Privacy statement

Who we are

ammo.tools is run by AMMO Solutions, a sole proprietorship (eenmanszaak), registered in the Netherlands at Kloosterdijk 6, 1141 PJ Monnickendam, Chamber of Commerce (KvK) 68679750, VAT NL001694241B13 (“AMMO”, “we”, “us”).

Contact for privacy questions: privacy@ammo.solutions (or reply to any account email from us).

What this product does

ammo.tools is a hosted tool for staging and test environments. You point your app’s outbound email and webhooks at us so test traffic stays out of real inboxes and live systems. Captured content is stored so you can inspect it. We do not deliver captured mail to real recipients, and we do not treat capture endpoints as a production gateway.

Two kinds of data

1. Account data (we are the controller)

Name, email address, password hash, organisation/account membership, billing status, support messages, and basic technical logs (IP, user agent, timestamps) needed to run the service securely. If you sign in with Google, Google shares your name, email address and Google account identifier with us; we use this information only to authenticate you.

2. Captured content (you are usually the controller; we process it for you)

Raw emails, attachments, headers, webhook bodies, headers, and related metadata that your staging systems send to ammo.tools. That content may include personal data about your users or third parties. You decide what is sent. Use staging data where you can. Do not point production systems that handle real people at ammo.tools unless you have a lawful reason and the right agreements in place.

Where we process personal data on your behalf, a data processing agreement (DPA) is required. Contact us to arrange this before sending personal data.

Why we process data

• Provide the service you signed up for (contract)
• Bill paid plans and prevent abuse (contract / legitimate interest)
• Security, fraud prevention, and keeping the platform running (legitimate interest)
• Legal obligations where they apply (tax, accounting)

We do not sell personal data. We do not use captured content to train models or for advertising.

Where data lives

Application servers, database, and capture object storage are intended to run in the EU (currently Hetzner in Germany for compute; Cloudflare R2 with an EU-jurisdiction bucket for capture objects and database backups). Cloudflare provides DNS only; our HTTP traffic is not proxied through Cloudflare. If hosting regions change, this statement will be updated so it stays accurate.

Account mail (signup, password reset, invites, deletion confirmation) goes through Postmark. Captured staging mail does not go through Postmark.

How long we keep it

• Captures expire by plan: Free 1 day, Solo 14 days, Team 30 days, then they are deleted (database rows and storage objects). Caps and ring buffers can remove older items sooner.
• Share links expire at most 30 days, and never outlive the capture they point at.
• Workspace deletion removes its captures and memberships when the delete job finishes. Users keep their personal accounts. Separate account erasure requests are reviewed for ownership and retention obligations. Backups may hold copies for up to 14 days before they expire.
• Invoices and billing records we keep as long as tax law requires (7 years in the Netherlands for administration).
• Records of terms acceptance and withdrawal requests (user, version, time) are kept for the duration of the contract plus the statutory retention period for administration.
• Active data is deleted within 14 days of an authorised deletion request or the end of the relevant service. Each backup copy is retained for no more than 14 days from creation.

Who else sees data (subprocessors)

We use these providers to run the product:

We may update this list when providers change. Material changes will be reflected in this statement.

Access inside your account

Owners and members of an account can see captures for that account. People with a valid share link can see that one item until the link expires or is revoked. AMMO staff access live customer data only when needed for support, security, or legal reasons, and access is limited.

Security (short version)

TLS in transit, access controls, encrypted SMTP credentials at rest, signed short-lived download links for attachments, sandboxed HTML preview for mail, and no outbound relay of captured mail to the public internet from this product’s capture path. No security measure is perfect; report issues to security@ammo.solutions.

Your rights (AVG / GDPR)

Depending on your situation you can ask to access, correct, delete, or export personal data we hold as controller, object to certain processing, or restrict it. We verify identity and authority before acting, normally respond within one month, and explain any applicable extension or refusal. Minimal request and action records may be retained to document how a request was handled. For captured content, ask the account owner first — they control what was sent in. You can also complain to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Changes

We may update this statement. The “Last updated” date at the top changes when we do. For material changes that affect how we use account data, we will also notify account owners by email when practical.

Contact

Questions or requests: privacy@ammo.solutions

AMMO Solutions — Kloosterdijk 6, 1141 PJ Monnickendam — KvK 68679750 — VAT NL001694241B13