Privacy Policy

1. Controller and contact

The controller is the service operator identified in the Legal Notice. The legal email shown above is the contact point for privacy requests. If the Legal Notice says that the legal name or postal address is incomplete, new registrations are disabled until those controller details are truthfully configured. A data-protection officer is not listed unless one has been appointed and published in the Legal Notice.

2. Data covered by this notice

Depending on how you use Promotlr, the service processes the following categories:

• Account and profile data: email address, username, display name, avatar, password hash, email-verification state, timezone, role, and workspace membership.
• Authentication and security data: session identifiers, OAuth account identifiers, IP address, user agent, login time, verification and recovery events, rate-limit records, and security audit events.
• Workspace and automation data: forum target, account username, encrypted credentials and tokens, proxy configuration, browser profile, thread URLs, schedules, job settings, messages, logs, results, and proof artifacts.
• Campaign and recipient data: contact details, source and consent records, suppression status, campaign content, delivery status, bounce or complaint events, and unsubscribe records where you use communication features.
• Billing data: selected plan, billing interval, invoice amount and currency, payment-provider identifiers, wallet or transaction references, payment state, refund state, and tax or accounting records. Promotlr does not need your private wallet key.
• Support and communications: tickets, email, form content, attachments, replies, and administrative notes reasonably needed to resolve a request.
• Usage and device data: feature interactions, worker usage, job timing, error reports, service configuration, referral-link events, and technical request metadata.

3. Sources of data

Most data comes from you, your workspace members, your connected worker, or services you direct Promotlr to contact. OAuth profile data comes from the identity provider you choose. Payment status comes from the payment provider. Forum and campaign information can come from public pages, connected accounts, recipient interactions, delivery providers, or files and lists supplied by you. If you provide another person’s data, you must have a lawful basis and give them any notice required by law.

4. Purposes and legal bases

• Contract and pre-contract steps: creating accounts and workspaces, authenticating users, executing requested automations, providing billing, support, exports, and account administration. The basis is performance of a contract or steps requested before entering one.
• Legitimate interests: securing accounts and infrastructure, preventing fraud and abuse, debugging, maintaining service reliability, measuring limits, defending legal claims, and improving the service. The interests are safe and efficient operation, balanced against the rights of affected people.
• Legal obligations: tax and accounting records, lawful requests, sanctions and fraud controls where applicable, and compliance with privacy, consumer, or security law.
• Consent: optional marketing or non-essential browser storage when Promotlr expressly asks for consent. Consent can be withdrawn for future processing at any time without affecting earlier lawful processing.
• Your recipients: you are normally responsible for the lawful basis for personal data and communications that you upload or instruct Promotlr to send. Promotlr processes that data to provide the service and applies suppression, unsubscribe, and safety controls.

5. Whether data is required

Account identity, authentication, security, workspace, and plan data are required to provide the service. If required data is not supplied, Promotlr may be unable to create an account, run a job, process payment, or provide support. Optional profile fields and optional communication consent can be left blank or withdrawn. Promotlr does not use consent as the legal basis when processing is genuinely required to perform your contract.

6. Recipients and processors

Personal data is disclosed only as needed to the following recipient categories:

• hosting, database, storage, security, monitoring, and software infrastructure providers;
• transactional email and campaign-delivery providers;
• payment, blockchain-payment, accounting, fraud-prevention, and refund providers;
• proxy, CAPTCHA, account-verification, and worker infrastructure providers selected by Promotlr or by you;
• forums, social platforms, and other services that you direct Promotlr to access or contact;
• professional advisers, auditors, insurers, authorities, courts, and counterparties where disclosure is necessary and lawful; and
• a buyer or successor during a genuine corporate transaction, subject to appropriate confidentiality and notice requirements.

Service providers are authorized to process data only for contracted purposes and under appropriate data-protection terms. Third-party forums and payment providers can act as independent controllers under their own notices.

7. International transfers

Some providers, forums, or recipients may be outside the European Economic Area. Where GDPR transfer rules apply, Promotlr relies on an adequacy decision, approved standard contractual clauses with any needed supplementary measures, or another lawful transfer mechanism. You may ask the legal contact for information about the relevant safeguard. When you deliberately direct a job to a service outside your region, that destination also receives the data needed to carry out your instruction.

8. Retention

Promotlr keeps identifiable data only for as long as needed for the purpose described, the active contract, security, or a legal obligation. The current operational periods and deletion criteria are stated in the Data Retention Policy. Backups are isolated from ordinary use and expire on their rotation schedule. Legal holds, payment disputes, fraud investigations, and statutory accounting periods can require longer restricted retention.

9. Cookies and similar storage

The Cookie Policy lists the first-party cookies Promotlr uses, their purpose, and lifetime. Authentication and OAuth security cookies are necessary to provide requested sign-in functions. Remembered account-switching storage is created only when the user selects “Remember for 30 days”. Promotlr does not set an affiliate-attribution cookie; referral codes now remain in the referral signup URL instead. Non-essential cookies or local storage will not be used unless an applicable consent requirement has been satisfied.

10. Security

Promotlr uses access controls, least-privilege roles, password hashing, encrypted secret storage, signed callbacks, rate limits, session revocation, network-target validation, audit records, and operational monitoring appropriate to the risks. No online service can guarantee absolute security. You must protect your credentials, restrict workspace access, and report suspected compromise promptly.

11. Your rights

Subject to the conditions and exceptions in applicable law, you may have rights to:

• obtain confirmation and access to your personal data;
• correct inaccurate or incomplete data;
• request erasure or restriction of processing;
• receive portable data you supplied where processing is automated and based on consent or contract;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent for future processing; and
• lodge a complaint with the data-protection supervisory authority for your habitual residence, place of work, or the location of an alleged infringement.

Send a request to the legal contact. Promotlr may need proportionate information to verify identity and protect other users. Requests are answered within the period required by law. You may also update profile data, revoke sessions, export available records, or request deletion through account settings.

12. Automated decisions and children

Promotlr does not make decisions based solely on automated processing that produce legal or similarly significant effects on users. Automated security controls can temporarily rate-limit or pause suspicious activity; support can review a disputed restriction. The service is not directed to children, and account holders must be at least 18 years old.

13. Changes to this notice

Each version is identified above. Promotlr will publish changes here and provide additional notice before a material change where required. A new purpose that is incompatible with the original purpose will not be applied without a lawful basis and any required notice or consent.