The General Data Protection Regulation (GDPR) is European Union legislation to strengthen and unify data protection laws for all individuals within the European Union. The regulation came into effect from May 25th, 2018.
At OOPSpam LLC ("oopspam"), we are committed to being transparent with our customers regarding our privacy practices and complying with all applicable privacy laws and regulations, such as the European Union (EU) General Data Protection Regulation (GDPR). We value your trust and are dedicated to protecting your privacy.
This page lays out our commitment to data protection and makes transparent what data we store about our users.
What data do we collect?
On our website:
Our website (as opposed to our web oopspam APIs) is hosted by GitHub in the United States.
On our website, we use Cabin to help us understand, in anonymized form, how the site is being used. Here is Cabin Privacy Policy.
Our dashboard and account details are hosted by DigitalOcean in the United States. DigitalOcean privacy policy.
When registering for our free trial, you need to provide us with a valid email address. We then confirm that the address works by emailing you a confirmation link. All transactional emails including Forgot Password emails are sent by using Postmark. Postmark privacy policy. You can find Postmark GDPR compliance notice here.
We also need an email address so we can contact you regarding any changes to our service or, for example, to this privacy policy. We send the email to you via the email delivery service EmailOctopus, here is EmailOctopus privacy policy.
As you may have noticed on our dashboard and the documentation page, we use a chat widget to answer questions and talk to our users in real-time. This chat widget is powered by Crisp. Here is Crisp privacy Policy.
Registering for a free trial requires acceptance of our publicly available terms & conditions.
On our APIs:
When you check a submission, we receive its content and, if you send them, the IP address and email address (optional, but recommended for accurate detection, and used only for spam detection). With our WordPress plugin, we also receive technical details of the HTTP request. We process this data in memory to return the verdict and do not store it by default. We don’t add data from your spam checks to our network-wide lists or use it for other customers.
- API servers: hosted with Fly.io. Each request is served by the nearest region: Frankfurt (Germany), London (UK), Secaucus NJ and San Jose CA (US), São Paulo (Brazil) or Sydney (Australia). Requests from the EU are normally served in Frankfurt; if that region is unavailable, another region, including the US, may be used. Our detection models run on our own servers in the same regions. Traffic reaches us through Cloudflare. Fly.io privacy policy.
- Detection microservices: some run on Hetzner in Germany or the US and process IP addresses and email addresses in real time, without storing them.
- Contextual detection: only when it is used, the submission content (no IP address or email address) is sent through OpenRouter in the US, with zero data retention.
- API gateway: to rate-limit usage, our API gateway on DigitalOcean in the US keeps request counts per API key and the IP address the API call comes from (normally your server) for 30 days. It does not store request bodies. DigitalOcean privacy policy.
- Logs (optional): only if you switch logging on, request and response logs are stored by Supabase in the EU (Frankfurt, eu-central-1) for your plan’s retention period (Freelance 2 months, Agency 4 months, Scale 6 months). Daily backups stay in Frankfurt for up to 7 days.
- Reports: when you mark a submission as spam or not spam, the report is stored in Frankfurt, Germany, and deleted 7 days after it is resolved. Reports are applied to our network-wide block and allow lists, which protect all customers. If you don’t want this, don’t use the report function; we will remove a report on request.
- Error monitoring: if a request causes an error, technical details of it may be sent to Sentry in the US and kept for up to 90 days.
The full list of sub-processors for the API is in Annex 1 of our DPA. We will email customers at least 30 days before adding or replacing one.
International transfers
Some of this processing takes place outside the EEA, including in the United States. For these transfers we rely on the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), which are part of our DPA. A signed copy with completed annexes is available on request at [email protected]. OOPSpam LLC is not certified under the EU-U.S. Data Privacy Framework.
Customer/Financial transaction information:
If you become a paying customer (as opposed to just using our free trial) you will need to provide us and our payment partner (Paddle) with valid billing information. We will be able to see your name, billing address, email address, and VAT number (if you have provided one). We are not able to see your credit card number, only Paddle has access to that.
As any business, we of course share transaction data with our accountants and with the relevant tax authorities when we pay VAT and file our annual tax return.
We also use ProfitWell for subscription analytics: understanding our growth, churn, and all kinds of financial metrics. ProfitWell is directly connected to Paddle, so they have access to customer billing history.
Data Processing Agreement
Becoming a customer of our service implies acceptance of our Data Processing Agreement, unless otherwise explicitly agreed with us in writing.
Data deletion
Any user (paid or free-trial) can request to have their account deleted at any time, this can be done by visiting the Personal Data page on our dashboard. For paying customers we of course have to keep records of all completed transactions for tax purposes.
Customers can also see their logging status and delete stored logs and reports at any time from the Trust Center in their dashboard, or by emailing [email protected].
Stay informed
Meaningful changes to this document, including changes to our sub-processors, will be announced by email and on our LinkedIn and X accounts.
