Privacy and GDPR

A newsletter is personal data from the first address. Postalion keeps all of it in your own database, asks for consent before adding anyone, and lets people leave with one click.

Consent

Double opt-in is on by default: a person joins only after clicking the link in the confirmation email, and the time of the confirmation is stored. Sign-up checkboxes are unticked by default, as the law in most of Europe expects. Imported people are your responsibility: import only those who agreed.

Leaving

Every email carries an unsubscribe link in its footer, plus the List-Unsubscribe headers that let Gmail, Apple Mail and Outlook show their own unsubscribe button. The link asks for one confirmation click, so a security scanner that follows links does not unsubscribe people by mistake. Unsubscribing is for all lists at once. A page with the unsubscribe form is created at activation for people who no longer have an email at hand.

Requests about personal data

Postalion plugs into the WordPress tools under Tools → Export Personal Data and Erase Personal Data. An export includes the person's subscriber record with their lists, the newsletters sent to them and their emails from the log; an erasure removes the subscriber record, the list memberships and the log entries for that address.

What is stored, and where

Nine tables in your WordPress database: subscribers, their lists and memberships, newsletters, the sending queue, the counted links, the email log, the activity and system log, and the users who opted out. Nothing is sent to outside servers; the plugin makes no requests of its own, loads nothing from a CDN and has no telemetry.

• The email log keeps a copy of each email as sent, for the preview. Entries are deleted after 90 days by default (Settings → Maintenance; 30 days to forever).
• Unconfirmed sign-ups are removed after 30 days.
• With statistics on, the time of the first open and click per recipient is kept; see Statistics.
• If you set up SMTP, the password is stored encrypted, or kept in wp-config.php if you prefer.

Removing everything

Deactivating keeps the data, so an update or a move does not lose your list. Deleting the plugin keeps it too, unless you tick Settings → Maintenance → Remove all data on uninstall first; then the tables and the options are dropped.

For your privacy policy

Postalion suggests a paragraph under Settings → Privacy → Policy Guide, which you can adapt. In short: you collect email addresses and optionally names for the newsletter, with double opt-in; you keep them on your own server; you measure opens and clicks only if you turned statistics on; people can unsubscribe from any email and ask for their data to be exported or erased.

Next: For developers