This Privacy Policy explains how Netstudio E.E. handles personal data in Tigramail (the "Service"). We comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Greek Law 4624/2019 and Greek Law 3471/2006 on electronic communications.
01Who we are
- Controller
- Netstudio E.E., 49 Trapezountos St., 145 65 Agios Stefanos, Athens, Greece. G.E.MI. 007975601000.
- Contact
- info@netstudio.gr, +30 210 800 4447
- Data Protection Officer
- dpo@netstudio.gr, at the address above
02Our two roles
We process personal data in two different capacities, and it matters which one applies to you.
As controller
For the people who use Tigramail (account owners, admins and members), people who visit our website and people who contact us, Netstudio decides why and how the data is processed. This policy describes that processing in full.
As processor, on behalf of our customers
Our customers use Tigramail to email their own contacts. For that data (contact lists, custom attributes, form submissions and engagement with emails), the customer is the controller and Netstudio processes it only on the customer's instructions, under the data processing terms in section 6 of our Terms of Use. The customer's own privacy policy applies to it.
Received an email sent with Tigramail? The organization that sent it is responsible for your data. Every marketing email contains an unsubscribe link that works instantly. To access, correct or delete your data, please contact the sender. If you cannot reach them, write to dpo@netstudio.gr and we will pass your request on and help them respond.
03Data we collect as controller
- Account data: name, email address, password (stored only as a one-way hash), two-factor authentication settings, profile photo if you add one, your role and the organizations you belong to.
- Sign-in with Google: if you choose it, Google shares your name, email address and profile picture with us. We do not receive your Google password.
- Organization and billing data: company name, address, VAT number, billing contact and invoice history.
- Usage and technical data: IP address, browser and device information, session records, timestamps, actions you take in the application, API and MCP requests, and error logs, kept to run and secure the Service.
- Integration data: if you connect Cloudflare, we store the access tokens needed to manage your DNS records and the zone information we read. If you create API tokens, we store them in hashed form.
- Communications: messages you send us, support requests and the information you share in them.
- AI feature data: the prompts and material you send to the design assistant and image tools, and the results returned.
04Why we use it and on what legal basis
- Providing the Service, managing accounts, organizations and invitations, support
- Performance of a contract (Article 6(1)(b) GDPR).
- Security, fraud and abuse prevention, enforcing our sending rules, keeping logs
- Our legitimate interest in protecting the Service, our customers and the reputation of our sending infrastructure (Article 6(1)(f)).
- Invoicing, accounting and tax records, responding to lawful requests by authorities
- Compliance with a legal obligation (Article 6(1)(c)).
- Service announcements (changes to terms, security notices, outages)
- Performance of a contract and our legitimate interest. These are not marketing and cannot be switched off while you have an account.
- Product news and offers from Netstudio
- Your consent, or our legitimate interest for existing customers about similar services under Article 11(3) of Law 3471/2006. You can opt out at any time.
- Improving the Service using aggregated, de-identified statistics
- Our legitimate interest in developing our product.
05Data we process for our customers
Depending on how a customer uses Tigramail, we process on their behalf:
- Contact data: email address, name and any other attributes the customer stores (for example company, city or birthday), subscription status, list membership and tags.
- Consent records: for signup forms with double opt-in, the time of signup and confirmation and the IP address used, so the customer can prove consent.
- Delivery and engagement data: which emails were sent and delivered, opens, clicks, bounces, spam complaints and unsubscribes, together with the time, IP address, user agent and the approximate country derived from the IP address.
- Suppression data: addresses that unsubscribed, bounced or complained, kept so they are not emailed again.
- Automation data: which automation steps a contact has entered and when.
We do not sell this data, use it for our own marketing or combine it across customers. Each customer's data is kept separate within its organization.
06Email tracking
Emails sent through Tigramail contain a small invisible image (a tracking pixel) that records when an email is opened, and links that pass through a redirect operated for us by Amazon SES to record clicks before taking you to the destination. Customers use this to measure their campaigns and remove inactive contacts.
Mail privacy features (such as Apple Mail Privacy Protection) and corporate security scanners can open emails and follow links automatically. Tigramail detects much of this activity, for example by comparing the requesting address against Apple's published relay ranges, so that it is not counted as a human open or click.
Customers are responsible for telling their contacts about tracking and, where required, obtaining their consent. You can prevent open tracking by blocking images in your mail client.
09International transfers
Tigramail runs on servers operated by Netstudio in the European Union, and email delivery runs on Amazon SES in the EU (Frankfurt). When a provider in a country outside the European Economic Area processes data (for example the AI providers above), we rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
10How long we keep data
- Account data: for as long as your account is active. When it is closed, we delete it within 30 days, except what we must keep by law.
- Customer data (contacts, engagement, designs): for as long as the customer keeps it in Tigramail. Customers can delete contacts at any time. When an organization is closed, its data is deleted within 30 days after the export window described in our Terms of Use, and erased from backups within their normal rotation.
- Suppression records: for as long as the customer's organization exists, because forgetting an unsubscribe would mean emailing someone who said no.
- Security and server logs: usually up to 12 months.
- Invoices and accounting records: for the period required by Greek tax and accounting law.
11Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit (TLS), hashed passwords and API tokens, two-factor authentication, role-based access within each organization, separation of each customer's data, restricted staff access and regular backups. Netstudio operates an information security management system certified to ISO/IEC 27001:2022.
No system is completely secure. If a personal data breach occurs, we will notify the affected customers and, where required, the Hellenic Data Protection Authority and the people concerned, without undue delay.
12Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict processing in certain cases;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive your data in a structured, machine-readable format (portability);
- withdraw your consent at any time, without affecting processing that happened before.
To exercise these rights, email dpo@netstudio.gr. We will reply within one month, which may be extended by two more months for complex requests. We may ask you to verify your identity. If your request concerns data a customer holds about you, we will refer it to that customer, as explained in section 2.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr, or with the supervisory authority in your country.
13Automated decisions
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Tigramail does apply automated checks, for example to classify bot traffic or to pause sending when bounce or complaint rates are too high, and our team reviews those outcomes on request.
14Children
Tigramail accounts are for adults acting in a professional capacity, and we do not knowingly collect data from children for our own purposes. Customers who email children must comply with the law, including the requirement under Article 21 of Law 4624/2019 that a child under 15 needs the consent of a parent or guardian for online services offered on the basis of consent.
15Changes to this policy
We may update this policy when our Service or the law changes. We will publish the new version here with a new date and notify account owners of material changes by email or in the application.
16Contact
For any question about this policy or about your personal data, contact our Data Protection Officer at dpo@netstudio.gr, or write to Netstudio E.E., 49 Trapezountos St., 145 65 Agios Stefanos, Athens, Greece. This policy is available in Greek and English. If the two versions conflict, the Greek version prevails.