Privacy Policy

Two roles, kept apart

NotifHQ handles personal data in two capacities and the difference decides which rights apply to whom.

For the people who administer a workspace — names, work email addresses, sign-in records, billing contacts — we are the controller, and this policy governs.

For the recipients your workspace sends to — their addresses, the contents of their messages, their delivery and preference records — we are a processor acting on your instructions. The customer whose workspace sent the message is the controller. The terms of that processing are the Data Processing Addendum, and a recipient exercising a right should approach that customer; we will assist them in doing so.

What we hold as controller

Account data: the name, email address and role of each person with access to a workspace, and the workspace's own name, plan and billing details.

Authentication data: sign-in times, the address a verification or sign-in link was sent to, and the fact of a session, held so that access can be audited and a compromised account recovered.

Operational data: API request metadata — endpoint, workspace, timing, outcome — used to run the service, enforce rate limits and investigate faults.

Why we are allowed to hold it

Performance of the contract, for the data needed to give you the service you bought.

Legitimate interests, for security, abuse prevention, and the operational measurements that keep the platform running — balanced against the interests of the people concerned and limited to what that purpose needs.

Legal obligation, for records we are required to keep, including billing records and the evidence that supports them.

How long we keep it

Retention is not a policy statement here; it is a configured window that a scheduled job enforces, and the windows differ by plan. The table below is generated from the same registry the job reads, so it cannot describe a window the platform does not apply.

What is kept beyond those windows

Configuration — workspaces, applications, API-key records, sending domains, webhook endpoints — is live state rather than a record of an event, and is kept while the workspace exists.

Audit and evidence records are kept for the window of their retention class, and are append-only for that time: they are the record of what the platform did, and a record that can be edited proves nothing.

Where it is held

The platform runs on Cloudflare. Data is stored in the United States. Where personal data originating in the United Kingdom or the European Economic Area is transferred there, the transfer is made under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses as applicable.

The service does not currently offer storage in another region, and does not claim to: a workspace cannot select one.

Who else sees it

Only the sub-processors listed on the sub-processors page, each for the purpose stated there. We do not sell personal data and we do not share it for anyone else's marketing.

We disclose data to a public authority only where we are legally compelled, and we will tell you unless we are prohibited from doing so.

Your rights

Where we are the controller you may ask for a copy of your data, ask us to correct or erase it, object to or restrict processing, and ask for it in a portable form. Write to the privacy address below and we will answer within one month.

You may also complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office.

Security

How the platform is built to protect this data — isolation between workspaces, credential handling, encryption, and what happens when something goes wrong — is set out on the security page.

Contact

Privacy questions and rights requests: privacy@notifhq.com. Anything else legal: legal@notifhq.com.