Privacy policy
How we handle personal data
In short. nurture.email is an e-mail marketing platform run by Solharbor. Our customers upload their contacts and send e-mail to them through us. For those contacts' data, our customer is the data controller and we act only on their instructions. For our customers' own account data, and for visitors to this website, we are the controller. We do not sell personal data, and we do not use our customers' contact lists for anything except providing the service to that customer.
1. Who we are
nurture.email is operated by Solharbor ("we", "us"), a business established in the United Kingdom. Contact details are in section 12. Where this policy refers to the "service", it means the nurture.email platform at app.nurture.email and tenant subdomains of nurture.email, together with this website.
2. Three kinds of people, two roles
We handle personal data about three groups, and our role is different for each.
| Who | Our role | Which sections apply |
|---|---|---|
| Customers and their users: the people who hold an account and log in | Controller | 3, 5–12 |
| Subscribers: the people our customers e-mail through the service | Processor, on the customer's instructions | 4, 5–12 |
| Website visitors: people who read this site or book a demo | Controller | 3, 5–12 |
If you received an e-mail sent through nurture.email and want to know why, unsubscribe, or ask for your data to be deleted, the sender is the controller. Use the unsubscribe link in the e-mail or contact the sender directly. If you cannot reach them, write to us (section 12) and we will pass your request on and help where we can.
3. Customers, users and visitors: what we collect and why
What we collect
- Account details. Name, e-mail address, password (stored as a hash), organisation name, role, and the time zone and settings you choose.
- Billing details. Billing name and address, VAT status, and your plan and usage. Card details go directly to Stripe; we never see the full card number.
- Sending domains. The domains you verify for sending, and the DKIM signing keys we generate for them (stored encrypted).
- Integrations. If you connect HubSpot or another system, the credentials or tokens needed to keep it connected (stored encrypted) and the data the integration syncs.
- Usage and logs. Sign-in times and IP addresses, actions taken in the account, API calls, and server logs. We keep these to run the service securely and to investigate problems and abuse.
- Support and demo requests. What you send us by e-mail or through the demo form on this site: name, work e-mail, company and your message.
- Acceptance records. Which version of our Terms, Acceptable Use Policy and this policy each user accepted, and when.
Why, and on what legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the service you signed up for, including billing | Performance of a contract |
| Keeping the platform secure, preventing abuse and spam, enforcing our Acceptable Use Policy | Legitimate interests (ours, and those of everyone who receives e-mail through us) |
| Responding to support and demo requests | Legitimate interests; steps before entering a contract |
| Service e-mails about your account: billing, security, changes to terms | Performance of a contract; legal obligation |
| Occasional product news to customers | Legitimate interests; you can opt out at any time |
| Tax, accounting and legal compliance | Legal obligation |
This website sets no analytics or advertising cookies. The app sets a session cookie so you stay signed in; it is strictly necessary and needs no consent.
4. Subscribers: data we process for our customers
Our customers decide whom to e-mail and what to send. We process subscriber data only to deliver that service, under our Terms of Service, which include data processing terms. This section explains what that involves so that subscribers and customers both know what happens.
What the customer gives us
- E-mail address, name, and any attributes the customer records (for example company, deal stage, tags, or fields synced from HubSpot).
- List memberships and subscription status, including how and when consent was recorded where the customer uses double opt-in.
What the service generates
- Delivery events. Whether each e-mail was accepted, delivered, bounced, delayed or reported as spam. These come from the mailbox providers via Amazon SES.
- Engagement events. Opens (via a tracking image) and link clicks, if the customer has turned tracking on for a campaign.
- Suppressions. Addresses that hard-bounced, complained or unsubscribed are kept on a suppression list for that customer so they are not e-mailed again. This is required by law and by the mailbox providers, and the customer cannot override it for complaints.
- Mailbox verification results. When a customer runs "Clean this list", each address is checked for whether it exists and accepts mail. The result (valid, invalid, unsure) is stored against the subscriber.
What we do not do with subscriber data
- We never e-mail a customer's subscribers for our own purposes.
- We never share one customer's subscribers with another customer, and we never combine lists across customers.
- We never sell, rent or trade subscriber data.
- We do not build profiles of subscribers across customers.
A subscriber's rights (section 8) are exercised against the customer who e-mailed them. We help customers meet those requests: every account can export, correct and delete subscribers, and honour unsubscribe and erasure requests.
5. Who else sees the data: our sub-processors
We use a small number of service providers. Each is bound by contract to protect the data and use it only to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting the service and its database; sending e-mail through Amazon SES; backups | London (eu-west-2), with backups in the same region |
| Stripe | Payments, invoices and VAT | EU/UK, with transfers to the US under Stripe's safeguards |
| Apify | Mailbox verification when a customer runs "Clean this list": e-mail addresses only, no names or other fields | EU |
| Netlify | Hosting this website and receiving demo-form submissions | US and EU, under Netlify's safeguards |
| HubSpot (where the customer connects it) | Two-way contact and deal sync, under the customer's own HubSpot agreement | Per the customer's HubSpot account |
We will give customers at least 30 days' notice before adding a sub-processor that will handle subscriber data, by e-mail to the account's contact address.
6. International transfers
The service and its data live in the United Kingdom (AWS London). Where a provider handles data outside the UK or EEA, we rely on the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision, as applicable.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account, subscriber and campaign data | While the account is open. Deleted within 30 days of the account closing, except where we must keep it (below). |
| Database backups | Rolling: 14 days on the host, 35 days in encrypted off-site storage. Data deleted from the live service disappears from backups on that cycle. |
| Suppression entries (bounces, complaints, unsubscribes) | While the account is open, so the address is never e-mailed again by that customer. |
| Delivery and engagement events | While the account is open; customers can delete campaigns and their events at any time. |
| Server and access logs | Up to 90 days. |
| Invoices and billing records | 6 years after the tax year they relate to, as UK tax law requires. |
| Records of abuse or Acceptable Use Policy breaches | Up to 2 years after the account closes, to prevent repeat abuse. |
| Demo and support correspondence | Up to 2 years after our last contact. |
8. Your rights
Under UK and EU data protection law you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, where we have no overriding reason to keep it;
- restrict or object to how we use it, including objecting to any direct marketing from us;
- give you your data in a portable format;
- withdraw consent, where consent is what we rely on.
Write to privacy@nurture.email. We will reply within one month. We may ask you to confirm your identity first. If you are a subscriber of one of our customers, we will forward your request to that customer unless you ask us not to, because they hold the data and decide what happens to it.
You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA. We would rather hear from you first.
9. Security
Data is encrypted in transit (TLS) and at rest (encrypted volumes and backups). Passwords are stored as salted hashes. DKIM keys and integration tokens are encrypted in the database with a key held outside it. Each customer's data is isolated at the database level, so one customer cannot see another's. Access to production is limited to named staff with multi-factor authentication, and administrative access is logged. We monitor sending for bounce and complaint spikes so that a compromised or abused account is caught quickly.
If we become aware of a breach affecting personal data, we will tell affected customers without undue delay and in any case within 72 hours of confirming it, with what we know and what we are doing about it, so that they can meet their own obligations.
10. Children
The service is for businesses. We do not knowingly collect data from anyone under 18 as a customer or user. Customers are responsible for the lawful collection of their subscribers' data.
11. Changes to this policy
We will post changes here with a new version number and effective date. For changes that affect how subscriber data is processed, or that reduce your rights, we will e-mail the account contact at least 30 days in advance. Users are asked to accept the current version when they next sign in.
12. Contact
Solharbor, trading as nurture.email
E-mail: privacy@nurture.email
Postal address: available on request by e-mail.