Privacy Policy

1. Introduction

SpamFoo is committed to safeguarding the privacy of our website visitors, customers, and the people whose email our service protects. This policy describes what personal data we collect, how we use it, with whom we share it, and your rights regarding your data.

Who this policy covers. This policy applies to two groups of people:

  • Customers and website visitors: we decide how your account, billing, and website data is used, so we are the Data Controller for it.
  • People who send or receive mail through a customer's server: we process signals about that mail on the customer's instructions, so we are their Data Processor. Your organization controls that data. Customers who need a Data Processing Agreement (DPA) should contact us.

2. Personal Data We Collect

We collect personal data from the following sources:

  • Directly from you when you create an account, contact us, or configure our services
  • From your use of our services, including technical and usage data
  • From email messages processed by the SpamFoo Client, including information about senders

The types of personal data we collect include:

  • Account information: name, email address, company name, billing address, payment method, and login credentials (your password is stored only as a one-way hash)
  • Communication data: support requests, sales inquiries, feedback submissions
  • Configuration data: email server settings, custom rules, allowlists and blocklists
  • Service usage data: API call volumes, processing times, classification results
  • Technical data: IP addresses, browser type, operating system
  • Installation data: license key, server host name, operating system and software versions, the IP address the SpamFoo Client connects from, and usage and performance counts, including a hashed identifier and your mail domain for each protected mailbox

For email processing, the SpamFoo Client classifies email on your mail server. It never sends attachments, and never sends message text unless someone chooses to share it, as described below.

Some sender information must be sent for SpamFoo to provide reputation services. When the SpamFoo Client checks or reports on a sender's reputation, it sends the sender's domain and connecting IP address as they appear in the message, along with authentication results (SPF, DKIM, DMARC) and message counts. Reputation cannot be tracked without these values. Your organization's mail domain is also sent with usage statistics.

When a user corrects a classification, the SpamFoo Client sends a correction record. By default, this record contains mathematical representations of the message (embeddings, word-frequency values based on a fixed vocabulary, and numeric features), hashed identifiers such as the reporting user's email address and the message ID, and the sender's domain and IP address. It does not contain the text of the message unless that text is shared as described below.

Message text is sent only when the recipient chooses to share it while submitting a correction from their email client, or when a customer's administrator turns on content sharing for reports submitted through the SpamFoo Client Dashboard. Customers are responsible for telling their users when sharing is on. Shared content includes the subject and body text after automated sanitization, the links in the message, and the sender's identity (display name, email address, reply-to, and return path), which is kept so the report can be evaluated. Sanitization removes or scrambles common identifiers such as email addresses, IP addresses, phone and card numbers, and first names. Web links are kept in full. Like any automated process, it cannot guarantee that all personal information is removed.

3. How We Use Your Data

SpamFoo processes your personal data for the following purposes:

  • Service delivery: to provide email classification and reputation services
  • Transaction processing: to process payments and manage your subscription
  • Communication: to respond to support requests and send service notifications
  • Product news: to send optional emails about SpamFoo features and updates. You can unsubscribe from these at any time from your account's email preferences or the link in each email. Service and billing notices are not optional.
  • Service improvement: to analyze sanitized and aggregated data for improving our classification models
  • Legal compliance: to meet our legal and regulatory obligations

Our legal basis for each purpose is:

  • Providing and billing the service: needed to perform our contract with you
  • Sender reputation, spam detection, and network security: our legitimate interest in protecting our customers' mail systems (GDPR Recital 49)
  • Improving our classification models with sanitized data: our legitimate interest, or consent where message text is shared
  • Product news: consent, or our legitimate interest in keeping existing customers informed, with an opt-out in every message
  • Legal and tax record keeping: our legal obligations

Sanitized data used for model improvement is never sold or licensed, is used solely to improve SpamFoo services, and is provided to third parties only when they process it on our behalf as described in Section 4.

4. Data Sharing

SpamFoo does not sell your personal data. We do not share email content or customer data with third parties for marketing, advertising, analytics, or unrelated commercial purposes.

We use the following service providers to operate our business:

  • Payment processing: we may use a third-party payment processor to charge your subscription. Card details you give us are stored in encrypted form on our systems or by that processor, and are used only to bill you.
  • Domain registries: SpamFoo looks up sender domains in public domain registration databases (WHOIS and RDAP) to check domain age; only the domain name is sent
  • AI model providers: to review corrections, we may send sender domain and authentication details, and message content shared as described in Section 2, to AI model providers that act on our behalf. We require these providers not to store the content or use it for any purpose other than answering our request.
  • Cloudflare: provides our content delivery network, DNS, and the Turnstile bot check on our web forms, and sees visitor IP addresses and browser details in doing so
  • Google Fonts: our website loads typefaces from Google, which receives your IP address

Our cloud infrastructure provider hosts our SpamFoo Online Services but is contractually restricted from accessing customer data except as necessary to provide infrastructure services.

We may disclose personal data to legal authorities when required by law, court order, or governmental regulation.

If SpamFoo is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and this policy will continue to apply to it.

5. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy.

Service data, including classification results, reputation data, and user feedback and corrections, is kept for as long as it is needed to provide reputation services and to train, evaluate, and improve our classification models. When this data is no longer needed for these purposes, we delete it or aggregate it so that it no longer identifies any individual or customer.

Other records are kept for the following periods:

  • Account and billing records: for as long as tax, accounting, and other laws require us to keep them
  • Audit logs: up to 7 years

Upon termination of your subscription, we cease active processing of your data, and service data is kept or deleted as described above. We retain your account information in a deactivated state so that you may reactivate your account in the future. You may request complete deletion of your account and all associated personal data at any time by contacting us.

6. Data Security

We protect personal data with measures that include encryption in transit (TLS 1.2 or higher), encryption or one-way hashing of sensitive stored data such as passwords and payment details, multi-factor authentication for administrative access, and role-based access limited to staff who need it.

7. International Data Transfers

SpamFoo is headquartered in the United States. Personal data may be processed and stored in the United States or other jurisdictions where SpamFoo or its service providers operate. Where required by applicable law, SpamFoo implements appropriate safeguards for international transfers of personal data.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you
  • Rectification: request correction of inaccurate data
  • Erasure: request deletion of your personal data
  • Portability: receive your data in a machine-readable format
  • Objection: object to processing based on legitimate interests
  • Restriction: request temporary restriction of processing
  • Withdraw consent: withdraw consent where processing is based on consent

To exercise any of these rights, contact us using the details in Section 15. We respond within 30 days, or sooner where the law requires, and may extend that period where the law allows if a request is complex. We may request verification of your identity before processing your request.

If you are an employee or user of a SpamFoo customer, please send your request to that organization. As their processor we act on their instructions and will help them respond.

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

9. Automated Decision-Making

SpamFoo uses automated processing to classify email as spam, phishing, or legitimate and to sort legitimate mail into categories such as primary, updates, promotions, and transactions. These decisions affect only where a message is delivered. We make no automated decisions about your account, billing, or access. You can override classifications with allowlists, blocklists, and custom rules, and you can submit corrections through your email client or the SpamFoo Client Dashboard.

10. Your California Privacy Rights

If the California Consumer Privacy Act ("CCPA") applies to you, you have the right to know what personal information we collect, to have it deleted or corrected, and to not be discriminated against for exercising those rights. The categories we collect are identifiers, commercial information, internet activity, and professional information, as described in Section 2. We do not sell or share personal information as the CCPA defines those terms. The only sensitive personal information we collect is your account login and password, which we use solely to secure your account. Contact us to make a request. We will verify your identity and respond within the time described in Section 8.

Residents of other US states with privacy laws have similar rights and can use the same contact address.

11. Data Breach Notification

If a security incident affects your personal data, we will notify you and any regulators as required by applicable law, and we will tell you what happened, what data was involved, and what we are doing about it.

12. Cookies

Our website uses only functional cookies and similar browser storage that are strictly necessary for the operation of the site. These are required for authentication, session management, remembering your preferences, and access to the account management and dashboard areas. They cannot be disabled without impairing the functionality of the site.

SpamFoo does not use analytics cookies, third-party tracking cookies, advertising pixels, or cross-site tracking technologies. Because we do not track visitors, we do not change our behavior in response to Do Not Track or Global Privacy Control signals.

13. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such information, contact us immediately.

14. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. When we make material changes, we will notify customers by email or by a notice on our website before the changes take effect. We will not use content you shared with consent for a purpose that was not described when you shared it. The revision number and effective date at the bottom of this policy show when it was last revised.

15. Contact Us

For questions about this privacy policy or to exercise your data protection rights, contact us:

Email: privacy@spamfoo.com

Revision 20260930.1 | Effective: September 30, 2026