#Data Processing Addendum
Last updated: November 9, 2026
Parties: Postra LLC (“Postra”, “Service Provider”) and the Organization customer that accepts the Terms of Use (“Customer”, “Business”).
This Data Processing Addendum (“DPA”) is part of the Terms of Use (the “Principal Agreement”). It covers Customer Content on an Organization’s custom domains: mail and related content the Customer puts through Postra for its own users and domains.
It does not cover Account Data or mailboxes on domains Postra operates (including @postra.so). For those, Postra is the business under the Privacy Policy.
You can sign a separate copy if your counsel wants wet ink or e-signature.
#1. Roles
1.1 Customer is the business (and, where non-US privacy law uses the term, the controller) of personal information in Customer Content. Postra is the service provider (and, where that law uses the term, the processor) for that content.
1.2 Postra remains an independent business for Account Data under the Privacy Policy. This DPA does not govern that processing.
1.3 Schedule 1 describes the processing. Schedule 2 summarizes security measures. Schedule 3 covers transfer tools only when Customer’s applicable non-US law requires them. Schedule 4 describes export tools.
#2. Customer instructions
2.1 Postra will process Customer Content only to provide the Service under the Principal Agreement and Customer’s documented instructions (including settings, APIs, and configuration in the product), unless US law or another law that applies to Postra requires otherwise. Where legally allowed, we will tell Customer before that kind of processing.
2.2 Customer is responsible for the lawfulness of its instructions and for any notices or consents its end users need.
#3. Confidentiality
People who may access Customer Content for Postra are under confidentiality duties. Staff access limits are in the Terms of Use.
#4. Security
Postra will use reasonable technical and organizational measures appropriate to the nature of the Service and the risk to individuals. A summary is in Schedule 2 and on Security. We may update measures if the overall level of protection is not reduced.
#5. Service providers and vendors
5.1 Customer authorizes Postra to use the vendors listed on Vendors to help run the Service. Postra will flow down protections no less protective than this DPA where those vendors process Customer Content on our behalf.
5.2 We will update that page when we add a new vendor that processes Customer Content for Customer. Customer may object on reasonable privacy or security grounds within 14 days of notice. If we cannot resolve the objection, Customer may terminate the affected Service as its sole remedy.
5.3 Systems Postra operates itself are not third-party vendors under this section.
#6. Where data is processed
Postra is a Wyoming LLC. Customer Content may be processed in the United States and in other countries where Postra or its vendors operate (see Vendors). If Customer’s applicable non-US law requires a specific transfer tool for Customer Content, Schedule 3 applies.
#7. US state privacy (service provider)
Where Customer is a “business” under the CCPA / CPRA or a similar US state privacy law, and Postra processes personal information in Customer Content as a “service provider” or “processor” for that business:
7.1 Postra will process that information only for the business purposes of providing the Service and Customer’s documented instructions, not for Postra’s own commercial purposes outside those instructions.
7.2 Postra will not sell that information, share it for cross-context behavioural advertising, or combine it with personal information from other sources except as a service provider may (for example security, or as otherwise allowed by law and this DPA).
7.3 Postra will require vendors that process Customer Content to meet obligations no less protective than this section, and will help Customer with consumer requests as described in Section 8, using the export tools in Section 10 where relevant.
7.4 On Customer’s written request, Postra will delete or return Customer Content as described in Section 10, except where retention is required by law.
#8. Help with individual requests
Taking into account how the Service works, Postra will give Customer reasonable assistance with requests from individuals about Customer Content, with security incidents, and with risk assessments Customer must run under laws that apply to Customer.
Customer answers those individuals. Postra will not respond substantively about Customer Content except on Customer’s instruction or as required by law.
Self-service export tools in Section 10 and Schedule 4 are the main way Customer retrieves Customer Content for access or portability. Help beyond those tools is limited to what is reasonably practicable.
#9. Security incidents
Postra will notify Customer without undue delay after becoming aware of a security incident that affects Customer Content, with information reasonably available to help Customer meet its own notice duties. Notice under this section is not an admission of fault.
#10. Return, export, and deletion
10.1 When the Service ends, or earlier on written request, Postra will delete or return Customer Content (at Customer’s election, where return is feasible) within the periods in the Privacy Policy (deletion from active systems within 60 days), except where law requires retention or a narrow security or abuse hold applies.
10.2 During the term, Organization admins may export Customer Content through domain export tools. Exports are ZIP archives per mailbox. Admins pick mailboxes and a date range.
10.3 Export limits. Each request covers at most 31 consecutive calendar days per mailbox. Successive requests are allowed. Postra may rate-limit, queue, and cap concurrency to keep the platform stable. Those limits define how return and portability work in the product; they do not erase rights Customer has under applicable law.
10.4 Schedule 4 summarizes the export tools. Operational details may change if the substance of this section stays.
#11. Reviews
On reasonable written request, and no more than once per twelve months (unless a documented security incident or a regulator that oversees Customer requires earlier review), Postra will provide information reasonably needed to show compliance with this DPA: security summaries, questionnaires, or third-party reports under confidentiality. On-site audits need mutual agreement on scope, timing, and confidentiality, and are at Customer’s expense unless a material breach of this DPA is found.
#12. Liability
Liability under this DPA follows the limits, force majeure, and mandatory carve-outs in the Principal Agreement (Disclaimers, Liability, and Force majeure in the Terms). Nothing here excludes liability that cannot lawfully be limited. Force majeure may excuse delayed processing during an infrastructure failure; it does not remove the duty to notify under Section 9 when that duty still applies.
#13. Order of precedence
If this DPA conflicts with the Principal Agreement or Privacy Policy about Customer Content on custom domains, this DPA wins. The Privacy Policy wins for Postra’s own Account Data and Postra-operated mailboxes.
#14. Term
This DPA lasts for the term of the Principal Agreement and survives as needed to delete or return Customer Content.
#15. Non-US privacy laws
Postra does not geo-block customers outside the United States. If Customer is subject to non-US privacy law (for example the EU GDPR, UK GDPR, or Swiss FADP) for Customer Content, then for that content:
15.1 The roles in Section 1 apply using that law’s controller / processor vocabulary where needed.
15.2 Postra will process only on documented instructions as in Section 2, keep appropriate security as in Section 4 and Schedule 2, use vendors as in Section 5, assist with individual rights and incidents as in Sections 8 and 9, and delete or return as in Section 10.
15.3 Transfer tools, if that law requires them for a restricted transfer, are in Schedule 3.
15.4 Nothing in this Section 15 expands Postra’s liability beyond Section 12 and the Principal Agreement, except where that non-US law forbids a limit.
#Schedule 1 — Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosted email and related Service features for Customer’s custom domains (not Postra-operated domains such as @postra.so) |
| Duration | Term of the Principal Agreement plus deletion or return |
| Nature and purpose | Hosting, transmission, storage, indexing, filtering, categorisation, backup, and support of Customer Content as instructed through the Service |
| Types of personal information | Email content and metadata, attachments, contact details in mail, mailbox identifiers, domain configuration; sensitive content only if Customer or correspondents put it there (Customer remains responsible for its lawful basis) |
| Whose information | Customer’s users, employees, contractors, customers, and other correspondents whose data appears in Customer Content |
| Frequency | Continuous while Customer uses the Service |
#Schedule 2 — Security measures (summary)
- Encryption in transit on public networks
- Encryption at rest via encrypted block volumes for databases, mail metadata, and object storage (no per-message OpenPGP EAR in the mail server; see Security)
- Access controls, authentication, and least-privilege admin
- Abuse-prevention controls (challenges, velocity limits)
- Sanitisation of untrusted HTML email and remote-image proxying
- Security logging and monitoring
- Restricted backups (encrypted when retained; rotated on schedule)
- Vendor diligence and contractual controls
- Confidentiality duties for personnel
#Schedule 3 — Non-US transfer tools (when required)
This schedule applies only when Customer’s applicable non-US law requires a transfer mechanism for Customer Content moving to a country without an adequacy finding (or equivalent).
In that case the parties will use the then-current EU Standard Contractual Clauses (processor modules), UK IDTA or UK Addendum, and/or Swiss-approved clauses, as applicable, with Postra as data importer where that role fits.
On request. Signed packs with completed modules and annex tables are available at [email protected]. Until a signed pack is executed, this Schedule 3 records agreement to use those standard clauses when the law requires them.
#Schedule 4 — Customer Content export
| Item | Description |
|---|---|
| Purpose | Let Customer retrieve Customer Content for its own use, including individual access or portability requests and migration or archive |
| Who may start | Authenticated Organization admins with authority over the domain (manager or above) |
| Interface | Domain admin export tools (mailbox list and date range) |
| Scope per request | One mailbox at a time |
| Format | ZIP on request: branded PDF notice, .mbox for the range, JSON metadata (and, if linked, product analytics events for that identity over the range) |
| Max range | 31 consecutive calendar days |
| More ranges | Successive requests allowed, subject to rate limits |
| Finished ZIP | Not kept as a standing copy after delivery |
| Stability | Rate limits, queuing, concurrency caps to protect the Service |
#Acceptance
By accepting the Terms of Use as an Organization, or by signing a separate copy of this DPA, Customer agrees to this DPA.
Postra LLC
Wyoming Filing ID: 2026-002122423
30 N Gould St, STE R, Sheridan, WY 82801, United States
[email protected] | [email protected]