Maxon SDR Privacy Policy

Engineering-authored policy draft pending the documented external legal review.

Maxon SDR processes customer account data and customer-directed prospect, recipient, campaign, message, reply, suppression, and billing data to provide the service.

Roles

The customer is the data controller and sender for prospect and recipient personal data. Maxon SDR acts as processor under the DPA accepted at signup. Maxon SDR does not generate message content or select recipients.

Sub-processors

Stripe — payment processing and subscription billing
Cloudflare — DNS, API delivery, and infrastructure protection
Google Cloud — Cloud SQL prospect data hosting
Contabo — VPS hosting for application and sending services
Postal — outbound and inbound email delivery

Retention

Campaign, message, and thread records: life of the workspace plus 30 days after deletion
Revealed prospect access records: life of the workspace for billing reconciliation
Suppression entries: 12 months after workspace deletion, then purged
Stripe and Postal webhook event logs: 12 months
Application logs: 30 days

Data-subject rights

Customers use Maxon SDR export and deletion tooling to fulfil access and erasure requests for the data Maxon SDR processes on their behalf. Erasure removes revealed prospect data and thread history for the workspace and adds the address to that workspace's suppression list.

International processing

Maxon SDR uses the sub-processors listed above and applies the transfer and security mechanism recorded in the customer DPA summary.