Legal
Privacy Policy
This Privacy Policy explains how 12N Labs collects, uses, and protects personal data when you use TrackSES and our website. We are committed to processing personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French law.
Last updated: June 2026
1. Data controller
The data controller for the personal data described in this policy is 12N Labs, a SAS with its registered office at 173 rue de Courcelles, 75017 Paris, France. You can contact us about privacy matters at support@trackses.com. We have not appointed a Data Protection Officer. The competent supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) in France.
2. Data we collect
We collect: account data such as your name and email address; billing data, which is processed by Stripe (we never store raw card numbers); SES event data that you choose to send to us, which may include the email addresses of your recipients and bounce, complaint, and delivery metadata, as well as message subjects and sender information; usage data such as the pages and features you use and related timestamps; and technical data such as your IP address, browser type, and device identifiers.
3. Purposes and legal bases
We process personal data: to provide and operate the service and perform our contract with you (performance of a contract); to comply with our legal obligations, including accounting and VAT requirements (legal obligation); to improve our product and prevent fraud and abuse (legitimate interest); and to measure website audience through analytics (consent). Where we rely on consent, you may withdraw it at any time.
4. Cookies and analytics
We use strictly necessary cookies to keep you signed in and to maintain your session; these do not require consent. We also use Google Analytics (measurement ID G-C24GDE7CG1) on the public website and on the login and registration pages. Analytics is loaded only after you give consent, through Google Consent Mode, which defaults to denied until you accept. You can withdraw your consent at any time through the cookie settings available on the site.
5. Sub-processors
We rely on the following sub-processors, each acting under its own terms: Amazon Web Services (AWS), used for SES, S3, Amplify, and EC2, for our infrastructure and for processing email event data; Stripe, for payment processing; MongoDB Atlas, for database hosting; and Google Analytics, for audience measurement. We may update this list as our service evolves.
6. International transfers
Most of our processing takes place within the European Union. Google Analytics may transfer data to the United States; such transfers rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, and take place only after you give consent to analytics.
7. Data retention
We retain account data for as long as your account is active. SES event data is retained according to your plan: 14 days for Basic, 30 days for Solo, and 90 days for Team. After account deletion, personal data is purged within 30 days. Audit logs are retained for a limited period for security and accountability purposes and then deleted.
8. Your rights
Subject to applicable law, you have the right to access your personal data, to rectify it, to request its erasure, to restrict or object to its processing, to data portability, and to withdraw your consent at any time where processing is based on consent. You also have the right to lodge a complaint with the CNIL. To exercise your rights, contact us at support@trackses.com.
9. Security
We implement technical and organizational measures to protect personal data, including TLS encryption in transit, AES-256-GCM encryption at rest for sensitive fields such as AWS credentials and two-factor authentication secrets, a private S3 storage with short-lived presigned access URLs, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Our role as processor
For the recipient personal data that you send to us through SES events, you are the data controller and 12N Labs acts as a data processor on your behalf, processing that data only on your instructions to provide the service. You are responsible for having a valid legal basis to send the underlying emails and to share the related data with us.
11. Children
The service is not directed to individuals under the age of 18, and we do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at support@trackses.com.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the platform. The date at the top of this page indicates when it was last updated.
13. Contact
For any question about this Privacy Policy or to exercise your rights, contact us at support@trackses.com. You may also contact the CNIL, the French supervisory authority, at any time.