Privacy Policy

The data we hold

• Your DID and registered sending domain(s).
• A salted hash of your API key. The plaintext key is only shown once, at enrollment.
• DKIM keypairs issued to your domain. Private keys are stored encrypted at rest and never leave our servers.
• Send logs: per-message sender DID, recipient address, From/To headers, timestamps, delivery status code, and bounce disposition. We do not store message bodies after handoff to the queue.
• Rate-limit counters: short-window send counts per DID used to enforce hourly and daily limits.
• Bounce records: inbound DSN classifications per DID so we can suspend senders with pathological bounce rates.
• Suppression list: recipients who used the one-click unsubscribe header, keyed per sender DID.
• IP addresses of SMTP clients, kept only in transient logs for abuse investigation and rotated out under the retention schedule below.

Data we deliberately avoid

We do not retain full message bodies past delivery. We do not set web tracking cookies, fingerprint browsers, or embed third-party analytics on any of our pages. We do not sell or rent member data to anyone, under any circumstances.

How long we keep it

• Terminal message logs (sent, bounced): 30 days, then purged.
• Rate-limit counters: 48 hours rolling window.
• Suppression entries: for the life of the member record. Unsubscribes must persist.
• Member record: indefinite while active. After a deletion request (see §6), a 14-day reactivatable cooldown, then anonymized hard delete. The contact email is kept an additional 30 days so the export link in the deletion-confirmation email keeps working.

Full lifecycle and field-level retention table: /privacy/data-deletion.

Who else sees this

We publish a small set of public atproto labels about your DID via our cooperative labeler at labeler.atmos.email. Today that's verified-mail-operator and relay-member. These are signed, network-visible, and any atproto consumer can read them. That's the point: third parties can verify you're a cooperative member.

Send events and bounce outcomes also feed our internal trust and safety systems, which derive operational reputation signals used to drive throttling, warming, and enforcement. Those signals stay inside the relay. They are not published as atproto labels and do not leave our infrastructure.

We do not share message content, recipient lists, or API keys with anyone.

Where the data lives. The relay and labeler are operated by Atmosphere Mail LLC on third-party cloud hosting in the United States. If you write to us from the European Economic Area, the United Kingdom, or another jurisdiction with cross-border data protection rules, your data is processed in the US. We act as a controller for all data we hold about you and collect it directly from you. There is no intermediate processor.

You provide your data directly to us as the controller, on your own initiative. EDPB Guidelines 05/2021 treat that as outside the Chapter V "transfer" regime. We remain subject to GDPR as a controller targeting EEA and UK residents, and every right in this notice applies.

Legal basis

Under GDPR Article 6, we rely on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) for the data we need to operate the relay you signed up to use: your DID, API key hash, DKIM keys, enrolled domains, send and bounce logs, suppression entries, and rate-limit counters.
• Legitimate interests (Art. 6(1)(f)) for the reputation signals we publish via the cooperative labeler and for the internal trust-and-safety detections that drive throttling and suspension. Our interest is keeping the relay deliverable for every member; that interest is balanced against your right to a fair, transparent reputation system (see §7 on automated decisions and §6 on your rights).
• Legal obligation (Art. 6(1)(c)) for the minimum records we must keep to respond to abuse complaints, lawful government requests, and our own breach-notification duties.

We do not rely on consent as a lawful basis for the operational data above, because withdrawing it would prevent us from running the service you asked for. Your right to delete (§6) is the equivalent control.

Providing the data we process under "Performance of a contract" is a contractual requirement. Without it we cannot enroll your DID or relay mail for you (Art. 13(2)(e)).

Access, correction, deletion, objection, complaint

Two self-service endpoints on the dashboard:

• /account/settings/delete schedules deletion (Art. 17, right to erasure). 14-day reactivatable cooldown; after that the member row is hard-deleted and most fields anonymized. A confirmation email lands at your contact address with a reactivate link and an export link valid for 30 days post-delete. Suppression entries (recipients who used the one-click unsubscribe header) are retained in minimized form under Art. 17(3)(b). Unsubscribes have to keep working after the member record is gone, and the suppression artifact is what makes that possible.
• /account/settings/data-export downloads a JSON archive of the personal data we hold against your DID: member metadata (status, limits, contact email, terms acceptance), enrolled domains and their public DKIM selectors, OAuth signin history, suppression entries (hashed recipients), and send-test records. Art. 15 access and Art. 20 portability.
• Some categories are not yet in the self-service archive: send logs, bounce records, rate-limit counters, and any retained IP-address logs keyed to your DID. Email postmaster@atmos.email and we will provide them in a machine-readable format within 30 days, along with the Art. 15 metadata for every category we hold about you (purposes, recipients, retention, lawful basis, automated-decision-making details).

You also have these rights, exercised by email to postmaster@atmos.email:

• Rectification (Art. 16): ask us to correct inaccurate data we hold about you.
• Restriction (Art. 18): ask us to pause processing while a dispute is resolved.
• Objection (Art. 21): you may object at any time to processing based on our legitimate interests (the labeler and the trust-and-safety signals in §5). When you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is needed to establish, exercise, or defend legal claims. If we continue, we will explain why in writing.
• Complaint to a supervisory authority (Art. 77): if you believe we have mishandled your data, you can lodge a complaint with the data-protection regulator in your country of residence. For EU members, that is your national DPA (e.g. CNIL in France, BfDI in Germany, AEPD in Spain). For UK members, that is the Information Commissioner's Office (ICO).

The API-key-authenticated /member/status endpoint returns current status and active labels for programmatic access.

If self-service isn't an option (lost handle, locked out, atproto identity rotated), email postmaster@atmos.email from a mailbox you can prove control of, or sign the request with your DID's signing key. We respond to verified requests within 30 days, in line with Art. 12(3).

How throttling and suspension work

We run automated systems that can throttle or suspend your account without a human in the loop on every event. They look at things like how fast you're sending, how often recipients are bouncing or complaining, and whether your sending pattern is unusual compared to your own history. If a threshold is crossed, your mail can be slowed or stopped.

Suspension stops your mail from being relayed, which is a significant effect under Art. 22. We rely on Art. 22(2)(a): the automated throttle and suspension logic is necessary to perform our contract with you, because protecting the deliverability of the relay's IP pool is the service. You can (a) request human review by emailing postmaster@atmos.email, (b) explain your side, and (c) contest the decision. Operator decisions are logged so they are visible on appeal.

We do not make automated decisions that produce legal effects on you (e.g. denial of a paid service, sharing data with employers or law enforcement) without explicit human review.

How we protect it

Sensitive fields (API keys, your contact email, and the cryptographic keys we use to sign mail on your behalf) are encrypted at rest using industry-standard methods. Host access is restricted to the LLC's operations team and uses hardware-keyed SSH.

Administrative access to member data is limited to authorized operators of Atmosphere Mail LLC, who are bound by confidentiality and act under the controller's authority. Operator credentials are limited and are rotated or revoked when no longer needed.

If we discover a personal-data breach that is likely to result in a risk to your rights and freedoms (Art. 33), we will notify the relevant supervisory authority within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay (Art. 34), via the contact email on your account.

Reach us

The data controller is Atmosphere Mail LLC, a Washington State limited liability company registered with the Washington Secretary of State. Operational contact for privacy and security matters: postmaster@atmos.email.

Members who require a registered mailing address (for example, for a formal data-subject request under GDPR or a regulator inquiry) may request one by email and we will provide it in writing.

EU representative. We are a US-based controller with no EU establishment and have not yet designated a representative under Art. 27. Members in the EEA or UK can exercise their rights by writing to postmaster@atmos.email, and we will respond within the Art. 12(3) timeline.