Privacy Policy

This policy explains what MastroSDR collects, why, and what you can do about it. It covers the MastroSDR application and marketing site.

Who we are

MastroSDR is operated by That Fellow Digital LLC. Where this policy says "we", it means that company.

You can write to us at:

26 Colonial Drive, New City, NY 10956

Who is responsible for what

For your own account information, we are the data controller. For the prospect data you upload and the emails you generate, you are the controller and we are your processor: we handle it on your instructions. See our Data Processing Addendum for those terms.

What we collect

• Account data. Name, email address, hashed password, workspace name and role.
• Prospect data you upload. Company name, contact name, email address, website and location.
• Content you generate. Your pitch text and the email drafts produced from it.
• Delivery events. Whether a message was delivered, opened, bounced or reported as spam.
• Integration keys. API keys you connect, encrypted at rest with AES-256-GCM.
• Security logs. IP address, user agent and timestamps for sign-ins and sensitive actions.
• Website analytics. Page views, IP address and browser user agent for visits to our marketing site, and which advertisement a visitor arrived from. Covered in full below.

What we do not do

• We do not sell personal data.
• We do not use your prospect data or pitch to train any model.
• We do not share one workspace's data with another, ever.
• We do not run advertising or ad-network tracking on the application. Meta's advertising pixel loads on our marketing pages only and is never present on any signed-in screen. See website visitors below.
• We do not record your screen. Session replay is switched off in our own code, not merely unused, so no prospect name, draft or reply is ever captured by an analytics provider.

Why we process it

To provide the service you asked for (contract), to keep it secure and prevent abuse (legitimate interests), to bill you (contract), and to meet legal obligations such as anti-spam and tax rules.

Where it goes

Your prompts and prospect details are sent to an AI provider, purely to generate the email you asked for. Which account that runs through depends on how you have set things up:

• Your own key connected, for the provider selected under Model in Settings. Everything goes through your provider account, under your key, and we never see the content. Settings always names which account is actually in use, because connecting a key for a provider you have not selected leaves the selected one still in charge.
• Using the AI drafts included with a paid plan. Those run through our provider account, because that is what the included credits are. The provider processes the content to generate the email and nothing more; we do not use it to train anything, and connecting your own key opts out entirely.
• A self-hosted or local model. Nothing leaves the machine you point us at.

Outbound email is handled by your connected delivery provider. Payments run through Stripe; we never see your card number. The full list is on our subprocessors page.

Website visitors and advertising

This section is about people browsing MastroSDR, not about the data inside a workspace. Nothing described here touches prospects, drafts, replies or your pitch.

• PostHog tells us which screens are used and where people get stuck. It runs on the marketing site and inside the application, and its requests are served through our own domain rather than a third-party one. Session recording is disabled in our code, so it captures page views and feature usage and never screen contents.
• Meta measures our advertising. Its script runs on our marketing pages only and is never loaded on a signed-in screen. It sets cookies that let Meta connect an advertisement you saw to a visit here. When someone creates an account after arriving from one of our ads, our server tells Meta that a sign-up happened and sends a one-way hash of the email address so the two can be matched. We do not send the address itself, and we send nothing else about the account.

You can refuse both. A browser set to block third-party cookies, or any content blocker, stops them, and nothing about MastroSDR works differently as a result. Under California law, using advertising cookies this way may count as "sharing" personal information for cross-context behavioural advertising; email privacy@mastrosdr.com to opt out and we will exclude you.

Both providers are named on our subprocessors page.

How long we keep it

• Account and workspace data: while your account is open.
• Prospect and message data: until you delete it, or 30 days after account closure.
• Proof of what was sent: when an email goes out, the audit log records the recipient address, the subject and the time. That entry is kept for 12 months even if you later delete the prospect, because it is the only record that can answer a complaint about an email you sent.
• Suppression list entries: kept for the life of the workspace and not removable by anyone in it, because deleting them would let someone who opted out be contacted again. They go when the workspace is closed, with the rest of its data.
• Security and audit logs: 12 months.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete or restrict processing of your personal data, and to object to it. Email privacy@mastrosdr.com and we will respond within 30 days. You can also complain to your local data protection authority.

If you received an email sent through MastroSDR and want your data removed, use the unsubscribe link in that email or contact the sender directly. They control that data; we process it for them.

Security

Passwords are hashed. Integration keys are encrypted at rest and never displayed again after you save them. API keys are stored only as hashes. Access is scoped to a single workspace at every layer. More detail is on our security page.

Children

MastroSDR is a business tool and is not directed at anyone under 16.

Changes

If we change this policy materially, we will email account owners before it takes effect.

Contact

privacy@mastrosdr.com