Registration of the Bulko operator is in progress. The legal name, registration number, and address will be added after registration is complete. Until then, contact
[email protected] for data-related questions.
This policy describes what data Bulko collects, how it uses, transfers, and protects it when providing the email campaign service.
1. What Data We Collect
1.1 Personal Data
Data you provide directly:
- Account information: username, email, password (stored as a hash)
- Payment information: processed by gateways (Stripe, CoinGate, Heleket, CactusPay) — we do not store card details
- Communication data: correspondence with support, support requests
- API keys you voluntarily add for specific features; use restricted keys and revoke them when no longer needed
1.2 Campaign Data
- Email campaign content (subject, body, templates)
- Subscriber and recipient lists that you import
- SMTP accounts: logins, connection details, servers, limits, and sending history, if the feature is available to your account.
- IMAP settings and collected recipient replies
- Campaign analytics: open/click/reply/bounce events
1.3 Technical Data
- IP Addresses (for security and abuse prevention)
- Browser User-Agent, screen resolution, device type
- Cookies and session tokens (for authentication)
- Usage logs for the dashboard and REST API.
2. How We Use Data
Collected data is used for:
- Providing and maintaining the Service
- Processing payments through third-party gateways
- Sending email campaigns through Bulko's managed infrastructure or user-connected SMTP when that feature is enabled
- AI content generation (via built-in models or your OpenAI key) and AI classification of incoming replies
- Preventing abuse (AI Content Filter — see Section 4 of the Terms of Use)
- Notifications about campaign status, SMTP failures, and balance depletion
- Service improvements based on aggregated analytics (without identifying individual users)
3. Data Transfer to Third Parties
We do not sell your data. We share data only in the following cases:
3.1 Service Providers
- Payment gateways: Stripe, CoinGate, Heleket, CactusPay — for payment processing. They receive only the data required for the transaction.
- AI providers: Google Gemini (built-in) or OpenAI (if you use your own key) — for subject/content generation and reply classification. Only email content is sent to the AI side, without recipients' personal data.
- Hosting and infrastructure: OVH/Hetzner for storage and Cloudflare for CDN/DNS. Data is stored in the EU.
- Analytics: Google Analytics, Ahrefs Analytics — only aggregated data about website traffic, not campaign data.
3.2 Legal Requirements
5. Cookies and Tracking
4. Data Storage and Protection
4.1 Storage Periods
- Account data — while the account is active, plus 30 days after closure for recovery
- Campaign data — 24 months after the last campaign activity
- SMTP logs and events — 12 months
- Snapshots of messages blocked by the AI filter — up to 12 months (for abuse investigation)
- Financial data — 7 years (tax law requirement)
4.2 Security Measures
- TLS 1.3 encryption for all connections
- Bcrypt for password hashing; AES-256 for encrypting API keys and SMTP passwords in the database
- Limited employee access to production data (least-privilege principle)
- Regular backups and a disaster recovery plan
- Firewall, suspicious activity monitoring, protection against brute-force attacks
5. Cookies and Tracking
We use the following categories of cookies:
- Essential: session cookies for authentication and interface operation. The Service does not work without them.
- Analytical: Google Analytics for understanding traffic. They do not personally identify you.
- Functional: saving language, dashboard theme (dark/light), other UI settings.
Tracking pixel in outbound campaigns (for open-rate) is a technology that you (as a Bulko user) apply to your recipients. Compliance with the legal requirements of such tracking is your responsibility.
6. Your Rights (GDPR / Personal Data Law)
If you are located in the EU, the UK, or another jurisdiction with similar legislation, you have the following rights:
- Access: request a copy of your data
- Rectification: request correction of inaccurate data
- Deletion: request data deletion (right to be forgotten), except where retention is required by law
- Restriction of processing: suspend data processing
- Portability: get your data in a machine-readable format
- Objection: object to certain processing methods
- Complaint: contact a data protection supervisory authority
To exercise your rights, write to [email protected]. We will respond within 30 days.
7. Cross-Border Data Transfers
Bulko's core infrastructure is hosted by European providers. Some functions, including AI and payments, may be processed by external providers in other countries. The current list is published on the subprocessors page; applicable international transfer mechanisms must be covered by provider agreements.
8. Children
Postigo is a platform for cold email outreach with AI-powered content rotation, response filtering, and deliverability control. We help teams connect with customers from the first email to the deal.
9. Changes to This Policy
Deliverability
10. Privacy Contact Information
For any questions about privacy and data processing: