How We Handle Your Information

Supersonic Mails is a retention marketing agency. We build and run email, SMS and lifecycle systems for ecommerce brands. This policy covers supersonicmails.com, the forms and booking links on it, and the email we send you as a result of them.

It does not cover the platforms we operate on your behalf once you are a client. Those — your ESP, your store, your helpdesk — are governed by your own agreements with those vendors, and by the client agreement between us.

Rather than list every field we could theoretically hold, here is what actually happens at each point you might touch us.

When you are only reading

Our host receives what every web server receives: your IP address, your browser and device type, the pages you opened, and the page that referred you. This is how the site gets delivered and how we notice something is broken.

This site does not run advertising or profiling cookies. If we later add a measurement tool, we will name it here before it goes live rather than after.

When you apply for an audit or book a call

You give us your name, your email address, your brand or store URL, and whatever context you choose to add about your business — list size, current revenue, what is not working. Booking a call also creates a record with our scheduling provider, including the time you picked and any answers you gave on the booking form.

We ask for revenue and list size because an audit is worthless without them. You are not obliged to give us either, and we will still reply.

When you email or message us

We keep the correspondence, because that is what an email account is. Anything you volunteer inside it — screenshots, exports, account access — we hold under the same terms as the rest of this policy.

• Reply to you, and prepare the audit or proposal you asked for.
• Deliver and support the work, if you become a client.
• Keep the business records and invoices we are required to keep.
• Understand which pages and case studies are actually read, so we write more of what helps.
• Send you follow-ups about the specific thing you enquired about.

If you opt in to hear from us more broadly, we will send occasional retention teardowns and results. That is a separate choice from filling in an enquiry form, and every one of those emails carries a one-click unsubscribe that we honour immediately.

Stating this positively is more useful than burying it in a clause:

• We do not sell, rent or trade your personal information. Not for money, and not for anything else of value.
• We do not buy email lists, scrape addresses, or send cold email to people who never asked to hear from us.
• We do not add you to a marketing list because you filled in an enquiry form.
• We do not use one client's customer data to find or pitch another client.
• We do not publish a client's numbers, screenshots or name as a case study without asking them first.

This section is the one that matters most if you hire us, and it is the one most agency policies leave out entirely.

Running retention for you means working inside your customer list. We segment it, write to it, and read the reporting that comes back. Those records are your customers' personal data, and none of it becomes ours.

• You stay the controller of that data. We act on your instructions, as a processor.
• We work inside your platforms under our own named seats — not shared logins — so every action is attributable to a person.
• We do not export your list, copy it to our own systems, or retain it after an engagement ends beyond what is needed to hand over cleanly.
• When we offboard, our access is revoked. If you would rather revoke it yourself on day one, tell us and we will confirm once it is done.
• If you need a formal data processing agreement to satisfy your own obligations, ask and we will sign one.

We are a small team and we use other people's software. Your information passes through the categories of provider below, each of which is bound by its own contract with us and none of which is permitted to use your data for its own purposes:

• Website hosting and content delivery.
• Email and calendar, for correspondence.
• Call scheduling, for booking links.
• Email and SMS sending platforms, when you are a client and we send on your behalf from your account.
• Accounting and invoicing, for anyone we bill.

Beyond those, we disclose information only where the law requires it, or where we genuinely need to in order to establish or defend a legal claim.

We work internationally, and our providers operate servers in several countries — most commonly the United States and the European Union. If you are somewhere with rules about moving personal data across borders, assume your information will be processed outside your own country and that we rely on our providers' standard contractual protections to do it.

• Enquiries that never turned into anything: deleted within about two years of the last contact.
• Client records, contracts and invoices: kept for as long as tax and accounting rules require, and no longer.
• Marketing subscribers: kept until you unsubscribe, then suppressed rather than deleted, so that an unsubscribe cannot be undone by a later import.

Depending on where you live you may have a formal right to some or all of the following. We would rather just honour them for everybody than argue about which regime applies to you:

• Ask what we hold about you, and get a copy.
• Have anything wrong corrected.
• Have it deleted, where we are not required to keep it.
• Tell us to stop using it for marketing — always, immediately, no reason needed.
• Object to a particular use, or ask us to restrict it while we look into a complaint.
• Complain to your local data protection regulator if we get it wrong.

Email [email protected] and say what you want. We do not require a form, and we aim to resolve requests within 30 days.

We use access controls, two-factor authentication on the systems that hold client data, encrypted connections, and the principle that nobody gets an account they do not need. We review who has access to what when someone joins or leaves.

What we will not tell you is that this is unbreakable. No transmission over the internet and no stored record is completely secure, and any policy claiming otherwise is overselling. If a breach ever affects your information, we will tell you and the relevant regulator promptly rather than quietly.

This is a business-to-business service. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us information, tell us and we will remove it.

Our case studies link out to client stores, platform documentation and social profiles. Once you follow one of those links you are on someone else's site under someone else's policy. We are not responsible for what they collect.

When this policy changes, the date at the top of the page changes with it. If a change materially affects how we use information you have already given us, we will tell the people it affects directly rather than relying on you to re-read this page.

Questions about this policy, or about anything we hold on you: