Privacy Policy

1. Introduction & Data Controller

Who We Are

Bitelio is an email automation platform operated by Overthings, S.L., a company incorporated under Spanish law with tax identification number (CIF) B57925703 and registered office at Pl. Alexandre Jaume 3, 2, 07002 Palma (Illes Balears), Spain. In connection with the hosted service available at bitelio.com, Overthings, S.L. acts in two distinct capacities:

• Data Controller: with respect to the data tied to your account (your email address, password, and billing information)
• Data Processor: with respect to the contact data you upload, which we handle exclusively on your behalf and under your instructions

Contact Information

Email: legal@bitelio.com
Postal address: Overthings, S.L., Pl. Alexandre Jaume 3, 2, 07002 Palma (Illes Balears), Spain
Response time: 7 business days (30 days for GDPR requests)

This Policy Covers

• The hosted service provided at bitelio.com (SaaS)
• How we process the data of users located in the EU/EEA
• The rights the GDPR affords you

This Policy Does NOT Cover

• Third-party services that you choose to connect to Bitelio
• External websites reached through links on Bitelio

2. Data We Collect

2.1 Account Data (We are the Controller)

The following information is gathered at account registration:

• Your email address (needed to sign in and to receive notifications)
• Your password (kept only as a secure hash — never in plaintext)
• The authentication method you chose (password, Google OAuth, GitHub OAuth)
• The date your account was created and your most recent login
• Whether your email address has been verified

OAuth Users: Registering through Google/GitHub means we receive:

• Your email address
• The provider's OAuth identifier (no password is ever stored)
• A pre-verified email status

We DO NOT collect:

• Your name (optional, never mandatory)
• A telephone number
• A physical address
• Payment card numbers (these go directly to Stripe)

2.2 Contact Data (You are the Controller, we are the Processor)

The contacts you add to your projects carry the data you supply:

• The email addresses of your contacts
• Any custom fields you define (held as JSON: name, company, preferences, etc.)
• Each contact's subscription state (subscribed/unsubscribed)
• Timestamps recording when a contact was created or modified
• Locale/language settings

System Fields (Reserved):

• bitelio_id (unique identifier)
• bitelio_email (email address)
• unsubscribeUrl (auto-generated)

2.3 Email Activity Data

The following is recorded for messages dispatched through Bitelio:

• The subject line and the rendered HTML body
• The addresses of sender and recipient
• When the message was sent and its delivery status
• The delivery message ID assigned to the email (used for tracking)
• Delivery events: sent, delivered, opened, clicked, bounced, complained
• Aggregated open and click counts
• The timestamps of any bounces or complaints

Whether tracking occurs is governed by your project settings:

• Enabled: Every email is tracked
• Disabled: Nothing is tracked
• Marketing Only: Campaigns and workflows are tracked; transactional messages are not

2.4 API Request Logs (30-Day Retention)

To keep the service secure and to diagnose problems, our logs capture:

• The HTTP method, path, and status code of each request
• How long the request took and when it occurred
• The originating IP address and user-agent string
• The project ID and user ID (where the request was authenticated)
• Any error codes and their messages
• The size of the request and response

Retention: Purged automatically once 30 days have passed

2.5 Usage Analytics (Internal Only)

Our internal analytics are aggregated and contain no personal data:

• Email volume sent per project
• Performance figures for campaigns and workflows
• Statistics on feature usage (anonymized)
• Error rates and system performance indicators

2.6 Cookies & Local Storage

Authentication Cookie (next_token):

• Purpose: Holds the JWT token that keeps you signed in to the dashboard
• Duration: 7 days
• Type: First-party, httpOnly, secure (HTTPS only)
• Scope: *.bitelio.com
• Can be deleted: Yes (the cookie is removed when you log out)

No Tracking Cookies:

• Third-party cookies are absent
• Analytics cookies are absent
• Advertising cookies are absent

Browser Local Storage:

• Interface preferences (theme, collapsed sidebar, etc.)
• Kept exclusively on your device — never transmitted to our servers

3. How We Use Your Data

3.1 Service Delivery

Your data enables us to:

• Verify your identity and keep your session active (JWT tokens)
• Dispatch emails for you through AWS SES
• Hold and administer your contact lists
• Run your campaigns and workflow automations
• Measure email performance (where tracking is enabled)
• Present analytics and reporting

3.2 Billing & Payments

Where paid usage applies, we:

• Compute charges based on your usage (emails sent)
• Handle payments through Stripe
• Issue invoices and receipts
• Screen for fraudulent activity

3.3 Security & Compliance

Under continuous monitoring are:

• Bounce and complaint rates (to protect sender reputation)
• Abuse of the API and breaches of rate limits
• Login attempts that appear suspicious
• Spam or other policy violations

Measures we may adopt include:

• Suspending projects whose bounce or complaint rates are excessive
• Blocking IP addresses engaged in malicious activity
• Demanding email verification where a signup looks suspicious

3.4 Communication

Reasons we might reach out to you:

• Service announcements (downtime, maintenance)
• Security alerts (unusual activity, data breaches)
• Changes to our policies (Terms, Privacy Policy)
• Billing matters (failed payments, quota warnings)
• Compliance notices (e.g., a suspended project)

We DO NOT send:

• Marketing emails (absent your explicit opt-in)
• Product updates (unless you have subscribed to them)
• Promotions on behalf of third parties

3.5 Legal Obligations

Data may additionally be used or disclosed in order to:

• Satisfy subpoenas or court orders
• Enforce our Terms of Service
• Safeguard the rights and safety of our users
• Stop fraud or unlawful conduct

4. Legal Basis for Processing (GDPR)

The GDPR grounds on which our processing rests are the following:

4.1 Contract Performance (GDPR Art. 6(1)(b))

• Creating your account and authenticating you
• Sending and delivering email
• Billing and processing payments
• Supporting and maintaining the service

Without this processing, the Bitelio service cannot be provided to you.

4.2 Legitimate Interests (GDPR Art. 6(1)(f))

• Monitoring security and preventing fraud
• Improving the service and fixing bugs
• Analytics on usage (anonymized)
• Watching sender reputation (bounce/complaint rates)

An objection to this processing may be raised at any time (email legal@bitelio.com).

4.3 Legal Obligation (GDPR Art. 6(1)(c))

• Observing anti-spam legislation
• Answering legal requests (subpoenas)
• Tax and financial record-keeping
• Notifying data breaches

4.4 Consent (GDPR Art. 6(1)(a))

• Marketing communications from Bitelio (only where you opt in)
• Optional features for which consent is a precondition

Consent, once given, may be withdrawn whenever you wish.

5. Data Storage & Security

5.1 Data Location

Every item of data resides within the European Union / European Economic Area:

• Primary infrastructure: Hetzner (hosting based in Germany)
• Database: PostgreSQL, reached only over encrypted connections (TLS)
• Redis cache: in-memory and ephemeral data exclusively
• Backups: kept at EU/EEA locations

No data stored in: the USA, China, or any country outside the EU (the sole exception being AWS SES for email in transit)

5.2 Security Measures

Technical safeguards:

• Passwords: hashed with industry-standard secure algorithms
• Cookies: httpOnly, secure, SameSite=none (HTTPS)
• Database connections: encrypted via TLS/SSL
• API: reachable over HTTPS only (TLS 1.2+)
• JWT tokens: expire after 7 days, carried in httpOnly cookies
• Rate limiting: defends against brute-force attacks

Organizational safeguards:

• Access control: production data is reachable by a restricted set of personnel only
• Logging: API request logs held 30 days for security auditing
• Monitoring: automated alerting on suspicious activity

5.3 Data Breach Notification

Should a data breach occur:

• Affected users will be informed within 72 hours (as the GDPR requires)
• The notice will go to the email address on your account
• It will identify which categories of data were affected
• It will set out steps you can take to protect yourself

6. Data Sharing & Sub-Processors

Data leaves our systems only toward the trusted sub-processors without which the service could not operate:

6.1 Amazon Web Services (AWS SES)

• Purpose: Email delivery (SMTP relay)
• Data shared: Sender/recipient emails, subject, body, attachments
• Location: Data passes through in transit only (the delivery provider does not store it)
• Protection: AWS DPA (Data Processing Agreement) together with Standard Contractual Clauses
• Learn more: aws.amazon.com/ses/

6.2 Stripe

• Purpose: Payment processing
• Data shared: Billing email, usage amounts, transaction history
• Location: Global (holds PCI-DSS Level 1 certification)
• Protection: Stripe DPA together with PCI compliance
• Learn more: stripe.com/privacy

6.3 Hetzner

• Purpose: Infrastructure hosting (servers, database, storage)
• Data shared: All application data
• Location: EU/EEA (data centers located in Germany)
• Protection: A GDPR-compliant provider established in the EU
• Learn more: hetzner.com/legal/privacy-policy

NO OTHER THIRD PARTIES

• No analytics vendors (Google Analytics, Mixpanel, and the like)
• No advertising networks
• No data brokers or marketing firms
• No social media tracking pixels

6.4 Legal Disclosures

Disclosure of data may become necessary in response to:

• Court orders or subpoenas
• Requests from law enforcement (backed by valid legal process)
• National security demands (subject to the legal protections that apply)
• Emergencies (where immediate harm must be prevented)

Unless the law forbids it, you will be informed of any such disclosure.

7. Data Retention

7.1 Account Data

• Retained: For as long as your account exists — until you delete it
• Deletion: Takes effect immediately and is permanent (there is no grace period)
• Backups: Purged from backups within 30 days

7.2 Contact Data

• Retained: Until the contacts — or your account — are deleted by you
• Your control: Contacts can be removed one at a time or in bulk
• No automatic deletion: Your contacts are never removed on our initiative

7.3 Email Activity Data

• Retained: Without a fixed time limit (to support analytics and deliverability tracking)
• Includes: Open rates, click rates, and bounce history
• Purpose: Workflow triggers, campaign performance, sender reputation

7.4 API Request Logs

• Retained: 30 days, then deleted automatically
• Purpose: Security auditing and debugging
• Deletion: A daily cleanup job discards any log older than 30 days

7.5 Deleted Account Data

• Deleting an account takes effect at once
• There is no recovery window and no "soft delete"
• Everything associated with the account is erased: contacts, campaigns, workflows, email history, API keys, projects
• Billing records are kept where the law demands it (the period varies by jurisdiction)

7.6 Legal Retention

• Financial records: kept as tax law requires
• Subpoena responses: kept for as long as the law obliges us

8. Your Rights Under GDPR

Residents of the EU/EEA are entitled to exercise the rights below:

8.1 Right to Access (Art. 15)

• Ask for a copy of every item of personal data we hold on you
• Obtain that data in a machine-readable format (JSON)
• How to exercise: Email legal@bitelio.com, or retrieve your data through the API

8.2 Right to Rectification (Art. 16)

• Have inaccurate or incomplete data corrected
• How to exercise: Change your account settings in the dashboard, or write to legal@bitelio.com

8.3 Right to Erasure ("Right to be Forgotten") (Art. 17)

• Have your account and everything tied to it deleted
• Erasure is immediate and irreversible (no grace period)
• How to exercise: Dashboard > Settings > Delete Account, or email legal@bitelio.com

8.4 Right to Data Portability (Art. 20)

• Take your data with you as a JSON export
• Move it to a different service
• How to exercise: Pull your data through the API endpoints, or ask via legal@bitelio.com

8.5 Right to Object (Art. 21)

• Oppose processing carried out on the basis of legitimate interests
• Oppose the receipt of marketing emails
• How to exercise: Email legal@bitelio.com

8.6 Right to Restrict Processing (Art. 18)

• Have the processing of your data limited for a period of time
• How to exercise: Email legal@bitelio.com

8.7 Right to Lodge a Complaint

• Bring a complaint before a data protection authority
• The Spanish authority competent for Overthings, S.L. is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you may equally address the supervisory authority of your own EU/EEA member state
• EU/EEA supervisory authorities: edpb.europa.eu

9. Email Tracking

9.1 Tracking Modes

Three tracking modes are available in Bitelio, each configurable per project:

9.2 How Tracking Works

Open Tracking:

• A transparent 1x1 pixel image is placed within the email HTML
• The pixel loads when the recipient opens the message (provided images are enabled)
• What is recorded: the timestamp of the first open and the total number of opens
• Limitation: image blocking on the recipient's side can defeat this mechanism

Click Tracking:

• Links in the message are rewritten to route through the Bitelio redirect server
• What is recorded: the timestamp of the first click, the total click count, and the link URL
• The recipient is then forwarded to the original destination without delay

Data Collected:

• When the event happened
• The contact ID and email ID concerned
• Recipients' IP addresses and user-agents are NOT captured

9.3 Recipient Privacy

Recipients who wish to escape tracking have several options:

• Turning off images in their email client (which defeats open tracking)
• Choosing an email client that suppresses tracking pixels (Apple Mail Privacy Protection)
• Refraining from clicking links (which avoids click tracking)

Important: Your own privacy policy should inform your contacts that tracking takes place.

10. Cookies & Local Storage

10.1 Cookies

A single cookie — and no other — is set by us:

NO TRACKING COOKIES

• No cookies from Google Analytics
• No cookies from Facebook Pixel
• No cookies for advertising or marketing
• No cookies from third parties

10.2 Browser Local Storage

Certain non-sensitive interface preferences live in your browser's local storage:

• Your theme choice (light/dark mode)
• Whether the sidebar is collapsed or expanded
• Which table columns are visible
• How your dashboard is laid out

These values:

• Remain inside your browser at all times
• Are never transmitted to our servers
• Disappear when you clear your browser data
• Play no role in tracking

10.3 Analytics (Only With Your Consent)

If we enable audience measurement on our public websites, it is loaded exclusively after you accept it through the cookie banner. Until you opt in, no analytics script runs and no usage data is collected. Your choice is stored locally in your browser and can be changed at any time via the "Cookie preferences" link in the footer.

10.4 Cookie Consent

The only cookie we set is strictly necessary for authentication, so the ePrivacy Directive does not oblige us to request consent for it. Any non-essential technology (such as the analytics described in 10.3) is subject to your prior, explicit consent.

Should you object to the authentication cookie, Bitelio cannot be used, since signing in depends on it.

11. International Data Transfers

11.1 Primary Storage (EU/EEA)

The EU/EEA is home to all of our primary data storage:

• Hetzner data centers (Germany)
• PostgreSQL database (EU/EEA)
• Redis cache (EU/EEA)

11.2 Email Transit (AWS SES - USA)

Delivering email through AWS SES entails a temporary transfer of data to the USA:

• Messages in delivery may pass through regions outside the EU
• This concerns data in transit only (no long-term storage takes place outside the EU/EEA)
• Safeguarded by Data Processing Agreements (DPA) and Standard Contractual Clauses (SCCs)

11.3 Payment Processing (Stripe - Global)

Payments handled by Stripe are processed worldwide under adequate safeguards:

• Certified PCI-DSS Level 1
• Covered by the Stripe DPA and GDPR compliance
• EU representative: Stripe Payments Europe, Ltd. (Ireland)

Learn more: stripe.com/privacy-center/legal

11.4 Adequacy Decisions

EU adequacy decisions are our preferred basis for transfers wherever they are available. Transfers to the USA rest on Standard Contractual Clauses (SCCs) in the form approved by the European Commission.

12. Children's Privacy

Age Restriction

• Children under 16 years of age are not the intended audience of Bitelio
• Data from children under 16 is never knowingly collected by us
• Registering an account requires attesting that you are 16 or older

If We Discover

• That an account belongs to someone under 16, the account is deleted without delay
• Accounts deleted for being underage receive no refund

Parental Rights

• Should you suspect your child has opened an account, write to legal@bitelio.com
• The matter will be investigated promptly and the account deleted

GDPR Age of Consent

Set at 16 years (Art. 8 GDPR). Although member states may reduce this threshold to 13, the standard we apply is 16.

13. Scope of This Policy

The hosted service at bitelio.com — the sole form in which Bitelio is offered — is what this Privacy Policy governs.

Outside its scope fall the third-party services you connect to Bitelio and the external websites Bitelio links to; each of those is subject to its own privacy policy.

14. Changes to Privacy Policy

Revisions to this Privacy Policy may be made to account for:

• Adjustments in how we process data
• Features or services we introduce
• Demands of law or regulation
• Clarifications or the correction of errors

Notification

• Material changes: every user receives 30 days' notice by email
• Non-material changes: only the "Last Updated" date is revised
• Major changes: a banner appears on the homepage

Your Options

• By continuing to use the service, you accept the revised policy
• Should you disagree, your account must be deleted before the changes take effect
• You may obtain your data prior to deletion (the GDPR right to portability)

Version History

Earlier versions can be obtained on request (email legal@bitelio.com)

15. Contact Information

Anything unclear about this Privacy Policy or about your data?

Data Protection Officer (DPO)

GDPR Art. 37 does not oblige us to appoint one at present. Were a DPO to be designated in the future, their contact details would appear here.

EU Representative

None is required, since Overthings, S.L. is established within the EU (Spain)

Supervisory Authority

Lodging a complaint with a data protection authority is your right. The Spanish authority competent for Overthings, S.L. is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you may also turn to the supervisory authority of your own EU/EEA member state. Find your authority: edpb.europa.eu

Technical Support

• Email: hello@bitelio.com