PostFend Privacy Policy

Privacy Policy of 2758188 Alberta Ltd., operating as PostFend.

Version 1.0 | Effective 11 November 2026 | URL: https://postfend.com/privacy

1. Who we are

2758188 Alberta Ltd., operating as PostFend ("PostFend", "we"). Contact us at [email protected]. This Policy covers the PostFend service, the website postfend.com and the PostFend Android app (package com.postfend.app); app-specific practices are in s.19.

This Policy explains how we handle personal information under the following laws:

• Alberta's Personal Information Protection Act ("PIPA");
• the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), where it applies, for example to information that crosses provincial or national borders; and
• for individuals in the EEA, UK or Switzerland, the GDPR, UK GDPR or Swiss law (s.15).

2. Our two roles

PostFend is sold to both Business Customers and Consumers, as those terms are used in the Terms of Service.

• Account, billing, website and marketing information. We decide how this is used. We are the responsible organization or "controller". This applies to every customer.
• Email we filter for a Business Customer. The Business Customer is the controller. We process that email on its behalf under the Data Processing Agreement (https://postfend.com/dpa), and we act as service provider or "processor". Your employer or the organization that runs your mailbox is responsible for telling you about it and for answering requests about it. We help them.
• Email we filter for a Consumer. For a Consumer (an individual who uses the Service mainly for personal, family or household purposes, including to protect their own mailbox), we are responsible for the filtered email as well. The Privacy Policy covers that data. The DPA does not apply to Consumers.

3. What we collect

We use only essential cookies to run the website and the dashboard. We do not use analytics, advertising or other non-essential cookies, and we do not show a cookie-consent banner. The Cookie Policy at https://postfend.com/cookies lists the essential cookies, how long they last, and how you can delete them in your browser.

4. Why we use it

We use personal information only for these purposes:

• (a) to filter, quarantine, deliver and report on email;
• (b) to protect the Service, our customers and the email ecosystem from spam, malware, fraud and abuse, including keeping reputation data about sending infrastructure;
• (c) to provide support;
• (d) to bill you and keep business and tax records;
• (e) to send service and legal notices;
• (f) to send marketing, but only with consent under Canada's Anti-Spam Legislation (CASL); and
• (g) to comply with the law.

5. What we never do

• We never sell personal information.
• We never use email content for advertising or profiling.
• We never train machine-learning models on your email content without your explicit opt-in. You can withdraw an opt-in at any time.
• Staff never read your email except at your request, to investigate a security incident or abuse, or when the law requires it. Every access is logged.

6. Consent

By subscribing, you consent to the collection, use and disclosure described here for the stated purposes. You may withdraw consent on reasonable notice, subject to legal and contractual limits. Because filtering requires processing email, withdrawing consent to filtering means ending the Service.

7. Service providers, and storage outside Canada

We use service providers to run PostFend. The current list, with locations, is at https://postfend.com/subprocessors and in the Data Processing Agreement Annex III. In summary:

• OVHcloud hosts the mail filter (server mx1) in Beauharnois, Québec, Canada, and hosts the website chat service on a separate OVH VPS in Canada. Push notifications are sent from our own server at push.postfend.com, also in Canada. We do not use Google Firebase or another third-party push service. We have not confirmed from a public OVHcloud page whether OVH support staff may access systems from outside Canada.
• ChemiCloud hosts the static website. ChemiCloud's published server list identifies 148.113.190.198 as its Montreal, Canada web-hosting address (chemicloud.com/server-locations), and that address appears in PostFend's SPF record for mail sent from the website host. We therefore treat the website as hosted in Montreal, Canada. ChemiCloud also operates data centres in the United States and other countries. We have not independently confirmed that no ChemiCloud account, billing or support data is processed outside Canada, so some of that data may be processed in the United States or other countries where ChemiCloud operates.
• Stripe processes payments. Stripe's Privacy Policy (last updated 28 April 2026, stripe.com/privacy) states that when Stripe collects personal data belonging to Canadian residents, it transfers that data to data centres in the United States, and that Stripe's service providers may also be located outside Canada. Stripe's Data Processing Agreement (stripe.com/legal/dpa) likewise states that users transfer personal data to Stripe, LLC in the United States.

We do not use a separate transactional-email vendor, support-desk vendor or analytics service. Service messages and support mail are sent by us from our own systems (the website host or mx1).

Notice under PIPA s.13.1: some of our service providers collect, use, store or access personal information outside Canada, in particular in the United States (Stripe, and possibly ChemiCloud account or support systems). While it is outside Canada, it may be accessed by the courts, law enforcement and national security authorities of those countries under their laws.

You may ask our Privacy Officer (s.13) about our policies and practices for service providers outside Canada. You may also ask how they collect, use, disclose or store personal information for us.

Where your data is stored: filtered email, quarantine, account data and app data are stored on our servers in Beauharnois, Québec, Canada (OVHcloud). The static website is hosted by ChemiCloud in Montreal, Canada, as described above. Payment data is processed by Stripe in the United States. The website chat runs on a separate OVH VPS in Canada (s.20).

8. How long we keep it

We delete or anonymize information when it is no longer needed for its purpose or for a legal requirement.

9. Safeguards

• Encryption in transit (TLS) and at rest, including backups.
• Each customer's data is kept separate from other customers' data.
• Multi-factor authentication and least-privilege access for staff.
• Logging of all staff access.
• Vulnerability management and secure development.
• Confidentiality agreements and training for staff.
• Security reviews of our vendors.

10. Security breaches

• PIPA: if a loss of, or unauthorized access to or disclosure of, personal information in our control creates a real risk of significant harm, we notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay. We notify affected individuals as PIPA and the Commissioner require.
• PIPEDA: where it applies, we report breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada. We notify affected individuals, and any organization that can reduce the harm, as soon as feasible. We keep a record of every breach of security safeguards for at least 24 months, as the Breach of Security Safeguards Regulations require.
• GDPR/UK GDPR: where we are controller, we notify the competent supervisory authority within 72 hours where required. Where we are processor, we notify our customer without undue delay (DPA s.8).
• Business customers are notified as set out in the DPA.

11. Your rights

• You may ask for access to your personal information, for information about how we used it and who we disclosed it to, and for corrections.
• We respond within the legal time limits: 45 days under PIPA and 30 days under PIPEDA, extendable only as the law allows. We aim to meet the shorter limit.
• If your request is about email processed for an organization, we pass it to that organization and help it respond.
• Requests are free unless the law allows a minimal fee. We will tell you about any fee in advance.

12. Complaints

Please contact us first. You may also complain to:

• the Office of the Information and Privacy Commissioner of Alberta (https://oipc.ab.ca); or
• the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca).

13. Privacy Officer

Privacy Officer, 2758188 Alberta Ltd. Contact the Privacy Officer at [email protected].

14. Children

PostFend is not directed to children. We do not knowingly collect personal information from children under 18, or under the age of majority in their province or territory if that is higher, except as incidental content of email filtered for an authorized customer.

15. Individuals in the EEA, UK and Switzerland

PostFend is operated from Alberta, Canada, and is not at present marketed as a service directed at the EEA, the UK or Switzerland. We have not appointed an EU or UK representative under GDPR Article 27 or the UK equivalent. If you are in the EEA, the UK or Switzerland and use the Service anyway, this section describes how we approach those laws, in addition to the rest of this Policy.

• Roles. We are controller for account, billing, website and marketing data, and for email we filter for a Consumer. We are processor for email filtered for a Business Customer (DPA).
• Legal bases (Art. 6 GDPR), where that law applies:
• performance of a contract (providing the Service);
• legitimate interests (security, anti-abuse, improving filtering with non-content signals, and defending legal claims);
• legal obligation (tax and record-keeping); and
• consent (marketing and any ML-training opt-in), which you may withdraw at any time. We do not use non-essential cookies.
• Transfers. Canada has an EU adequacy decision covering organizations subject to PIPEDA, and the UK recognizes Canada for the same scope. Counsel should confirm that this covers PostFend in a given case. Transfers to other countries, such as payment processing by Stripe in the United States, rely on the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, plus supplementary measures, where required. Copies are available on request.
• Your rights. You have rights of access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), data portability, and withdrawal of consent. You may also lodge a complaint with your supervisory authority.
• Representatives. We have not appointed an EU or UK Article 27 representative, because we are not targeting those markets at launch. Contact us at [email protected].
• No automated decisions with legal effects. Spam classification is automated, but it does not produce legal or similarly significant effects on individuals. You can always release a quarantined message or ask for human review.

16. United States residents

PostFend is not at present marketed as a US-only or US-directed product, but US residents may use the Service.

• We do not sell personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are used in US state privacy laws.
• For Business Customers we act as a service provider or processor. For Consumers we are the controller of the email we filter for them, as well as of their account data.
• Residents of states with comprehensive privacy laws may have rights to access, delete, correct and port their information, and to appeal our decision. Contact [email protected].

17. Québec

Some personal information is hosted in Québec (the mail filter is in Beauharnois). Where Québec's Act respecting the protection of personal information in the private sector applies, we will comply with it, including, where required, assessing privacy risks before personal information is communicated outside Québec. The person in charge of the protection of personal information can be reached at [email protected].

18. Changes

We post each version with its effective date at https://postfend.com/privacy and notify customers of material changes by email. When a material change affects the PostFend app, the app shows the updated notice the next time you open it and asks you to acknowledge it before continuing (see s.19.11).

19. The PostFend Android app

The PostFend app (com.postfend.app) lets authorized administrators of PostFend customer accounts ("Admins") view spam statistics, preview and release quarantined messages, manage allow and block lists, and import sender lists. It contains no analytics, advertising, tracking or crash-reporting software development kits (SDKs). Everything the app sends goes over TLS-encrypted connections to our own servers in Canada.

19.1 Account and sign-in

To sign in, you enter your email address and password, then a two-factor authentication (2FA) code. We use them only to authenticate you and protect your account. Your password is never stored on the device. After sign-in, the app receives a session token, which is stored encrypted on the device (s.19.7). We record sign-in events (time, IP address, device model and app version) to secure the account and detect misuse.

19.2 Email data you view and act on

Quarantine previews, sender addresses, subject lines and message contents are personal information of the senders and recipients. They belong to the customer organization that runs the mailboxes, and we handle them on its behalf (s.2 and the DPA).

• Viewing: the app downloads the message you open for display only. Previews are kept in memory and are not saved to the device's storage. The app blocks screenshots and screen recording of quarantine screens, and hides them in the recent-apps view.
• Acting: when you release, delete, allow or block, the app sends your instruction (the message identifier, the sender address or domain, and the action) to our servers. Every action is recorded in the customer's audit log, with your user ID and the time.

19.3 Push notifications and ntfy topics

If you allow notifications, the app subscribes to a private notification channel ("topic") on our self-hosted ntfy server at push.postfend.com. The topic name is a random identifier assigned to your device, and access to it requires your account's credentials. Our server stores the topic name, your user ID, a device label (device model and app version) and the time of subscription, so that it knows where to send alerts.

• Notifications contain only short alerts, such as "3 new messages held for review" or service and security notices. They never contain message content, subject lines or sender addresses.
• We do not use Google Firebase Cloud Messaging or any other third-party push provider, and our ntfy server does not forward topics to any outside service.
• To stop notifications, turn them off in the app or in Android settings, or sign out. Signing out deletes the topic from our server.

19.4 Background check (every 15 minutes)

While you are signed in with notifications on, Android runs a short background task about every 15 minutes (Android decides the exact timing). The task asks our servers whether there are new held messages or alerts. It sends only your session token, the topic identifier and the app version. It does not read anything else on your device, and it uses no location. You can turn it off in Settings → Notifications → Background check, or by revoking the notification permission.

19.5 Biometric unlock (optional)

You may turn on fingerprint or face unlock. It uses Android's built-in BiometricPrompt.

• The app never receives, stores or transmits your fingerprint, face or other biometric data. Android checks your biometric on the device and tells the app only whether the check succeeded.
• A successful check unlocks a key held in the device's hardware-backed Android Keystore, which then decrypts your session on the device.
• We do not learn which biometric you used.
• You can turn biometric unlock off at any time. Your password and 2FA always remain available.

19.6 CSV imports

You may import a CSV file of sender addresses or domains for your allow or block lists. You choose the file with Android's file picker. The app gets no general access to your storage, and asks for no storage permission.

• The app reads the file on the device and uploads only the parsed entries (addresses or domains, list type and optional notes) to your organization's lists.
• The original file is not uploaded or kept by us.
• Imported entries are kept until you or another Admin removes them, or until the customer account is closed.
• Import only lists you are authorized to use.

19.7 Local storage and encryption

The app stores on your device:

• your session token and settings, encrypted with a key in the Android Keystore;
• your notification preferences and topic identifier; and
• short-lived cached statistics (counts and charts, not message content).

The app's data is excluded from Android cloud backup and device-to-device transfer. Signing out, or using Settings → Clear local data, deletes it all. Uninstalling the app deletes it as well.

19.8 Device data

We collect only what is needed to run and secure the app: device model, Android version, app version, a random install identifier, the ntfy topic identifier, IP address and the times of requests.

• We do not collect advertising IDs, IMEI or phone numbers, or the list of other apps on your device.
• We do not access location, contacts, camera, microphone, SMS or call logs.
• We do not use IP addresses to determine your location.

19.9 Crash logs and analytics

The app does not include crash reporting or analytics, and sends no crash logs or usage analytics. If you choose to send a diagnostic report to support, we tell you exactly what it contains before you send it. If we ever add crash reporting, we will update this Policy and the app's store listing first, and ask for your consent where the law requires it.

19.10 Retention and deleting your app account

• Your Admin account and app data: you can delete your Admin account in the app (Settings → Account → Delete account) or at https://postfend.com/delete-account. When we delete it, we delete within 30 days your profile, credentials and 2FA secrets, device registrations, ntfy topics and sessions. Your local app data is deleted when you sign out or uninstall.
• What we keep, and why:
• Audit-log entries of actions you took are kept for 2 years for security and the customer's compliance. After your account is deleted, they are linked to a pseudonymous identifier instead of your name and email.
• Records we must keep by law, such as billing, tax and consent records, are kept for the periods in s.8.
• Backups are overwritten within 35 days.
• Your organization's mailbox data is separate. Quarantined mail, logs, lists and settings belong to the customer organization. Deleting one Admin's account does not delete them. They are deleted when the organization closes its subscription (Terms s.18), or on its instructions under the DPA. If you are the organization's only owner, you must first transfer ownership to another Admin, or close the subscription. The app and the web page explain how.

19.11 Updates to this Policy in the app

The app records which version of this Policy and the Terms you acknowledged, and when. If a new version makes material changes, the app shows a summary and links to the full text, and asks you to acknowledge it before you continue.

19.12 Pilot (test) versions

Pilot versions of the app installed outside Google Play follow this Policy. They may also send diagnostic information that you choose to share with support, as described in s.19.9.

20. The website chat assistant

The PostFend website may offer a chat assistant, labelled as an automated assistant, so that you can ask questions about the Service.

Today the chat is not connected to a third-party language service. It runs on PostFend's own OVH VPS in Canada and answers from our public website text. Answers can be incomplete, so please confirm important details with us at [email protected].

What we collect, and why. While you are chatting, your questions are used only to find an answer from our own pages. We do not store the chat on our servers unless you choose to send it to us. If you submit a form from the chat, we receive the name and contact details you enter, your consent, and a copy of the transcript, so that we can reply to your question. That message is handled like our other website enquiries. Please do not paste passwords, payment-card numbers, health information, or other sensitive personal information into the chat.

How long we keep it. An unsaved chat stays only in your browser and is not kept on our servers. If you send us a lead, we keep that email with our other support and enquiry mail.

If we later add a third-party language service. We may in future use a third-party provider, Amazon Web Services (AWS) Bedrock, in a Canadian region, solely to help draft answers from our public website text. That is not in use today. Before it is used, we will update this Policy and the subprocessor list at https://postfend.com/subprocessors, and we will give notice.