Privacy Policy
Last updated October 14, 2026
PigeonAtlas is operated by Golux Group, Timocka 11, Belgrade-Zemun, 11080, Serbia. This describes what we hold, why, for how long, and who else can see it. Where it is vague, assume the narrower reading and write to support@pigeonatlas.com.
Two different roles
For your own account (your name, your email address, your billing) we decide what is held and why, and we are the controller.
For the mail you send, we are a processor. Your recipients are your contacts, not ours: we hold their addresses and messages because you asked us to deliver them, we act on your instructions, and we never market to them or use their addresses for anything but delivering what you sent. Whether you had the right to mail them in the first place is your responsibility, and the Acceptable Use Policy sets out what we require of you there.
What we hold
Your account
Name, email address, a hash of your password, and your account's plan. Never the password itself.
Sessions
The IP address and browser user agent of each sign-in, so you can see where your account is signed in and we can rate limit attacks on it.
Messages you send
Sender, recipient, subject, the message body, and the delivery outcome. The body is the part with the shortest life; see below.
Delivery events
Deliveries, bounces, complaints and, if you switch tracking on, opens and clicks with the recipient's IP address and user agent. Tracking is off unless you enable it per domain.
Suppressions
Addresses that bounced or complained on your account, so we do not send to them again.
Billing
Your Paddle customer and subscription identifiers, and for each email pack you buy: which pack, when, and Paddle's transaction id. Card details go to Paddle directly and never reach us.
How long we keep it
Message bodies are deleted after 30 days. What survives is the delivery record (who it went to, when, and what happened to it) because "did this send?" has to stay answerable long after the message itself is no use to anybody.
Everything else lives as long as your account does. Closing it deletes your domains, keys, messages, contacts and stored bodies. Suppressions are the one exception we would argue for keeping: an address that filed a spam complaint should not start receiving mail again because an account was recreated.
If you joined a waiting list
We keep the address, the list, where you came from, the sentence you agreed to and the times you asked and confirmed. Until you click the link in the one confirmation message, you are not on the list and we send nothing else; after it, you can leave in one click from any message or from the link on the confirmation page. We do not share these addresses and we do not use them for anything but the list you chose.
Newsletter brands and subscriber lists
Your account holds newsletter brands, logos, templates, campaign drafts and subscriber lists. CSV imports store the subscribers' email addresses and optional names, along with who confirmed permission, when, and the source they provided. We do not keep the uploaded CSV file. Newsletter records are deleted with your account; unsubscribe and suppression controls apply to newsletter delivery.
If you joined a brand through its page
When you sign up on a brand's public page we keep your name, your email address, the sentence you agreed to, the page you were on, and when you signed up, confirmed and left. We do not store your IP address with it. Until you confirm from the one email we send, the brand has none of it and we send nothing else. Once you confirm, the brand holds your name and address on its list and decides what it sends you; for that list we act for the brand. Your address on our side, and whether you unsubscribed from everything, is ours to keep for you: it is how we stop every brand on PigeonAtlas from mailing you after you asked, so we keep it even if the brand closes its account. Leaving a brand, or everything, marks the records rather than deleting them, because the mark is what keeps you off the list. Ask us to delete them and we will, with the understanding that the opt-out goes too.
If you request setup help
We store your name, email, phone number, preferred contact channel, service choice and request details so our team can handle your request. Tickets are separate from an application account and stay until our team deletes them, including when you ask us to delete them. Closing an application account does not automatically delete a service ticket. Submitting a request does not subscribe you to marketing. If you choose WhatsApp, communication on WhatsApp is also handled by that provider under its own privacy terms.
If you send us a message
The contact and sales forms store your name, email address, message and the details you choose to add (such as your company and expected volume) so we can reply. We do not store your IP address with it. Messages stay until our team deletes them, including when you ask us to. Sending one does not subscribe you to anything.
Counting visits
We count views of our public pages per day, and how many different visitors there were that day. To tell visitors apart we keep a one-way fingerprint of your IP address and browser, made with a key that changes every day, and we delete it after the day ends. No cookie is set for this, and the IP address itself is not stored.
Where it is held
In the European Union, throughout. The application and database run in Amsterdam, archived message bodies sit in Frankfurt, and mail is sent through Frankfurt. Nothing is stored outside the EU. The data residency page has the same facts laid out the way a data protection officer asks for them.
Who else touches it
DigitalOcean
Amsterdam and Frankfurt
Runs the servers and the database, and stores archived message bodies.
Amazon Web Services
Frankfurt
Delivers the mail. Messages pass through SES to reach the recipient.
Paddle
United Kingdom and United States
Sells you the subscription as merchant of record: takes payment, works out and collects VAT, issues the invoice. They receive your billing details directly; we receive identifiers back.
Sentry
European Union
Receives error reports when something breaks, so we find out before you do. Recipient addresses, account email addresses, passwords, API keys, signing keys and authorization headers are removed from every report before it leaves our server.
Google (Tag Manager)
United States and EU
Loads the measurement tags we configure on the public site and the dashboard. Receives page URLs and the browser's technical details; never message content, recipient addresses or API keys.
That is the whole list. We will update this page before adding to it.
Cookies
One, and it holds your session so that you stay signed in. If you sign in to manage your subscriptions, that page sets one of its own, for the same reason and for 30 days. There is no analytics script on this site, no advertising network, and nothing that follows you to another one, which is why you were not asked to dismiss a banner on the way in.
What you can ask for
A copy of what we hold about you, a correction, deletion, or a machine-readable export. Write to support@pigeonatlas.com and we will answer within 30 days. You do not need a reason and it costs nothing.
If you are a recipient rather than a customer, we hold your address because one of our customers sent to it. Write to us and we will tell you which account, and pass the request on, but they, not we, decide whether they had grounds to mail you. You can also unsubscribe from any bulk message directly, which suppresses your address for that account immediately and does not require our involvement.
If you think we have got this wrong, you can complain to your national data protection authority.
Breaches
If data is exposed, we will tell affected customers within 72 hours of finding out, with what happened and what we know at that point rather than waiting until the picture is complete. Security reports are welcome at security@pigeonatlas.com.
Changes
We will email account owners before this page changes in a way that affects them, rather than editing it quietly and relying on the date at the top.