Privacy Policy

1. Introduction

Van Moose (“we,” “our,” or “us”) operates Truncus, a transactional email infrastructure service (“Service”). This Privacy Policy describes how we collect, use, and protect your information when you use our Service.

We are committed to protecting your privacy and ensuring transparency in our data practices. This policy complies with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Information We Collect

2.1 Account Data

• Authentication: Email address and authentication data via Clerk
• Profile: Name (if provided), organization name
• Billing: Payment information processed by Stripe (we do not store card details)

2.2 Email Data

• Email Content: Subject, body, recipients of emails you send through our API
• Delivery Events: Delivery status, bounces, opens (if enabled), clicks (if enabled)
• Technical Data: IP addresses, timestamps, API request logs

2.3 Email Delivery Infrastructure

We deliver email through Amazon Web Services Simple Email Service (AWS SES, eu-west-1, Ireland) as the primary provider, with Scaleway Transactional Email (TEM, fr-par, France) as the second provider. Failover is used when SES is unavailable and works where a domain is authenticated with both providers. Both providers process email within the European Economic Area, so email content does not leave the EEA for delivery purposes. Each processes this data as our sub-processor under appropriate data protection agreements. For a complete list of sub-processors and their locations, see our Data Processing Agreement.

2.4 Website and Dashboard

The domain check on our homepage runs in your browser and queries Google Public DNS (dns.google) for the domain you type. Google receives that domain name and your IP address.

When you use the dashboard, we record a device signal (browser user agent, languages, time zone, screen properties and a canvas hash) together with your IP address, to detect abuse and duplicate sign-ups. It is stored in our own database (Supabase, Frankfurt) and not shared with third parties.

3. How We Use Your Information

We use collected information to:

• Provide the Service: Send emails on your behalf, track delivery status
• Manage Your Account: Authentication, billing, support
• Improve the Service: Analyze usage patterns, fix bugs, enhance features
• Security: Detect and prevent abuse, fraud, and security threats
• Legal Compliance: Comply with applicable laws and regulations

4. Legal Basis for Processing (GDPR)

We process your data based on the following legal grounds:

• Contract Performance: To provide the email services you have subscribed to
• Legitimate Interest: To improve our services, ensure security, and prevent abuse
• Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

5.1 Service Providers

• AWS SES: Email delivery infrastructure (primary, EU)
• Scaleway TEM: EU failover email delivery (France) where a domain is authenticated with both providers
• Clerk: Authentication services
• Stripe: Payment processing
• Vercel: Hosting and infrastructure
• Supabase: Database hosting (EU, eu-central-1 Frankfurt)
• Cloudflare: DNS for truncus.co and inbound email routing for info@truncus.co
• Upstash: Redis rate-limit counters and circuit-breaker state (EU, Frankfurt; API-key identifiers, sending-domain names and counters only — no email content, recipients or IP addresses)
• Telegram: Internal operational alerting for Van Moose’s own sending domains only — customer domain names are never sent
• AWS Route 53: DNS hosting for customer subdomains delegated to Truncus (DNS records only; no email content) — Global service; US parent (SCCs apply)
• Google Workspace: Our support mailbox: email sent to info@truncus.co and internal operational notifications, which can contain account email addresses and sending-domain names (no customer email content) — US parent (SCCs apply)

5.2 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights and safety.

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: Data encrypted in transit (HTTPS/TLS) and at rest
• Access Controls: Limited access to data on a need-to-know basis
• API Keys: Securely hashed, never stored in plain text

7. Data Retention

• Email content: Processed in transit; not stored beyond 7 days (delivery retry window)
• Delivery metadata: Bounce codes, delivery timestamps, complaint flags — retained for 90 days
• Engagement data: Open and click events (if tracking enabled) — retained for 90 days
• Account data: Retained while your account is active; deleted within 30 days of account termination
• Billing records: Retained as required by Dutch law (typically 7 years)

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at info@truncus.co.

9. International Data Transfers

Email delivery is processed within the EU (AWS SES eu-west-1, Ireland; Scaleway TEM fr-par, France) and does not constitute an international transfer. Personal data may be processed outside the European Economic Area via Clerk (authentication), Stripe (payments), Vercel (hosting), Cloudflare (DNS and inbound email routing), Upstash (rate-limit counters), AWS Route 53 (DNS hosting), and Google Workspace (support mailbox). These transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission. For full details, see our Data Processing Agreement.

10. Cookies

This website uses essential cookies for authentication and functionality. We do not use tracking cookies for advertising purposes.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Supervisory Authority

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your personal data in accordance with applicable law.