Privacy Policy

For data about our customers and their team members (accounts, billing, support, usage) and about website visitors, Quad Labs L.L.C. is the controller.

For data our customers put into Sooner (the recipients they email, their contacts, message content), the customer is the controller and we are their processor under the Data Processing Agreement. If you received an email sent through Sooner, contact the sender to exercise your rights. We will forward requests we receive to them. You can always unsubscribe from marketing email with the link in the message.

• Account data: name, email address and avatar from your sign-in provider (GitHub or Google); team and role.
• Billing data: plan, subscription status and invoices from Paddle. We never see full card details.
• Usage and technical data: API requests, email volumes, IP addresses and user agents in server logs, error reports.
• Support data: what you send us by email.
• Customer data (as processor): recipient addresses, email content and attachments, contacts and their properties, delivery, bounce, complaint, open and click events.

• Providing the service and support: performance of our contract with you (GDPR Art. 6(1)(b)).
• Billing, tax and accounting through Paddle: contract and legal obligations (Art. 6(1)(b) and (c)).
• Security, abuse prevention and protecting deliverability (for example monitoring bounce and complaint rates): our legitimate interest in a safe, reputable service (Art. 6(1)(f)).
• Service emails (invites, billing notices, security and policy changes): contract and legitimate interest. We don't send marketing without consent.

We don't sell personal data or use it for advertising, and we don't use customer data to train machine-learning models.

Webhooks you configure send event data to the endpoints you choose. Open and click tracking, when you enable it on a domain, records the recipient's IP address and user agent when an email is opened or a link is clicked.

Paddle is our merchant of record and processes payment data as an independent controller under its own privacy notice. We receive the customer id, subscription status, plan and invoice metadata.

We use the providers on our subprocessor list, mainly in the United States. Quad Labs L.L.C. is established in Kosovo. Where data from the EEA, UK or Switzerland is transferred to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on the EU-US Data Privacy Framework where the recipient is certified. We may disclose data where required by law, and only after checking the request is lawful.

• Email logs and events: kept for your plan's retention period (7, 30, 90 or 365 days), then deleted automatically.
• Contacts, templates, domains and settings: until you delete them or your team.
• Suppression entries: until removed, because they protect people who bounced or complained.
• Account data: until you delete your account. Invoice records are kept as long as tax law requires.
• Server logs: up to 30 days. Deleted data leaves backups within our providers' backup cycles.

Depending on where you live, you can ask for access, correction, deletion, restriction, portability and to object to processing based on legitimate interests. You can export contacts, delete a team and delete your account yourself in the dashboard. For anything else, email erzen@quad-labs.com. We answer within one month.

You can also complain to a supervisory authority: in Kosovo, the Information and Privacy Agency (Agjencia për Informim dhe Privatësi); in the EU/EEA, the authority where you live or work; in the UK, the ICO.

Data is encrypted in transit (TLS) and at rest by our providers. API keys are stored only as hashes. Access is restricted to staff who need it. See Annex B of the DPA for details. We'll announce material changes to this policy by email or in the dashboard before they take effect.