Privacy Policy

Last updated 3 August 2026

Systmatk Email Systems ("Systmatk", "we", "us") provides an email outreach platform. This policy explains what we collect, why, and the choices you have. It covers our mobile apps and our website at gosystmatk.com.

1. Who is responsible for your data

Two different relationships exist, and the distinction matters:

• When you are our customer (you signed up and use the app), we are the data controller for your account information.
• When our customer emails you, that customer is the data controller for your contact details. We are their data processor. You may still exercise your rights directly with us using the form above, and we will act on them.

2. What we collect

From customers

Business contact data

We compile business contact information from publicly available sources: company websites, public business registers such as UK Companies House, and public professional directories. We collect business role information only — name, job title, employer, and work email address. We do not collect or sell personal data such as home addresses, personal phone numbers, or any special category data.

Our lawful basis is legitimate interest in facilitating business-to-business communication, balanced against the rights of the individual. You may object at any time using the data removal form, and we will stop.

3. How we protect mailbox credentials

Your mailbox app password is encrypted before storage using envelope encryption. The encryption key is held separately from the database. The password is never written to our logs, never returned by our API, never included in analytics or crash reports, and never visible to our staff. You can revoke it at any time from your Google or Microsoft account, and access ends immediately.

4. Who we share data with

We do not sell personal data. We share only with processors necessary to run the service:

• Hosting — our servers are in Europe
• Email verification — to check an address exists before sending, which reduces spam
• AI processing — to draft message text. Content is not used to train third-party models.
• Payment processing — we never see or store your full card details

We may also disclose data where legally required.

5. How long we keep it

• Account data — for as long as your account is open, then 30 days
• Campaign and sending records — 24 months, for deliverability and dispute handling
• Suppression list — permanently. This is deliberate: it is the only way to guarantee someone who opted out is never contacted again. It stores a one-way hash of the address, not the address itself.
• Audit logs — 24 months

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your data, and to receive it in a portable format. Exercise any of these through the data request form. We respond within 30 days and never charge a fee.

Customers can also export or delete their entire account from within the app, under More.

7. International transfers

Our infrastructure is in Europe. Where a processor operates outside your region, transfers are covered by Standard Contractual Clauses or an adequacy decision.

8. Children

This is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

9. Changes

If we make a material change we will update the date above and notify account holders by email before it takes effect.

10. Contact

Privacy questions: privacy@gosystmatk.com
Data requests: gosystmatk.com/data-request