Privacy Policy
Draft of 25 October 2026
This policy explains what personal data Postilon collects, why, who receives it and what rights you have. It applies worldwide, with extra details for Indonesia, Singapore, the EU and UK, and the US in section 12.
1. Who we are
Kulina Pte. Ltd. (UEN 201530273G), 10 Anson Road, #03-05 International Plaza, Singapore 079903, which operates Postilon, is the controller (pengendali data pribadi) for the data described in sections 3 and 4. Our team operates from Indonesia. Our Data Protection Officer is Murtiono Widi, reachable at privacy@postilon.com.
2. Two kinds of data
- Data about our customers and visitors (account holders, their team members, people who visit our sites): we decide how it is used, so this policy governs it.
- Data our customers send through Postilon (email content, recipient addresses and what happens to each email): we process it on our customers' behalf as their processor (prosesor). If you received an email sent through Postilon, the sender's privacy policy applies; ask the sender to exercise your rights, and we will help them.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email, password (stored only as a salted hash), profile picture, workspace name and logo, team roles | You |
| Billing | Stripe customer ID, card brand and last 4 digits, payments and credit history. Full card numbers are held by Stripe, never by us | You, Stripe |
| Technical and usage | IP address at signup (kept 24 hours to limit fake accounts), session cookies, API and SMTP request logs (method, endpoint, status, user agent, request and response bodies up to 8 KB), security and audit logs | Your devices and use of the service |
| Communications | Messages you send to support and our replies | You |
We do not sell personal data or use it for advertising. With your consent where the law requires it, Google Analytics measures how our website and dashboard are used (section 11).
4. Data we process for customers
When customers send email through Postilon we process the message content and headers, recipient addresses, delivery results (delivered, bounced, complained, failed), and, when the customer turns tracking on, the time, IP address and browser of recipients who open an email or click a link. We keep a suppression list of addresses that bounced, complained or unsubscribed so they are not mailed again.
5. Why we use it
| Purpose | Legal basis (UU PDP Art. 20; GDPR Art. 6) |
|---|---|
| Provide the service: accounts, sending, tracking, webhooks, dashboard | Performance of our contract with you |
| Account emails: verification, password resets, invitations, service notices | Performance of contract |
| Billing, invoices, tax records | Contract; legal obligation |
| Preventing fraud and abuse: signup limits per IP, blocking disposable email, pausing workspaces with high bounces or complaints | Legitimate interests in protecting customers and our sending reputation |
| Security, monitoring, troubleshooting | Legitimate interests; legal obligation |
| Improving the service from aggregated, non-identifying statistics | Legitimate interests |
| Anything else | Your consent, which you can withdraw at any time |
6. Who receives it
| Recipient | Why | Location |
|---|---|---|
| Google Cloud | Hosting, database, logs, monitoring | United States (us-east4) |
| Stripe | Card payments and invoices | Singapore, United States |
| Google Analytics | Measuring visits to our website and dashboard, with consent where required | United States |
| Cloudflare | DNS for our domains (no email or account data passes through it) | Global |
| Google Workspace | Our support and team email | Singapore |
| Mailbox providers (Gmail, Outlook, others) | They receive the emails customers send, as part of delivery | Worldwide |
We also disclose data when the law or a valid order requires it, and to a buyer or successor if Postilon is reorganised or sold, under the same protections. Our staff access data only to run and support the service.
7. International transfers
Our systems run in the United States and our team works from Indonesia [and Singapore], so data moves between countries. We transfer data only where the receiving country or company gives a level of protection equal to or higher than UU PDP requires, under contractual safeguards (such as standard contractual clauses for EU and UK data), or with your consent where the law allows it.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While the account exists, then deleted within 30 days |
| Email body, attachments, template variables and the full message | 30 days after the email is created |
| Email recipients, subject, status, delivery events, opens and clicks | 90 days |
| API and SMTP request logs, webhook delivery records | 30 days |
| Signup IP address | 24 hours |
| Suppression list | While the customer's account exists |
| Billing and tax records | 10 years, as Indonesian tax law requires |
| Backups | 7 days (daily backups and point-in-time recovery logs) |
9. How we protect it
Traffic is encrypted with TLS. Passwords are stored as salted PBKDF2 hashes, API keys as hashes, and DKIM signing keys encrypted with AES-256-GCM. Staff use separate administrator accounts with a passkey or authenticator code, and every administrative change is logged. If a breach puts your personal data at risk, we will tell you and the relevant authority within the time the law sets: 3 x 24 hours under UU PDP, 72 hours under the GDPR.
10. Your rights
You can ask us to tell you what data we hold about you and give you a copy; correct it; delete it; restrict or object to how we use it; move it to another service; and withdraw consent you gave. You can also complain to a data protection authority. Write to privacy@postilon.com; we may need to confirm your identity first. Account holders can also correct their profile and delete their account in the dashboard.
11. Cookies and children
These cookies keep the service working: postilon_session keeps you signed in to the dashboard (30 days) and postilon_console_session keeps Postilon staff signed in to the admin console (7 days). Your theme choice is stored in your browser, and your cookie choice in the postilon_analytics_consent cookie, shared by postilon.com and the dashboard (6 months). We also use Google Analytics cookies (_ga and _ga_*) to measure visits to postilon.com and the dashboard. In the EU, the UK and other places that require consent, they are set only after you accept them in the cookie banner, and you can withdraw consent at any time from the cookie settings link. Google receives your IP address and device information; Google's advertising features are turned off. Postilon is not intended for anyone under 18, and we do not knowingly collect their data.
12. Regional information
Indonesia (UU PDP, UU No. 27 of 2022). You have the rights in Articles 5 to 13, including to withdraw consent and to object to decisions based solely on automated processing; a person reviews any workspace paused automatically, on request. We respond to requests within the periods UU PDP sets [counsel to confirm, including the 3 x 24 hour periods]. You may complain to the personal data protection authority. Our Data Protection Officer is named in section 1.
Singapore (PDPA 2012). You may ask to access or correct your data; we respond within 30 days, or tell you when we will. Our Data Protection Officer is reachable at privacy@postilon.com, and you may complain to the Personal Data Protection Commission.
EU and UK (GDPR, UK GDPR). The legal bases are listed in section 5. Transfers outside the EU or UK rely on standard contractual clauses. You may complain to your local supervisory authority. We will appoint EU and UK representatives under Article 27 before we actively offer the service there.
United States. We do not sell personal information or share it for cross-context behavioural advertising. Depending on your state, you may ask to know, correct or delete the personal information we hold, and we will not treat you differently for asking.
13. Changes and contact
We will post changes here and email account owners about material ones at least 30 days before they apply. Questions or requests: privacy@postilon.com · Kulina Pte. Ltd., 10 Anson Road, #03-05 International Plaza, Singapore 079903.