Privacy Policy

Fromly is operated by Fromly, a French micro-entreprise (sole trader). For anything in this policy, including a request about your data, write to axel.schapmann@gmail.com.

Your data as a customer. Your name, your email address, your workspace and your billing details. We decide what happens to it, so we are the controller, and this policy describes it.

Your subscribers’ data. The contacts you import and the emails you send them. You decide what happens to it, so you are the controller and we are your processor: we act on your instructions, we do not use it for our own purposes, and we never contact your subscribers ourselves.

• Account: your name, email address, and the workspace you belong to.
• Sign-in: the fact you signed in with Google or with a one-time code, and your session.
• Billing: the credits you buy and use, your automatic recharge settings, and the brand and last four digits of your saved card. Card details go to Stripe and never reach us.
• Usage: technical logs, and errors, to keep the service running.
• Site analytics: pages visited and where visitors came from, without tracking individuals across other sites.
• Support: what you write to us when you ask for help.

On your behalf we store the contacts you import or create (email address, name, and the attributes your connected tools expose, such as subscription status), the events those tools send, the emails you write, and what happened to each one: sent, delivered, opened, clicked, bounced, unsubscribed.

We also store the access tokens for the tools you connect. They are encrypted, and they are used only to sync your data.

• To provide the service you signed up for — performance of our contract with you.
• To bill you and keep accounting records — our legal obligations.
• To keep the service secure, prevent abuse and protect sending reputation — our legitimate interest.
• To send you product and service emails — our legitimate interest, and your consent where it is required.

For your subscribers’ data, the lawful basis is yours to establish, not ours.

We do not sell personal data and we do not share it for advertising. We rely on a small number of providers to run the service, each with access to only what its job requires:

• Hosting: the servers that run the app and the database.
• Email delivery: sending your emails and reporting bounces and complaints.
• File storage: the images used in your emails.
• Payments: card payments, and the integration that reads your own Stripe account if you connect it.
• Sign-in: signing in with a Google account, for those who choose it.
• Abuse prevention: automated review of new accounts and of emails before they are sent, to stop phishing and spam. A person reviews anything it holds back.
• Support: the chat in the app, when you open it.
• Audience measurement: visits to the public website.

The current list of these providers, with where they process data, is available on request at axel.schapmann@gmail.com.

We may also disclose data when the law requires it, or to establish or defend a legal claim.

Data is stored in the European Union and the United Kingdom. Some providers may process data elsewhere, including the United States; where they do, the transfer relies on the European Commission’s standard contractual clauses or an adequacy decision.

• Your account and workspace data: as long as your account exists.
• After an account is closed: deleted, apart from what we must keep for accounting, which is kept for the legal retention period.
• Your subscribers’ data: as long as you keep it, and deleted when you delete it or close your workspace.
• Unsubscribes and suppressed addresses: kept after deletion, because forgetting them would mean emailing someone who asked us not to.
• Technical logs: a few weeks.

You can ask for a copy of your data, have it corrected or deleted, object to how we use it, or ask us to restrict it. Write to axel.schapmann@gmail.com and we will answer within a month.

If a request concerns an address in a customer’s contact list, we forward it to that customer: the data is theirs, not ours.

You may also complain to a data protection authority. In France, that is the CNIL.

The app sets the cookies it needs to keep you signed in. They are essential to the service, and without them you cannot use it. The support chat keeps an identifier in your browser so that a conversation continues where you left it.

The public website measures audience with DataFast, which counts visits and referring sites without following you around the web. There is no advertising cookie, no retargeting pixel, and nothing we sell to a third party.

Connections use HTTPS, integration tokens are encrypted, sign-in codes are stored hashed, and access to production is restricted to us. No system is perfectly secure, but we do treat a breach as something we tell you about.

Fromly is a tool for businesses and is not intended for children.

We will update this page when the service changes. If a change matters, we will tell you by email rather than quietly changing the date at the top.

Any question about privacy: axel.schapmann@gmail.com.