GDPR in Lumail

Last reviewed: 2026-09-15

Contract and transfer requirements: Organization owners and administrators can accept and download a DPA in Settings → Configuration → Data Processing Agreement. Version 2026-09-15.1 incorporates EU SCC Modules Two and Three, the UK ICO Addendum and Swiss adaptations. It does not promise EU-only processing or complete the Customer's transfer assessment.

This page describes the product and infrastructure as they operate today. It is intended to help customers perform their own assessment; it is not legal advice and is not a certification that a particular use of Lumail complies with GDPR or French ePrivacy rules.

Roles and responsibility#

For subscriber lists, campaigns, and transactional recipients, the Lumail customer normally determines the purpose and means of processing and is the data controller. Codelynx, LLC operates Lumail and processes that data to provide the Service.

Codelynx is a separate controller for account, billing, security, support, and its own website analytics data. Customers remain responsible for their notices, legal bases, consent records, email content, recipient selection, and responses to data-subject requests.

Current data map#

Opens, clicks, bounces, complaints, and unsubscribe events are stored in the same Frankfurt PostgreSQL region as subscriber records. This does not mean all related data stays there: SES, R2, Cloudflare, QStash, and operational alerts can process related data elsewhere. Hatchet job payloads are processed on the self-hosted German worker.

See the Privacy Policy for the complete public disclosure.

International transfers#

Codelynx does not currently claim certification under the EU-U.S. Data Privacy Framework. DPA version 2026-09-15.1 incorporates the European Commission's 2021 Standard Contractual Clauses for controller-to-processor and processor-to-subprocessor transfers, the UK ICO Addendum and Swiss adaptations.

Those clauses create a Customer-to-Codelynx transfer instrument. They do not replace the required assessment of the destination country's laws, supplementary measures where needed, or the upstream safeguards for each onward transfer. Infrastructure-provider DPAs and SCCs cover only the parties and transfers identified in those agreements.

See Data Processing Agreement for the current contractual status.

GDPR setup checklist#

Before collecting subscribers, an EU customer should:

1. Complete the required agreements. Review and accept the current organization DPA. It supplies the applicable EU, UK and Swiss transfer terms between you and Codelynx, but you must still document the transfer assessment and any supplementary measures before starting the affected processing.
2. Publish your own privacy notice. Identify your purposes, legal bases, recipients, transfers, retention periods, and how subscribers can exercise their rights.
3. Enable native double opt-in. In Settings → Configuration → Double Opt-In, enable the setting before collecting subscribers when confirmation is appropriate for your legal basis and market. Step-by-step: Enable Double Opt-In.
4. Minimize data. Send only fields needed for the stated purpose. Do not place special-category or children's data in Lumail without a separate assessment and written agreement.
5. Choose tracking deliberately. Open pixels and tracked links can require notice or consent. The transactional API, SDK, and MCP send_email tool default both options to disabled. Set tracking.open and tracking.links to true only when tracking is necessary and lawful. Marketing campaigns still track opens and clicks. Native double-opt-in confirmation emails do not track.
6. Keep independent consent evidence. Store the notice version, source, timestamp, purpose, and consent wording in your own system. Native Lumail confirmation stores confirmedAt and confirmationIp, but those fields are not a complete consent record by themselves.
7. Test rights handling. Verify export, unsubscribe, suppression, and lawful erasure (not the disabled DELETE API) before launch. Contact [email protected] for downstream provider deletion.

Native and custom double opt-in#

Lumail's recommended flow is the native double opt-in. See Enable Double Opt-In for the Configuration screenshots and the confirmation email editor.

1. Enable Double Opt-In in organization configuration.
2. Add the subscriber through the Subscribers API or a Lumail capture flow.
3. Lumail creates the subscriber as PENDING_CONFIRMATION and sends the native confirmation email.
4. The Lumail confirmation link changes the status to SUBSCRIBED and records the confirmation time and IP address.

The transactional email API behaves differently:

• It always creates a subscriber row when the address does not already exist.
• By default that row is TRANSACTIONAL: delivery, bounce, and complaint tracking without marketing eligibility.
• If Settings → Configuration → Add transactional recipients to the marketing list is on, the new row is SUBSCRIBED and a subscribed event is recorded. Double opt-in is ignored on this path.
• Existing contacts are reused and never have their status changed. TRANSACTIONAL becomes SUBSCRIBED only on a real subscribe (capture, import, admin, or API upsert with resubscribe).
• Adding a custom tag does not change PENDING_CONFIRMATION or TRANSACTIONAL to SUBSCRIBED, populate confirmedAt, or prove consent in Lumail.

Therefore, do not use the transactional API plus a confirmation tag as Lumail's custom double-opt-in mechanism. Use the native flow, or keep the entire consent and marketing-eligibility state in your own system and do not treat Lumail's SUBSCRIBED status as proof of consent. Confirmation emails sent by Lumail's native double-opt-in flow already disable tracking. If you send your own confirmation message through the transactional API, keep the default (off) or set both options explicitly:

{
  "transactional": true,
  "tracking": {
    "open": false,
    "links": false
  }
}

Retention, deletion, and suppression#

Lumail does not currently provide a contractually guaranteed retention period for every data category.

Ordinary subscriber DELETE is not a product operation: DELETE /api/v1/subscribers/{id} returns 405 and the delete_subscriber tool is disabled. Unsubscribe stops marketing mail and keeps history.

An authorized organization owner or admin can run lawful erasure from the subscriber detail page (confirm ERASE). That path:

• scrubs identifiable subscriber fields, email bodies, snapshots, clicks/opens, events, capture events, and related AI conversation mentions
• deletes R2 content objects whose keys are known
• writes a hashed tombstone so imports, API upserts, and transactional sends cannot recreate the address
• keeps hashed suppression / delivery-guard identities so the address is not emailed again

It does not automatically erase SES provider logs, PostHog events, historical import files, or database backups. Those exceptions are recorded on the erasure ledger. Contact [email protected] for downstream provider deletion. Do not promise a completion date for third-party stores without that follow-up.

The accepted DPA governs Codelynx's processing obligations; it does not imply an automated deletion deadline.

See Customer compliance guide.

Security and incident handling#

Lumail uses TLS, access controls, separated environments, provider security controls, and abuse monitoring. These measures reduce risk but do not create an absolute security guarantee. Customers should limit API-token permissions, rotate credentials, use separate development and production tokens, and report suspected incidents to [email protected].

Planned compliance work#

The organization DPA can be accepted electronically and downloaded with its acceptance record. Maintaining the transfer assessment, upstream provider evidence and notification processes, and improving retention and downstream erasure controls remain distinct work. A signed DPA is not a certification of all product behavior or a completed transfer assessment.