Privacy Policy
How Vaakio collects, uses, shares, and protects personal data on our website and in the Vaakio product.
Last updated 21 September 2026
1. Who we are
Vaakio ("we", "us", "our") provides email marketing, forms, automation, and analytics software. This policy covers www.vaakio.com (the "Site") and the Vaakio application at app.vaakio.com (the "Service").
Vaakio is the controller for the personal data described in this policy. Privacy questions and requests: privacy@vaakio.com.
2. Our two roles: controller and processor
Data protection law distinguishes between the party that decides why and how personal data is used (the "controller") and the party that handles it on that party's instructions (the "processor"). We act in both roles:
- Vaakio as controller — for data about our own website visitors, prospects, and account holders (Sections 3 to 5).
- Vaakio as processor — for the subscriber and contact data our customers upload or collect through the Service (Section 6). The customer is the controller of that data and is responsible for having a lawful basis to send to it, for honouring consent and unsubscribe requests, and for complying with anti-spam law.
3. Personal data we collect as controller
- Account data — name, work email, company, role, password (stored hashed), and preferences.
- Billing data — billing name, address, tax details, and payment status. Card details are handled by our payment provider; we do not store full card numbers.
- Communications — messages you send us through the contact form, support, or email, and our replies.
- Usage and device data — pages and features used, IP address, browser, device type, approximate location derived from IP, and timestamps, collected through logs and cookies.
- Marketing data — your email address and preferences if you subscribe to our own updates, and your interactions with those emails.
We do not knowingly collect special-category data (such as health or biometric data) for our own purposes.
4. How and why we use it (lawful bases)
Where GDPR or UK GDPR applies, we rely on the following bases:
| Purpose | Lawful basis |
|---|---|
| Create and run your account, provide the Service, provide support | Performance of a contract |
| Process payments, keep financial records, respond to legal requests | Contract; legal obligation |
| Secure the Service, prevent fraud and abuse, monitor deliverability and spam complaints | Legitimate interests |
| Improve the Service, analyse usage, develop features | Legitimate interests |
| Send service notices (changes, security, billing) | Contract; legitimate interests |
| Send marketing about Vaakio | Consent, or legitimate interests for business contacts where the law allows. You can opt out at any time. |
| Non-essential cookies and similar technologies | Consent |
Where we rely on consent you may withdraw it at any time; withdrawal does not affect earlier processing. Where we rely on legitimate interests you may object (Section 10). We do not sell personal data, and we do not use it for automated decisions that produce legal or similarly significant effects.
5. Cookies and similar technologies
The Site uses Umami, a cookie-free analytics service, to count visits and page views. It does not set cookies or track you across other sites. The Service uses essential cookies for sign-in, security, and load balancing, which do not need consent. The Site serves its fonts from our own servers, so no font requests go to third parties. If we add any cookie-based analytics or other non-essential technology, it will stay off until you accept it in the cookie banner, and you can change your choice at any time through "Cookie settings" in the footer. We do not use advertising cookies on the Site. Our emails may contain tracking pixels and links that record opens and clicks; see Section 6 for how customers use these.
6. Customer data we process on your behalf
When you use the Service to send email, we process your subscribers' data (for example email address, name, custom fields, subscription status, and open, click, bounce, and complaint events) only to provide the Service and on your documented instructions, as set out in our data processing agreement. We:
- process it only as needed to deliver, measure, and secure your campaigns, forms, and automations;
- keep it confidential and limit access to staff who need it, including limited review of sending patterns and, where needed, campaign content to detect abuse and protect deliverability;
- use approved sub-processors under written terms (Section 7);
- assist you in responding to data subject requests and notify you without undue delay after becoming aware of a personal data breach affecting it;
- delete or return it when you ask, or when your account ends (Section 9).
If you are a subscriber and want to see, correct, or delete data a Vaakio customer holds about you, or stop receiving their email, contact that sender or use the unsubscribe link in their email. If you contact us, we will forward your request to the relevant customer where we can identify them.
Customers must not upload special-category data or purchased or scraped lists, and must send only to recipients who have given permission. See our Terms of Service.
7. Who we share data with
We share personal data only with:
- Sub-processors and service providers — hosting and infrastructure, email delivery, payment processing, error monitoring, analytics, customer support tooling, and similar vendors. Each is bound by a data protection agreement and may process data only for the services it provides to us. Our current sub-processors are listed below, and we notify customers before adding a new one that will process customer data.
- Professional advisers — lawyers, auditors, and insurers, under confidentiality duties.
- Authorities — where required by law, court order, or to protect rights, safety, and security. Where allowed, we notify the affected customer first.
- A successor — in a merger, acquisition, or asset sale, subject to this policy or notice of a change.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage, and infrastructure | United States (AWS US East) |
| Umami Software, Inc. | Cookie-free website analytics (Site only, not customer data) | United States |
We do not sell personal data or share it for cross-context behavioural advertising.
8. International transfers
We and our sub-processors may process data in countries outside your own, including outside the European Economic Area and the United Kingdom. Where we transfer personal data to a country without an adequacy decision, we rely on an approved safeguard, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You can request a copy of the relevant safeguards by emailing privacy@vaakio.com.
9. Retention
- Account data — kept while your account is active and for up to 12 months after closure, then deleted or anonymised, unless the law requires longer.
- Customer subscriber data — kept until the customer deletes it or closes their account, then deleted within 12 months from active systems. Backups roll off on their normal cycle.
- Billing and tax records — kept for the period required by tax and accounting law.
- Logs and security records — kept for no more than 12 months.
- Suppression lists — unsubscribe, bounce, and complaint records may be kept so that we do not email people who have opted out.
10. Your rights
Depending on where you live, you may have the right to:
- be informed about, and get access to, your personal data;
- have inaccurate data corrected and incomplete data completed;
- have your data erased ("right to be forgotten");
- restrict processing;
- receive your data in a portable format and have it transmitted to another provider;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time;
- not be subject to solely automated decisions with significant effects.
To exercise a right, email privacy@vaakio.com. We may need to verify your identity, and we respond within one month (extendable by up to two further months for complex requests, as the law allows). We do not charge a fee unless a request is manifestly unfounded or excessive. If you are unhappy with our response, you may complain to your local data protection authority; in the EU you can find yours through the European Data Protection Board, and in the UK it is the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
11. US state privacy rights (including California)
Residents of California and other US states with privacy laws may have the right to know, access, correct, delete, and obtain a portable copy of their personal information, to opt out of its sale or sharing, and to not be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising. For customer subscriber data, we act as a service provider or processor for the customer. You may use an authorised agent to submit a request. Contact privacy@vaakio.com.
12. Anti-spam and sender obligations
Customers are responsible for complying with CAN-SPAM, CASL, GDPR and ePrivacy rules, and other laws that apply to their sending, including having valid consent where required, identifying themselves, and honouring unsubscribe requests promptly. Vaakio provides tools such as unsubscribe handling and suppression lists, but does not verify each customer's legal basis.
13. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and least-privilege access, logging and monitoring, and secure development and vendor practices. No system is completely secure. If a breach affecting your personal data occurs, we will notify affected customers and, where required, regulators without undue delay, and within 72 hours of becoming aware where GDPR requires.
14. Children
The Site and Service are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
15. Representatives and contact
For privacy questions, requests, or to contact our data protection contact: privacy@vaakio.com, or write to Vaakio via our contact page. If we appoint an EU or UK representative, their details will be added here.
16. Changes to this policy
We may update this policy as our practices or the law change. We will post the new version here with a new date and, for material changes, notify account holders by email before they take effect.