Privacy Policy
Last updated
1.Who we are and what this covers
Ballast (ballast.to) runs the Ballast website and app. For the people this policy covers, we decide how their data is used (we are the "controller"). Write to contact@ballast.to about anything in it.
- people with a Ballast account, and people invited to a workspace;
- visitors of ballast.to, including people who use the free domain checker;
- people who write to us.
If you received an email sent through Ballast: the company that wrote to you decides what happens with your data, not us. We process it for them under our Data Processing Agreement. Use the unsubscribe option in the email, or reply asking to be removed. If that doesn't work, write to contact@ballast.to with the sender's name and we pass your request on and help them act on it.
2.What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a hash), Google profile name and picture if you sign in with Google | You |
| Workspace | Workspace name, members and roles, settings, onboarding answers (sending domain, expected volume, offer profile) | You and your team |
| Billing | Plan, subscription status, Dodo Payments customer ID. Card details never reach us: Dodo Payments holds them | Dodo Payments |
| Security and logs | IP address and browser of each sign-in session, API key and connected app activity, error reports | Your device |
| Messages to us | What you write and your email address | You |
| Domain checker | The domain you check, stored with its result and a salted hash of your IP address. The raw IP is used only in memory, for the rate limit | You |
3.Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and workspaces, sending account emails (verification, password resets, invites, alerts about your mailboxes and campaigns) | Contract |
| Billing, through Dodo Payments | Contract, and legal obligation for tax records |
| Keeping Ballast secure: stopping abuse, fixing errors, enforcing the Acceptable Use Policy | Legitimate interest |
| Telling you about important changes to the service or these documents | Contract and legitimate interest |
| Counting website visits without cookies (Plausible and Google Analytics, on the public website only) | Legitimate interest |
| Answering your messages | Legitimate interest, or contract if you are a customer |
4.What we never do
- We don't sell or rent personal data, or the leads and copy in your workspace.
- We don't use your data for advertising, and there are no advertising or tracking cookies on our site.
- We don't train AI models on your data, and the AI providers we use don't either.
- We don't send marketing email to the leads you upload, or contact them for any reason of our own.
6.Where it is stored
Ballast's servers, database and backups are in the EU. AI features use OpenAI and Google, which process requests in the United States under the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. They receive only what an AI request needs, and only when someone uses one of those features. Clicks on a customer's link domain are served by Cloudflare from the location nearest the visitor. Visits to our public website are also counted by Google Analytics, which processes them in the United States under the EU-US Data Privacy Framework.
7.How long we keep it
| Data | Kept for |
|---|---|
| Account and workspace data | While the account or workspace exists, then deleted within 30 days of closing |
| Backups | 30 days, then overwritten |
| Sign-in sessions | Until you sign out or the session expires |
| Webhook delivery logs | 30 days |
| Website visit statistics in Google Analytics | 2 months (the shortest setting Google offers), then deleted by Google |
| Domain checker results | Kept so shared result links keep working. The IP hash stored with them can't be turned back into an address without our secret salt |
| Billing records | As long as tax law requires (kept by Dodo Payments) |
| Messages to us | As long as needed to answer, and for the life of your account if you are a customer |
8.Your rights
You can ask to see, correct, export or delete your personal data, to restrict how we use it, or object to a use based on legitimate interest. Write to contact@ballast.to from the address on your account. We answer within one month.
You can also complain to the data protection authority where you live or work. We'd like the chance to fix it first.
10.Security
- All traffic is encrypted with TLS.
- Mailbox passwords and access tokens are encrypted with AES-256-GCM before they are stored, and are never shown again or written to logs.
- Passwords and API keys are stored only as hashes.
- Every workspace's data is kept apart, and each member only gets what their role allows.
- Disks and backups are encrypted at rest by our hosting provider.
11.Children
Ballast is a business tool for adults. We do not knowingly collect data from anyone under 18.
12.Changes
When this policy changes in a way that matters, we email account owners before the change applies. The date at the top always shows the latest version.