, your name, your language, your role on the account, the invitations you send, the brands you follow and claim, the content you submit and import along with their reports, and the share links you create along with their open count. This data is used to run the subscribed service; its basis is the contract.

It is kept for as long as the account exists. When the account is deleted, it is erased after the seven days during which the request can be cancelled; billing data is kept for ten years, as accounting law requires.

3.6 You use the Postmetry Web Inspector extension

The Chrome extension observes what a page sends during a session you start yourself, in the tab you choose: the page's requests, and the browser's cookies and storage for the sites contacted. It works only when you ask it to, and stops with the session.

Everything stays on your computer. The extension sends no request, neither to us nor to anyone else, and requires no account: we receive nothing of what it observes. From the moment of capture, values are replaced by a fingerprint computed under a key drawn at the start of the session and erased at its end; only the addresses of the sites contacted, the names — of a parameter, of a cookie — and values that point to no one, such as the name of an event or a campaign, remain readable.

Sessions are kept in Chrome's local storage and erased automatically after seven days, or at any time from the extension's panel. An export file is created only when you ask for it, and you decide who to share it with.

3.7 Your brand sends messages to our addresses

The public corpus is made of messages that brands have sent to addresses we have signed up to their lists, like any other subscriber. These messages are commercial communications, but they may contain data that identifies a person: a signature, a reply address, a contact's name. We keep them in the archive for as long as the service exists, on the basis of our legitimate interest in measuring and documenting sending practices over time — that is the very purpose of the service, and an archive that gets altered proves nothing anymore.

What is published never reproduces a message in full: measurements, thumbnails, and previews where addresses are masked. A person who appears in an archived message can write to us to exercise their rights.

5. Who receives your data

Your data is processed by the people at fstck who need it for the service, and by the following processors, who act on our instructions:

  • ONETSOLUTIONS (France) — hosting of the site and the application;
  • Cloudflare, Inc. (United States) — delivery and protection of the site, placed in front of our servers: every request passes through it, along with the IP address that issues it; receiving mail on our addresses; storage of the raw archive, in a region located in the European Union;
  • Resend, Inc. (United States) — sending our own emails: sign-in links, reports, notifications;
  • Plausible Insights OÜ (Estonia) — audience measurement for the site, with no cookie and no identifier, hosted in the European Union.

We do not share any data with an advertising partner, and we do not hand any of it over to a third party for its own uses. An authority may obtain disclosure of it when the law requires us to. If the business is taken over, the data follows the service, and you are informed of it.

6. Transfers outside the European Union

Two processors are established in the United States: Cloudflare and Resend. The resulting transfers are governed by the standard contractual clauses adopted by the European Commission, and by their certification to the EU-US Data Privacy Framework where it is in force. The archive itself is stored in the European Union.

7. For how long

The retention periods, gathered together:

  • contact messages — for the length of the exchange, then at most three years after the last contact;
  • contact details left for a report — at most three years after the last exchange, or until you ask us to delete them;
  • answers to the diagnostic — kept in aggregated form for the published figures; the result link expires after thirty days;
  • submitted messages and reports — twelve months after the measurement, or until your request if it comes first;
  • account data — the lifetime of the account, then erasure after the seven days during which cancellation is possible;
  • billing data — ten years;
  • Web Inspector extension sessions — on your computer, erased after seven days;
  • public corpus archive — the lifetime of the service;
  • anti-abuse counters — for the length of the counting window, in the form of a non-reversible fingerprint;
  • two bytes of IP address — for the same duration as the record they accompany.

8. Security

The archive is written once and is never modified; the application can only write to it under the imports prefix, and never reads it from a public page. Exchanges with the site are encrypted. There is no password to steal: access goes through a single-use link sent to your address. Report links carry a non-enumerable token. Access to data is limited to the people who need it.

9. Your rights

You can request access to your data, its rectification, its erasure, the restriction of its processing and its portability, object to processing based on our legitimate interest, withdraw consent at any time, and set directives on the fate of your data after your death.

Write to us at the address at the bottom of this page. We may ask you to confirm your identity when the request warrants it — for example by replying from the address concerned. We respond within one month of the request; this period can be extended by two months when the request is complex, and we will tell you so.

If you believe your rights are not being respected, you can refer the matter to the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

10. The messages we send

We only send what you have asked for: the sign-in link, the report, an alert notification for the customer area and, for the diagnostic, a request for feedback one week after the report. Product news is only sent with your agreement. Every message that is not strictly transactional carries a one-click unsubscribe link. None of our messages contains a tracking pixel or a tracked link: we measure them at other companies, we do not set our own.

11. Minors

The service is aimed at professionals and is not designed for minors. We do not knowingly collect data about them; if you think this has happened, write to us and we will delete it.

12. Changes

The date at the top of the page tells you when this policy last changed. Account holders are notified by email of a change that concerns them. Previous versions remain available on request.