1. Overview
PostMX is a developer email inbox API. In order to create inboxes, receive messages, deliver
webhooks, and support customer accounts, we process operational and technical information necessary
to run the platform.
2. Information we collect
Depending on your account and usage, we may collect account details, billing details, API keys,
inbox labels, message metadata, webhook configuration, timestamps, request IDs, IP address, region,
and support communications.
We do not intentionally store API request payloads except where needed to deliver the product or
where you enable related observability or retention settings.
3. How we use information
We use information to provide and maintain PostMX, authenticate requests, enforce rate limits and
scopes, deliver messages and webhooks, detect abuse, process billing, respond to support requests,
and improve reliability.
We may also use limited data to troubleshoot incidents, verify platform performance, and meet legal
obligations.
4. Data sharing and processors
We do not sell personal information. We may share data with selected infrastructure, analytics,
messaging, and payment providers only as needed to operate the service.
We may also disclose information if required by law, regulation, valid legal process, or to protect
the service and its users.
5. Data retention
We retain data only for as long as needed to deliver the service, support security analysis, handle
billing reconciliation, and satisfy legal requirements. Retention periods may vary by data category
and account configuration.
6. Your rights and choices
Subject to applicable law, you may request access, correction, export, restriction, or deletion of
your data. You may also manage inboxes, keys, and webhook settings through the dashboard.
API keys should be treated as secrets. If you believe a key has been exposed, rotate or revoke it as
soon as possible.
7. Security measures
We use technical and organizational safeguards appropriate to the service, including encryption in
transit, access control, environment isolation, logging, and monitoring for suspicious activity.
No online service is perfectly secure, but we work to reduce exposure and protect the platform and
customer data.