Skip to main content
SimpleNewsletter365
Start free

Legal

Privacy Policy

Last updated

Effective date: October 29, 2026

This Privacy Policy explains how SimpleSoftware365, Beatrixgasse 27/1/25, 1030 Vienna, Austria (“SimpleNewsletter365,” “we,” “us”) handles personal data when you use our website and the SimpleNewsletter365 application (the “Service”). SimpleNewsletter365 is a newsletter tool for organizations that use Microsoft 365.

Two roles, two relationships

We act in two different roles depending on whose data is involved:

  • As a controller for the personal data of our account holders: the people who sign in, set up an organization, and administer the Service. This Privacy Policy describes that processing.
  • As a processor for the contact and recipient data that you, our customer, upload and send to. You remain the controller of your audience data, and your use of that data is governed by your own privacy notice and by our Data Processing Addendum.

Data we collect as a controller

Account and identity data. When you sign in with Microsoft, we receive and store your Microsoft tenant ID, user object ID, email address, and display name from Microsoft Entra. We sign you in as a confidential OpenID Connect client. Microsoft access and refresh tokens stay on our servers and are never exposed to the browser or to front-end code.

Organization data. Account and tenant identifiers, display names, setup status, enabled feature gates, team memberships, roles, permissions, and invitations.

Mailbox connection data. When you connect a sending mailbox, we store non-secret grant metadata (grant ID, tenant, user object ID, subject mailbox, and granted scopes). Refresh-token material is encrypted at rest and never exported or logged.

Usage and diagnostic data. Audit records (actor ID, action, target, and timestamp), correlation IDs, and operational logs. Our logs use identifiers, hashes, statuses, counts, and durations rather than message content, email addresses, or token material.

Website analytics data. We use website analytics to understand visits to the marketing website, such as page URLs, referrers, browser and device metadata, event timestamps, page speed figures (web vitals), script errors (error message, stack trace and script file name, our own scripts only), clicks on links to other sites, and approximate location derived from IP address. Our analytics is self-hosted Rybbit at analytics.simplesoftware365.com, operated by us and hosted by Hetzner Online GmbH (Germany) in EU data centers; it is cookieless and sets no cookies or local storage on your device.

Billing data. If you buy a paid plan, paid plans are sold through Link (Stripe Managed Payments). Link, LLC is the merchant of record and processes your payment and charges applicable taxes. We receive plan, transaction, and status metadata, not your full card number.

Data we process as a processor

On your instruction, the Service stores and processes the audience data you manage, including contact email addresses, names, organizations, custom fields, subscription status, segment membership, signup form submissions, newsletter content, and delivery outcomes. We process this data to provide the Service to you and do not use it for our own purposes. See the Data Processing Addendum and our list of subprocessors.

How newsletters are sent

Newsletters are delivered through your own Microsoft 365 mailbox using Microsoft Graph. We do not operate a shared sending pool, and your recipients’ email addresses are not shared with other customers. We store a recipient record with an obfuscated email hint for progress reporting; full recipient email addresses are shown only to users with the appropriate permission.

How we use personal data

We use personal data to authenticate you, provide and secure the Service, send newsletters on your behalf, generate delivery and engagement reports, provide support, comply with legal obligations, and prevent abuse. We do not sell personal data, and we do not use your audience data to train advertising profiles.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (where required, for example certain cookies), and compliance with legal obligations.

Cookies

The application uses strictly necessary sign-in cookies to keep you signed in and protect the session. They last up to 14 days (renewed while you use the app) and are deleted when you sign out. We do not use advertising or tracking cookies. Our marketing website uses privacy-friendly, cookieless analytics, so it sets no non-essential cookies.

Sharing and subprocessors

We share personal data only with service providers that help us run the Service under contract: Microsoft Corporation (Azure) for hosting, storage, and key management, Link, LLC (merchant of record) and Stripe for payments, Lettermint (EU region) and Resend (US region) for transactional email, and Cloudflare for hosting this website and DNS, and Hetzner Online GmbH (Germany) for hosting our website analytics. We keep a current list of subprocessors. We may also disclose data where required by law or to protect rights and safety.

International transfers

Each organization chooses a home region once, when it signs up: EU (Microsoft Azure West Europe, Netherlands) or US (Microsoft Azure Central US). Customer content, files, recipients, activity data and logs that contain any of it stay in the home region. A small global service in West Europe keeps only what routing needs: a keyed hash of your Microsoft tenant ID, your home region, account flags and reserved organization names. It holds no names, email addresses or customer content. Billing data (billing identity, invoices and subscription state) is not bound to the home region: it is processed by our merchant of record, Link, and passes through the global service in West Europe. There is no migration between regions; moving means deleting the account in one region and creating it in the other.

Transfers of personal data to the United States rely on the EU-US Data Privacy Framework (DPF) where the recipient is certified. We checked the official DPF list on October 29, 2026:

  • Microsoft Corporation, Stripe, LLC and Cloudflare, Inc. are listed as active participants.
  • Plus Five Five, Inc. (Resend) is listed as active, with its re-certification under review. Resend’s Data Processing Addendum also incorporates the Standard Contractual Clauses.
  • Link, LLC is the merchant of record and processes buyer and payment data as an independent controller under its own privacy policy. Link is part of Stripe, and Stripe states that it complies with the EU-U.S. Data Privacy Framework and uses the EU Standard Contractual Clauses for transfers (source: link.com/privacy, checked on October 29, 2026).
  • Lettermint B.V., Netherlands (EU processing, no transfer outside the EEA).

The subprocessor list shows the transfer mechanism for each provider. Business customers can request a Data Processing Addendum under GDPR Article 28 by emailing hello@simplenewsletter365.com; see Data Processing Addendum.

Retention and deletion

We keep account data for as long as your account is active. When an account is deleted, we remove account-scoped records and stored image assets. Subscriber history rows are retained as append-only audit evidence, with email and actor email fields anonymized. Encrypted mailbox token material is revoked and deleted. Hashed signup-form audit and rate-limit rows are purged on a short cycle. Unsubscribe state is retained long enough to honor opt-outs. See the Data Processing Addendum for the processor-side detail.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection, and you may withdraw consent. Account holders can export and delete account data from within the Service. If you are a recipient of a newsletter sent through SimpleNewsletter365, please contact the sender (our customer), who controls that data; we will assist them as their processor. To exercise rights against us as a controller, contact hello@simplenewsletter365.com.

Security

We protect data with encryption in transit and at rest, encrypted token storage protected by Azure Key Vault, least-privilege access, tenant and account isolation on every record, and logging that excludes sensitive values. See our Security overview.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

Changes

We may update this Policy and will revise the effective date above. Material changes will be communicated through the Service or by email.

Contact

SimpleSoftware365, Beatrixgasse 27/1/25, 1030 Vienna, Austria. VAT ATU62316158. Full operator details are in the imprint. Privacy questions: hello@simplenewsletter365.com.