Privacy Policy

This policy explains what MastroSDR collects, why, and what you can do about it. It covers the MastroSDR application and marketing site.

Who we are

MastroSDR is operated by That Fellow Digital LLC. Where this policy says "we", it means that company.

You can write to us at:

26 Colonial Drive, New City, NY 10956

Who is responsible for what

For your own account information, we are the data controller. For the prospect data you upload and the emails you generate, you are the controller and we are your processor: we handle it on your instructions. See our Data Processing Addendum for those terms. For the business directory described below, we are the controller.

What we collect

• Account data. Name, email address, hashed password, workspace name and role.
• Prospect data you upload. Company name, contact name, email address, phone number, website and location.
• Content you generate. Your pitch text and the email drafts produced from it.
• Delivery events. Whether a message was sent and whether it bounced. We do not track whether an email was opened or a link in it clicked.
• Replies. Who replied to your outreach and when, and the text of the reply for a mailbox connected with a password or through Microsoft.
• Integration keys. API keys you connect, and the sign-in token or password for a mailbox you connect, encrypted at rest with AES-256-GCM.
• Calls. The outcome and note you record after a call, and the call brief and script written for it. We do not record calls.
• Bookings. The name, email address, optional phone number, note and time zone a guest gives when booking a meeting through your booking page.
• Assistant conversations. What you ask the assistant while signed in and what it answered, kept in your workspace. Questions asked on our website before signing in are answered and not stored.
• Enquiries and newsletter sign-ups. What you send us through our enquiry form, and the email address you give for our newsletter, whether or not you confirm it.
• Security logs. IP address, user agent and timestamps for sign-ins and sensitive actions.
• Website and product analytics. Page views, IP address and browser user agent for visits to our website, which screens are used inside the application, and which advertisement a visitor arrived from. Covered in full below.

What we do not do

• We do not sell personal data.
• We do not use your prospect data or pitch to train any model.
• We do not share one workspace's data with another, ever.
• We do not run advertising or ad-network tracking on the application. Meta's advertising pixel loads on our marketing pages only and is never present on any signed-in screen. See website visitors below.
• We do not record your screen. Session replay is switched off in our own code, not merely unused, so no prospect name, draft or reply is ever captured by an analytics provider.

Why we process it

To provide the service you asked for (contract), to keep it secure and prevent abuse (legitimate interests), to bill you (contract), and to meet legal obligations such as anti-spam and tax rules. Measuring our website and advertising rests on your consent in the European Economic Area, the United Kingdom and Switzerland, and on our legitimate interest in knowing what works everywhere else.

Where it goes

Your prompts and prospect details are sent to an AI provider to write what you asked for. Which account that runs through depends on what is being written and how you have set things up:

• The assistant. Always runs on our provider account, whatever key you connect. Your question goes to that provider along with whatever the assistant reads to answer it, which can include prospects, drafts, replies and call notes. A draft the assistant writes for you follows the rules below, like any other draft.
• Your own key connected, for the provider selected under Model in Settings. Drafts, suggested replies, call briefs, targeting and search go through your provider account, under your key. Settings always names which account is actually in use, because connecting a key for a provider you have not selected leaves the selected one still in charge.
• Using the AI drafts included with a paid plan. Those run through our provider account, because that is what the included drafts are. If that provider fails, a second provider of ours can take the same request. We do not use any of it to train anything, and connecting your own key moves this work to your account.
• A self-hosted or local model. Drafts and the other writing never leave the machine you point us at. The assistant still runs on ours.

A visitor who tries the sample on our home page sends the website address or sentence they type to our AI provider, and our server reads that website. To write the sample email, the provider also receives the name, website, town and homepage text of a business from our directory.

Outbound email leaves through your connected mailbox, or through our relay for a sending domain we manage. Our own email to you, and booking confirmations to your guests, are delivered by Resend. Payments run through Stripe; we never see your card number. The full list, with what each one receives, is on our subprocessors page.

Where it is stored

Our database and our application both run in Oregon, in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred there, we rely on an appropriate transfer mechanism, such as the Standard Contractual Clauses with the UK addendum where it applies. Some of the providers on our subprocessors page process data in other regions.

The business directory

To find companies for our customers, we keep one directory of businesses. It is built from Google Places, from web search through Brave Search or Serper, from each business's own website, and from the company details our data providers return for a company's web address. It holds a business's name, website, the email address and phone number it publishes, its town and map position, its social media handles and a short summary of what it does. It is shared by every workspace, so a business found once is not looked up again for the next customer.

For this directory we are the controller. Our basis is our legitimate interest in helping businesses find each other, using details companies publish about themselves. It also keeps the web address of each company a workspace imports, and the trade and place a workspace searches for, so the same lookup is not paid for twice. Neither is linked to the workspace, and both stay after a workspace is closed. Nothing else a workspace adds goes into it: not the names of its prospects, its notes, its drafts or its replies.

If your business is listed and you want it removed or a detail corrected, email privacy@mastrosdr.com with your website address. Removal is done by hand, within 30 days. A later search can find the business again from the same public sources; if that happens, tell us and we will remove it again.

Website visitors and advertising

This section is about people browsing MastroSDR, not about the data inside a workspace. Nothing described here touches prospects, drafts, replies or your pitch.

• PostHog tells us which screens are used and where people get stuck. It runs on the marketing site and inside the application, and its requests are served through our own domain rather than a third-party one. Session recording, heatmaps and click capture are disabled in our code, so PostHog receives page views and named product events and never screen contents. Every web address is sent without its query, apart from the campaign tags of an ad that brought you here, such as utm_source or fbclid. Once you are signed in, those events carry your user id and workspace id so one account can be told from another, and never your name or email address. Pages reached by a private link, such as a password reset, an unsubscribe or a booking page, are not measured at all.
• Where you came from. While PostHog is allowed to run, a cookie called mastro_first_touch keeps the website you arrived from and the campaign tags on the link. It also notes whether an ad click came from Meta or Google, and never the click id. It lasts 30 days. If you then create an account, we save it with your sign-up so we can see which links bring people in. Refusing removes it.
• Meta measures our advertising. Its script runs on our public marketing pages only, and never on a signed-in screen, the sign-in page or a page reached by a private link. It sets two cookies, _fbp and _fbc, that let Meta connect an advertisement you saw to a visit here. When someone creates an account, other than by accepting a teammate's invitation, our server tells Meta that a sign-up happened and sends a one-way hash of the email address, the IP address and browser of that request, the page it came from without its query, the ad click id if that page's address carried one, and those two cookies if they are set. If the account was made on a page where Meta's script is running, the script also reports the sign-up from your browser, with the same reference number so Meta counts it once. We do not send the email address itself, and we send nothing else about the account.

Your choice. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked first, and neither tool runs until you choose Allow both. When we cannot tell which country a visit comes from, we ask as well. Everywhere else both run unless you refuse them. You can change your answer at any time with Cookie choices at the foot of every page of our website, or under Your account once you are signed in. Refusing removes the cookies both tools set in this browser, reloads the page without them, and stops our server reporting a sign-up from this browser to Meta. Nothing about MastroSDR works differently as a result.

If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sharing for advertising: Meta's script does not load and our server does not report your sign-up to Meta, whatever else you choose. Under California law, using advertising cookies this way may count as "sharing" personal information for cross-context behavioral advertising, and Refuse both or Global Privacy Control each opts you out. We do not act on the older Do Not Track setting, which has no agreed meaning; use either of those two instead.

Both providers are named on our subprocessors page.

How long we keep it

• Account and workspace data: while your account is open.
• Prospects, messages, replies, call notes, bookings and assistant conversations: until you delete them. Closing a workspace deletes all of it at once, with no way back. Our database keeps six hours of history for recovery, so a deleted record is gone from that within six hours too.
• Proof of what was sent: when an email goes out, the audit log records the recipient address, the subject and the time. That entry is kept for 12 months even if you later delete the prospect, because it is the only record that can answer a complaint about an email you sent. It goes when the workspace is closed.
• Suppression list entries: kept for the life of the workspace and not removable by anyone in it, because deleting them would let someone who opted out be contacted again. They go when the workspace is closed, with the rest of its data.
• Security and audit logs: 12 months, then deleted automatically.
• The business directory: until a business asks us to remove it, as described above.
• Enquiries and newsletter addresses: until you ask us to delete them.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete or restrict processing of your personal data, and to object to it. Email privacy@mastrosdr.com and we will respond within 30 days. You can also complain to your local data protection authority.

If you received an email sent through MastroSDR and want your data removed, use the unsubscribe link in that email or contact the sender directly. They control that data; we process it for them. If your business is also in our directory, we can remove it from that, as described under the business directory.

Security

Passwords are hashed. Integration keys and mailbox credentials are encrypted at rest and never displayed again after you save them. API keys are stored only as hashes. Access is scoped to a single workspace at every layer. More detail is on our security page.

Children

MastroSDR is a business tool and is not directed at anyone under 16.

Changes

If we change this policy materially, we will email account owners before it takes effect.

Contact

privacy@mastrosdr.com