This DPA governs how ColdRelay LLC, which operates NuMail (“NuMail”), processes personal data on your behalf when you use the platform to run cold-email infrastructure. It forms part of, and is incorporated into, the NuMail Terms of Service.
You decide which contacts to email, what data to upload, and why. That makes you the controller of the personal data in your workspace. NuMail processes that data only to deliver the service to you (sending through your connected mailboxes, detecting replies, drafting responses, and reporting analytics), which makes us your processor.
Determine the purposes and means of processing. Responsible for having a lawful basis to contact each recipient and for honoring opt-outs.
Processes personal data solely on your documented instructions to operate the platform, and never for our own marketing or to build cross-customer profiles.
For agencies on the Agency tier, you act as processor toward your own end-clients, and NuMail acts as your sub-processor. The same obligations in this DPA flow down to those sub-workspaces.
Your documented instructions are: (a) this DPA, (b) the Terms of Service, and (c) the configuration and actions you take inside the product or via the REST API and MCP server: connecting a mailbox, launching a campaign, generating an AI draft, exporting a report. We process personal data only to provide, secure, and support those functions.
If a law we're subject to requires us to process beyond your instructions, we'll tell you before doing so unless that law forbids the notice. If we believe an instruction infringes data-protection law, we'll inform you and may pause the relevant processing.
You give general authorization for NuMail to engage sub-processors to deliver the service. Each is bound by data-protection terms no less protective than this DPA. The list below is complete: these are all of the sub-processors that handle personal data for the service today.
Connected mailbox providers (Gmail, Microsoft, your own SMTP) are sub-processors only to the extent NuMail routes data through them on your behalf; your underlying mailbox relationship is your own. A workspace that adds its own AI provider key sends its AI requests to that provider under its own account. Services that only ever receive domain names (public DNS resolvers) receive no personal data and are not listed; a domain-availability check sends the registrar the name alone, and an order sends it the registrant contact. Customers can request the dated sub-processor list at any time by emailing the address in §11, and can subscribe to change notices.
We'll give at least 30 days' notice before adding or replacing a sub-processor that handles personal data. If you reasonably object on data-protection grounds, you may raise it within that window; if we can't address it, you may terminate the affected service without penalty for the remaining prepaid term.
We maintain measures appropriate to the risk (GDPR Art. 32), reviewed as the platform evolves. At a minimum:
TLS 1.2+ on every connection: browser, API, webhooks, and provider calls. HSTS enforced.
Database storage and backups encrypted with AES-256 by our database provider. Mailbox credentials (OAuth refresh tokens, SMTP and IMAP passwords) and workspace AI keys are also encrypted by the application with AES-256-GCM before they are stored.
Role-based access in every workspace (owner, admin, editor, viewer). API keys are scoped to one workspace, stored only as hashes, and can be rolled or revoked anytime. Staff support access is a logged session.
Every query is scoped to a workspace. AI drafting runs per workspace, and the warmup pool exchanges only system-generated messages, never your campaign content or leads.
An audit log records sensitive actions (mailbox connections and removals, team and role changes, API keys, exports, support sessions) with actor, time, and source.
Point-in-time database recovery from our database provider, and sends claimed in the database so a retried job never sends the same email twice.
Personnel with access are bound by confidentiality obligations that survive the end of their engagement. Security changes only ever raise the bar; we will not materially weaken these measures during your term.
Because you're the controller, requests from data subjects (access, rectification, erasure, restriction, portability, objection) come to you. NuMail provides the tooling and assistance to honor them.
If a data subject contacts NuMail directly about your data, we'll forward the request to you and won't respond on the substance ourselves unless legally required.
On becoming aware of a personal-data breach affecting data we process for you, NuMail will notify you without undue delay. Our target is notice within 72 hours of confirmation, giving you the runway to meet your own regulator deadlines.
The notice will include, to the extent known: the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, the measures we've taken or propose to take, and a point of contact. Where details emerge over time, we'll send them in phases rather than wait for a complete picture.
We'll cooperate reasonably with your breach assessment and any required notifications to authorities or data subjects. Our notice is not, by itself, an admission of fault.
NuMail and several sub-processors operate from the United States. Where we transfer personal data out of the EEA, UK, or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (SCCs), incorporated by reference into this DPA, plus the UK International Data Transfer Addendum for UK data.
NuMail's own systems run in the United States, and so do the sub-processors in §03, with these exceptions: Google, Microsoft, and Stripe operate globally; the domain registrar and the registries it passes registrant data to operate globally; and for any AI request, the default model included, the model host OpenRouter routes it to may process it outside the United States. We do not offer EU-region hosting today.
On reasonable written request (no more than once per year, unless a regulator or a breach requires otherwise), NuMail will make available the information needed to demonstrate compliance with this DPA: our security documentation, sub-processor list, and, when available, third-party reports or certifications.
Where documentation isn't enough to address a specific, well-founded concern, we'll cooperate on a focused audit during business hours, on reasonable notice, under confidentiality, and in a way that doesn't disrupt the service or compromise other customers' data. Each party bears its own audit costs.
You can export your data (leads, campaigns, replies, analytics) via the dashboard or API at any time, including after your subscription ends.
We may retain the minimum data required by law (e.g. invoices for tax records) and aggregated, non-identifying statistics that can't be tied back to a data subject.
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Terms of Service, and any reference to a party's liability there applies to the combined liability of that party under the Terms and this DPA.
This does not limit any liability that cannot be limited under applicable data-protection law, including a data subject's rights to compensation. Where both parties are responsible for damage caused by processing, each is liable to a claimant in line with Art. 82 GDPR, with the right to seek contribution from the other party in proportion to its responsibility.
For anything on this DPA (the live sub-processor list, an SCC counter-signature, a breach or audit inquiry, or to have us review your own DPA), reach our data-protection team:
ColdRelay LLC, 5830 E 2nd St, Ste 7000 #19475, Casper, WY 82609
We respond to DPA and privacy requests within five business days. Enterprise and Agency customers can request a counter-signed DPA before go-live.
✉ dpa@numail.aiLooking for the rest? See our Privacy Policy, Terms of Service, and Security overview.
SCCs, a complete sub-processor list, breach notice without undue delay, and lead deletion from the dashboard, built into the platform, not bolted on.