We never sell your personal information, to anyone. Card payments go straight to Lemon Squeezy — we never see or store your card details. Sensitive credentials (SMTP, API keys) are encrypted at rest. AI features only send data to a provider when you've enabled them. You can access, export or delete your data at any time. Uploaded audience lists are processed only to run the campaigns you create.
Our Role: Controller vs Processor
Devlo plays two different privacy roles, depending on whose data is involved. This distinction matters for email marketing platforms specifically, so we call it out clearly:
For your own account data — your name, email, billing details and usage of the Service — we decide how and why it's processed, as described throughout this policy.
For the audience/contact lists you upload to send campaigns, you are the controller and we act only as a processor, on your instructions.
If you are a recipient of a campaign sent using Devlo and want to exercise a privacy right over your data (for example, to be removed from a list), please contact the sender directly — every campaign includes an unsubscribe link, and the sending account holder controls that list, not Devlo.
Information We Collect
| Category | Examples |
|---|---|
| Account information | Name, email address, username, password (encrypted), company name |
| Billing information | Subscription plan and billing history — payment card details are handled entirely by our payment processor, Lemon Squeezy; we do not store your card details |
| Content you provide | Uploaded audience/contact lists, campaign content, WordPress posts, social media designs, chat messages, uploaded files and images |
| Connected accounts | Credentials you provide to connect your own SMTP/email account, WordPress site, social media accounts, or optional AI provider key — stored encrypted and used only to perform the actions you request |
| Usage data | Log data, device/browser information, IP address, and how you interact with the Service, used to keep the Service secure and to improve it |
How We Use Information
- To provide, maintain, and improve the Service — necessary to perform our contract with you.
- To process subscriptions and billing through Lemon Squeezy — necessary to perform our contract with you.
- To send you transactional communications (e.g. welcome emails, account notifications) related to your account — necessary to perform our contract with you.
- To detect, prevent, and address technical issues, abuse, or violations of our Terms & Conditions — our legitimate interest in keeping the Service safe.
- To respond to support requests you send us — necessary to perform our contract with you.
- Where required, with your consent (for example, optional analytics cookies) — consent, which you can withdraw at any time.
AI Features
Certain features (such as AI-assisted content generation and the in-app AI Help Assistant) send the relevant text you provide to a third-party AI provider (Google Gemini) to generate a response. Where a feature is "bring-your-own-key", requests are made using your own API key and are subject to that provider's own data-handling terms — Devlo does not see or store the AI provider's replies beyond delivering them back to you.
International Transfers
Your information may be processed and stored in countries other than your own, including where our hosting and service providers operate. Where this involves transferring data out of the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism.
Data Retention
We retain your account data for as long as your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, tax, or accounting purposes.
Data Security
We use industry-standard measures to protect your data, including encryption of sensitive credentials (such as connected email and API account passwords) at rest. In the unlikely event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Your Rights
Depending on your location, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your personal data.
- Restriction & objection — limit or object to certain processing.
- Portability — receive your data in a structured, commonly-used format.
You can update most account information directly within the Service, or contact us at [email protected] to exercise these rights.
California Privacy Rights
If you are a California resident, the CCPA gives you the right to know what personal information we collect, request its deletion, and opt out of its "sale" — we do not sell personal information, so there is nothing to opt out of. To exercise any CCPA right, contact us at [email protected].
Cookies
| Type | Purpose |
|---|---|
| Essential | Keep you logged in and the Service functioning securely. Cannot be disabled. |
| Preference | Remember choices like light/dark mode. |
| Analytics (where used) | Understand how our public pages are used, in aggregate, to improve them. |
You can control or block cookies through your browser settings; blocking essential cookies may affect the Service's functionality.
Children's Privacy
The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page, and where appropriate, we'll notify you directly.
Contact
Questions about this Privacy Policy can be sent to [email protected].