SMTPly SMTPly
Legal

Privacy Policy

1. Privacy at a glance

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the privacy policy listed below this text.

Data controller

IT Beratung – Andreas Hähnel
Andreas Hähnel
Neukircher Str. 3
74357 Bönnigheim
Germany
Phone: +49 7141 1338333
Email: mail@smtply.app

Special note: the SMTPly software sends no content to us

This privacy policy applies to the website smtply.app. The SMTPly software, which you install on your Windows server, processes email exclusively locally and sends no email contents, logs, configuration or telemetry to us. It only makes these outbound connections:

  • Microsoft (sign-in and Microsoft Graph): delivery of the email, within your existing Microsoft 365 contract.
  • Polar (api.polar.sh): activation and regular validation of the license key, see section 5.
  • smtply.app: retrieval of a small file with the current version number to show available updates. No data about your installation is sent; as with any page request, the host sees the IP address (see section 3).
  • GitHub: download of the installer when you start an update or have enabled automatic updates (see section 7).

Destinations you configure yourself (such as webhooks, a syslog server or email notifications) receive data only on your behalf and under your responsibility.

2. General information and mandatory notices

Your rights

Within the limits of the law, you have the right at any time to free information about your stored personal data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent given at any time with effect for the future (Art. 7(3)). For this and any other data protection questions, you can contact us at any time at the address given in the imprint.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Right to object (Art. 21 GDPR)

Where processing is based on legitimate interest (Art. 6 para. 1 lit. f GDPR), you have the right to object at any time for reasons arising from your particular situation.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the browser's address bar switching from "http://" to "https://".

3. Data collection on this website

Server log files and hosting (Cloudflare Pages)

This website is hosted as Cloudflare Pages with Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). The provider automatically collects and stores information in so-called server log files that your browser automatically transmits:

  • Browser type and version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of the server request
  • IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6 para. 1 lit. f GDPR, our legitimate interest in the technically error-free presentation and security of the website. According to Cloudflare, these log data are deleted after a short time; we only evaluate them in aggregated form (such as the number of requests and the error rate).

A data processing agreement has been concluded with Cloudflare. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, the agreement includes the EU Standard Contractual Clauses (Art. 46 GDPR).

Reach measurement (Cloudflare Web Analytics)

To measure reach we use Cloudflare Web Analytics (Cloudflare, Inc., address as above). This service works without cookies and without recognising you across devices or websites. It only collects aggregated metrics that cannot be traced back to a person, such as pages viewed, approximate region of origin (country) and the referring website (referrer). No user profiles are created and no data is passed to third parties for advertising purposes; Cloudflare does not permanently store IP addresses for the analysis.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in privacy-friendly reach measurement). The Cloudflare counting service itself neither stores information on nor reads information from your device. The same data processing agreement with Cloudflare as for hosting applies.

In addition, on your first visit the website records a coarse origin category in your browser's local storage under the key smtply-src. The only thing stored is one of five words (anzeige, suche, verweis, direkt or unbekannt), derived from the referring website. This lets us see which route visitors take to the download. The entry contains no identifier and no personal reference, is not transmitted to us or to third parties, and expires after two hours. You can delete it at any time in your browser's local storage (developer tools → Application → Local Storage).

Two further entries are created only when you choose a setting yourself: smtply-lang remembers the language you selected, smtply-theme your choice between light and dark display. Each holds only that single value, is never transmitted and only serves to keep your choice on your next visit. The legal basis is § 25(2) no. 2 TDDDG, as the storage is strictly necessary for the function you requested.

Contact by email or phone

If you contact us by email or phone, your information including all personal data resulting therefrom (name, email address, phone number, request) will be stored and processed by us for the purpose of handling your request.

The legal basis is Art. 6 para. 1 lit. b GDPR (fulfillment of pre-contractual measures or performance of a contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in processing your request).

We store your request including all personal data derived from it until you request deletion, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your request has been processed). Mandatory statutory retention periods, in particular under commercial and tax law, remain unaffected.

4. Payment processing and license sales

We use Polar (Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA) as Merchant of Record for payment and license issuance. When you click "Buy license", you will be redirected to the Polar checkout page. There you enter your payment details directly with Polar; we never have access to full credit card numbers or bank details.

From Polar we receive only the data necessary for license issuance (name, email address, billing address, VAT ID where applicable, license key). Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance) and Art. 6 para. 1 lit. c GDPR in conjunction with statutory retention obligations under commercial and tax law.

Polar is based in the USA and is itself responsible for processing your payment and billing data. According to Polar, transfers to the USA and other third countries rely on adequacy decisions of the European Commission (Art. 45 GDPR) or on the EU Standard Contractual Clauses (Art. 46 GDPR). Polar privacy policy: polar.sh/legal/privacy.

5. License activation within the SMTPly software

When you activate a license key in the SMTPly software, the software validates the key against Polar's public customer-portal endpoint. The following is transmitted:

  • The license key you entered
  • An identifier of the server as the activation label: a shortened SHA-256 hash formed from the SMBIOS UUID, the Windows machine ID, the BIOS serial number and the network addresses. Only the hash is transmitted, not the underlying values.
  • Our hardcoded Polar organisation ID (public)

The recipient is Polar Software, Inc. in the USA; the transfer is covered as described in section 4. This data is used solely for license validation. After successful activation, the software checks once a day whether the key is still valid, transmitting the same data. If Polar cannot be reached, the license remains valid for up to 30 days without a successful check. No email contents, logs or configuration data are transmitted to Polar or the manufacturer.

6. Contact form (Formspree)

The contact form on this website uses Formspree (Formspree, Inc., San Francisco, CA, USA). When you submit the form, the data you enter (name, email address, topic, message) is transmitted via HTTPS to Formspree and forwarded to our email address.

Formspree stores your data temporarily for delivery purposes. No Formspree account is created for you. The legal basis is Art. 6 para. 1 lit. b GDPR (processing your request) or Art. 6 para. 1 lit. f GDPR (legitimate interest in a structured contact channel). Formspree privacy policy: formspree.io/legal/privacy-policy.

To protect against automated submissions, the form uses Cloudflare Turnstile (Cloudflare, Inc., address as in section 3). Turnstile checks technical characteristics of your browser and your IP address to determine whether a human is filling in the form, without setting cookies and without puzzles. The legal basis is Art. 6 para. 1 lit. f GDPR, our legitimate interest in protecting the form against abuse and spam. Transfers to the USA are covered as described for hosting in section 3.

7. Software download (GitHub)

The SMTPly installer is hosted on GitHub (GitHub, Inc., 88 Colin P Kelly Jr Street, San Francisco, CA 94107, USA; a Microsoft company). When you download the installer, your browser connects directly to GitHub's servers. GitHub processes technically necessary data such as IP address, timestamp and browser user agent in accordance with the GitHub Privacy Statement. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in reliable software delivery). The same applies when the installed software downloads an update from GitHub. As a Microsoft company, GitHub is certified under the EU-US Data Privacy Framework.

8. Setup tips and newsletter (Brevo)

After downloading (page “Download started”) you can sign up for three e-mails with setup tips during your trial, and on the newsletter page for our newsletter, which is only sent when there is news, a few times a year. For sign-up and delivery we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes the data on our behalf (Art. 28 GDPR) and, according to Brevo, stores it in the EU.

We process your e-mail address, the list you chose, the time and IP address of sign-up and confirmation, and whether an e-mail was delivered and opened and whether a link in it was clicked. We only use this in aggregate to improve the e-mails. Your sign-up only takes effect once you click the link in the confirmation e-mail (double opt-in); time and IP address serve as proof of your consent. The sign-up form does not set cookies.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw it at any time with effect for the future, using the unsubscribe link at the end of every e-mail or by contacting us. After that you will not receive any further e-mails; we keep the record of your earlier consent for as long as claims can be based on it (Art. 6 para. 1 lit. f GDPR). The setup tips end by themselves after three e-mails. Brevo privacy policy: brevo.com/legal/privacypolicy.

9. No cookies, no advertising networks

This website sets no cookies and embeds no advertising networks, no conversion tracking and no social media plugins. No profiling takes place. The cookie-free reach measurement is described in section 3. Fonts are loaded from our own server, not from third parties. The three entries in your browser's local storage are described in section 3.

The website contains links to external pages (e.g. Microsoft documentation, Polar checkout, GitHub releases, imprint reference). When you follow these links, you leave the scope of this privacy policy. The respective privacy policies of the operators apply to data processing on the target pages.

11. Changes to this privacy policy

We reserve the right to adapt this privacy policy occasionally so that it always meets current legal requirements or to reflect changes in our services. On your next visit, the new privacy policy will apply.

Last updated: 28 September 2026