Privacy policy

Summary

FormSMTP (“we”) lets you send email from websites through your own SMTP account. We collect what we need to run the service, we don’t sell personal data, we don’t use advertising trackers, and you can delete your data at any time.

What we collect

Account data: your email address, name, an optional profile picture from Google or GitHub, a password hash (if you set a password), and which sign-in providers you connected.
Project configuration: SMTP host, port, username and password, sender name and address, allowed websites and recipients. SMTP passwords and API keys are encrypted at rest.
Content you create: email templates, contacts you add or import (email, name, tags, custom fields, subscription status) and scheduled emails.
Sending logs: for each email, the recipients, subject, status, any SMTP error, time, and the website and IP address that made the request. We do not keep a copy of message bodies sent through the API or forms after they are handed to your SMTP server.
Technical data: IP address and browser user agent for your sign-in sessions, used for security.
Billing data: if you buy a paid plan, your plan, billing period, subscription status and payment records (amount, date, status and Razorpay’s payment ID). Card, UPI and bank details are entered on Razorpay’s checkout and never reach our servers.
Website statistics: when you visit formsmtp.com we count the page, the referring website or campaign, your country, and your device type, browser and operating system. We don’t use cookies for this and don’t store your IP address: it is used only in memory to look up the country and to make a visitor count that is reset every day.

How we use it

To provide and secure the service: authenticate you, send email through your SMTP account when you or your website asks us to, show logs and statistics, prevent abuse, and contact you about your account (for example confirmation and password-reset emails). Our legal bases are performing our contract with you and our legitimate interest in keeping the service secure.

When you collect contacts or form submissions with FormSMTP, you are responsible for that data (the “controller”) and we process it on your behalf, only to provide the service.

We don’t sell or rent personal data. We use a small number of service providers to run FormSMTP:

Hosting: a virtual private server provider that stores the database.
Spaceship: domain, DNS and our own mailbox (hello@formsmtp.com) for account emails.
Google and GitHub: only if you choose to sign in with them; they share your name, email and profile picture with us.
Razorpay: processes payments for paid plans under its own privacy policy. We share your name and email with it to prefill checkout.
Your SMTP provider: the provider you connect receives the emails you send, under its own privacy terms.

We may disclose information if the law requires it, or to protect people and the service from abuse.

How long we keep it

Sending logs are deleted automatically after 30 days (longer on paid plans, as described on the pricing page). Sessions expire after 30 days of creation. Website statistics are kept for about 13 months. Payment records are kept as long as tax and accounting laws require. Account data, projects, templates and contacts are kept until you delete them or your account. Deleting a project deletes its templates, contacts and logs.

Security

SMTP passwords and API keys are encrypted with AES-256-GCM. Passwords are hashed with scrypt. All traffic uses HTTPS. Sessions are stored server-side and can be ended from your account settings.

Your rights

Depending on where you live (including under the GDPR and India’s Digital Personal Data Protection Act, 2023), you can ask to access, correct, export or delete your personal data, or object to how we use it. Most of this you can do yourself in the dashboard; for anything else, email hello@formsmtp.com. We answer within 30 days. If your email address is in a FormSMTP user’s contact list, please contact that user first; we will help where we can.

Cookies

We use only essential cookies: a session cookie that keeps you signed in, and a short-lived cookie that protects the Google/GitHub sign-in flow. We don’t use analytics or advertising cookies; our website statistics are cookie-free (see above). Country lookups use IP Geolocation by DB-IP. The site remembers your light/dark theme in your browser’s local storage.

Changes

If we change this policy in a meaningful way, we’ll update the date above and tell account holders by email before the change takes effect.

Contact

Questions or requests: hello@formsmtp.com.