Privacy Policy

1. Introduction

Van Moose BV (“we,” “our,” or “us”) operates Truncus, a transactional email infrastructure service (“Service”). This Privacy Policy describes how we collect, use, and protect your information when you use our Service.

We are committed to protecting your privacy and ensuring transparency in our data practices. This policy complies with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Information We Collect

2.1 Account Data

• Authentication: Email address and authentication data via Clerk
• Profile: Name (if provided), organization name
• Billing: Payment information processed by Stripe (we do not store card details)

2.2 Email Data

• Email Content: Subject, body, recipients of emails you send through our API
• Delivery Events: Delivery status, bounces, opens (if enabled), clicks (if enabled)
• Technical Data: IP addresses, timestamps, API request logs

2.3 Email Delivery Infrastructure

We use Amazon Web Services Simple Email Service (AWS SES) to deliver emails. Email content passes through AWS infrastructure, which may include servers located in the United States. AWS processes this data as our sub-processor under appropriate data protection agreements.

3. How We Use Your Information

We use collected information to:

• Provide the Service: Send emails on your behalf, track delivery status
• Manage Your Account: Authentication, billing, support
• Improve the Service: Analyze usage patterns, fix bugs, enhance features
• Security: Detect and prevent abuse, fraud, and security threats
• Legal Compliance: Comply with applicable laws and regulations

4. Legal Basis for Processing (GDPR)

We process your data based on the following legal grounds:

• Contract Performance: To provide the email services you have subscribed to
• Legitimate Interest: To improve our services, ensure security, and prevent abuse
• Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

5.1 Service Providers

• AWS SES: Email delivery infrastructure
• Clerk: Authentication services
• Stripe: Payment processing
• Vercel: Hosting and infrastructure
• Neon: Database hosting (EU region)

5.2 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights and safety.

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: Data encrypted in transit (HTTPS/TLS) and at rest
• Access Controls: Limited access to data on a need-to-know basis
• API Keys: Securely hashed, never stored in plain text

7. Data Retention

• Email Logs: Retained for 30 days
• Account Data: Retained while your account is active
• Billing Records: Retained as required by law (typically 7 years)

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at info@truncus.co.

9. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA), including the United States (via AWS SES). We ensure adequate protection through Standard Contractual Clauses and appropriate safeguards.

10. Cookies

This website uses essential cookies for authentication and functionality. We do not use tracking cookies for advertising purposes.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Supervisory Authority

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your personal data in accordance with applicable law.