What data does our plugin collect?
The MailPoet and MailPoet Premium plugins do not collect any user data by default, per the WordPress Plugin Guidelines.
We do collect data if you opt in to share it in your site dashboard under MailPoet > Settings > Advanced. See Sharing Your Data with Us for the detailed list.
The following user feedback tools collect some data if you interact with them:
- The support contact widget (bottom-right corner of all MailPoet admin dashboard pages) will identify you.
- “Would you recommend this plugin to a friend?” will identify your website and email address.
- The sidebar announcement panel logs your IP but does not identify you.
- Video guides track views, non-identifiably.
What data does our sending service collect?
If you have created an account with MailPoet to send emails or to purchase a plan, we collect the following data on our servers in the United States of America:
- Email address
- Names
- IP
- Billing address
We ask for consent during the account creation process with a checkbox. A link to this page is provided during this step.
If you send emails with MailPoet, we store the following:
- Logs of emails sent
- Support inquiries by email
Third-party services and their location
MailPoet relies on third-party services to run its own services.
Services that process subscriber/end-user data
| Service | What it does | Location |
|---|---|---|
| WordPress.com | Delivers your emails and campaigns to your recipients | US |
| Amazon S3 | Encrypted backups | US |
| Linode | Hosts your MailPoet account | Germany |
Services that touch MailPoet’s own opt-in/business data (not subscriber data)
| Service | What it does | Location |
|---|---|---|
| Stripe | Processes MailPoet account payments | US |
| MixPanel | Opt-in usage analytics | US |
| Google Analytics | Website analytics for mailpoet.com | US |
| SatisMeter | Opt-in user feedback collection (“how likely would you recommend MailPoet?”) | Czech Republic |
| TypeForm | Opt-in user feedback collection | Spain |
| PollDaddy | Opt-in user feedback collection | US |
| Canny.io | User feedback board (mailpoet.canny.io) | US |
| Zendesk | Customer support tool | US |
Length of data collection
MailPoet keeps identifiable data until the user asks us to anonymize/delete it. Logged emails from the sending service are automatically erased after 3 months.
Who has access to our data?
Except as described above, data at MailPoet is not shared with or sold to any third party. MailPoet staff and contractors have access for the purpose of providing services. No personal/identifiable data is stored permanently on staff or contractor computers; contractors are asked to delete it at the end of their engagement.
Your data, your rights
- You can request a copy of your data, provided within 30 days.
- You can request anonymization, done within 30 days.
- In the event of a data breach or misuse, we’ll inform users of what happened and what we did to fix it, within 30 days.
Data Processing Agreement
We can provide you with a signed DPA by email request (gdpr@mailpoet.com).
You’ll need to return a signed copy of this agreement if you would like to have a valid DPA contract with us. Please refer to this article on how to sign PDF documents if you have questions about how to sign.
MailPoet is part of Automattic, and Automattic’s DPA covers both MailPoet and WordPress.com. If you have a WordPress.com account, you can request a copy of our DPA without needing to reach out to us by using the “Request a DPA” tool in your account dashboard here: https://my.wordpress.com/me/preferences/privacy