Security and Data Handling

Every time one of your subscribers opens an email with an Alterable image in it, their email client asks our servers for that image. That request is how a countdown shows the right time and a map shows the nearest store. It also means we see a little information about each reader, on your behalf.

This page covers what that information is, what we do with it, and how long it stays. It’s written for the person on your team who has to answer “is this vendor OK?” before you sign up.

What we collect when an email is opened

When a reader opens your email (or clicks, or votes in a survey), we record:

• The IP address, cut down to its network. We keep the first three parts of an IPv4 address (81.17.240.0 instead of 81.17.240.123) and the first 48 bits of an IPv6 address. The full address is used for a moment to work out the reader’s location, then dropped.
• An approximate location: country, region, city and time zone, looked up on our own servers. No IP address is sent to a third-party location service.
• The device and email client, from the request’s user agent.
• When it happened: the time of each open and click.
• Survey and poll votes and scratch card plays, if you use those services.

If you pass a subscriber ID or email address in an image URL (a merge tag such as ?uid=), we never store it as sent. It’s replaced with a keyed hash before it touches the database, which still lets us count unique readers.

Opening an email sets no cookie. When a reader votes in a poll or survey, plays a scratch card or clicks a social count, and your link doesn’t say who they are, we set one cookie holding a random ID for a year. That’s how we stop the same reader from voting or counting twice. It isn’t used for anything else.

We don’t build profiles of readers, and we don’t share or sell their data.

How long we keep it

Opens and clicks are kept for the current calendar year and the two full years before it. A scheduled job deletes everything older, every night. That’s long enough for your “Last year” stats and their comparison with the year before, and no longer.

You can delete your account yourself, under Settings → Security. We keep its data for 14 days in case it was a mistake, then delete it permanently: the account, its services, uploaded images and every open, click and vote recorded for it. Invoices are the exception: tax law requires us to keep them. Database backups roll over within 7 days.

Where your data lives

Alterable runs on DigitalOcean in New York, USA: the application, the database and file storage. Cloudflare sits in front of it, so requests are answered from the location closest to each reader.

Those are the only two providers that handle reader data. Some services call other providers, but without anything that identifies a reader:

• Local maps request base maps from Geoapify, using a map area snapped to a grid.
• Weather rules ask Apple WeatherKit for the weather at coordinates rounded to about a kilometre.
• Place names in location rules are looked up with Mapbox.

Payments go through Stripe. We never see or store card numbers.

How we protect it

• All traffic to Alterable is encrypted with TLS.
• The database is encrypted at rest and backed up daily, with point-in-time recovery over the last 7 days. Older backups aren’t kept.
• Cloudflare filters traffic before it reaches the application and absorbs denial-of-service attacks.
• Every account we use to run Alterable (hosting, network, source code) requires two-factor authentication.
• Your Alterable account supports two-factor authentication too.
• Each team’s services and statistics are kept apart in the application. Nobody in another team can see them.

You can check uptime and incidents on our status page.

GDPR and your subscribers

For your subscribers’ data, you’re the controller and Alterable is your processor: we handle it only to render your images and show you your stats. That data is stored in the United States.

Opens, clicks and votes are in your dashboard and available through the API, which is how you answer a subscriber who asks what you hold about them.

Questions and reports

Questions about privacy or data handling go to privacy@alterable.com.

Found a security issue? Email security@alterable.com with the details and how to reproduce it. Please give us a reasonable time to fix it before making it public.