1. Introduction
Van Moose BV (“we,” “our,” or “us”) operates Truncus, a transactional email infrastructure service (“Service”). This Privacy Policy describes how we collect, use, and protect your information when you use our Service.
We are committed to protecting your privacy and ensuring transparency in our data practices. This policy complies with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
2. Information We Collect
2.1 Account Data
- Authentication: Email address and authentication data via Clerk
- Profile: Name (if provided), organization name
- Billing: Payment information processed by Stripe (we do not store card details)
2.2 Email Data
- Email Content: Subject, body, recipients of emails you send through our API
- Delivery Events: Delivery status, bounces, opens (if enabled), clicks (if enabled)
- Technical Data: IP addresses, timestamps, API request logs
2.3 Email Delivery Infrastructure
We use Amazon Web Services Simple Email Service (AWS SES) to deliver emails. Email delivery is processed exclusively within the EU region (eu-west-1, Ireland). Email content does not leave the European Economic Area for delivery purposes. AWS processes this data as our sub-processor under appropriate data protection agreements. For a complete list of sub-processors and their locations, see our Data Processing Agreement.
3. How We Use Your Information
We use collected information to:
- Provide the Service: Send emails on your behalf, track delivery status
- Manage Your Account: Authentication, billing, support
- Improve the Service: Analyze usage patterns, fix bugs, enhance features
- Security: Detect and prevent abuse, fraud, and security threats
- Legal Compliance: Comply with applicable laws and regulations
4. Legal Basis for Processing (GDPR)
We process your data based on the following legal grounds:
- Contract Performance: To provide the email services you have subscribed to
- Legitimate Interest: To improve our services, ensure security, and prevent abuse
- Legal Obligation: To comply with applicable laws and regulations
5. Data Sharing and Disclosure
We do not sell your personal information. We may share data with:
5.1 Service Providers
- AWS SES: Email delivery infrastructure
- Clerk: Authentication services
- Stripe: Payment processing
- Vercel: Hosting and infrastructure
- Neon: Database hosting (EU region)
5.2 Legal Requirements
We may disclose information if required by law, court order, or to protect our rights and safety.
6. Data Security
We implement appropriate technical and organizational measures to protect your information:
- Encryption: Data encrypted in transit (HTTPS/TLS) and at rest
- Access Controls: Limited access to data on a need-to-know basis
- API Keys: Securely hashed, never stored in plain text
7. Data Retention
- Email content: Processed in transit; not stored beyond 7 days (delivery retry window)
- Delivery metadata: Bounce codes, delivery timestamps, complaint flags — retained for 90 days
- Engagement data: Open and click events (if tracking enabled) — retained for 90 days
- Account data: Retained while your account is active; deleted within 30 days of account termination
- Billing records: Retained as required by Dutch law (typically 7 years)
8. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your personal data
- Restriction: Limit how we process your data
- Portability: Receive your data in a machine-readable format
- Objection: Object to processing based on legitimate interests
To exercise these rights, contact us at info@truncus.co.
9. International Data Transfers
Email delivery is processed exclusively within the EU (AWS SES eu-west-1, Ireland) and does not constitute an international transfer. Account and billing data may be processed outside the European Economic Area via Clerk (authentication), Stripe (payments), and Vercel (hosting). These transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission. For full details, see our Data Processing Agreement.
10. Cookies
This website uses essential cookies for authentication and functionality. We do not use tracking cookies for advertising purposes.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
12. Supervisory Authority
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your personal data in accordance with applicable law.