Trust Center

We process personal data as a processor acting on your documented instructions, under terms that form part of the Terms of Use.

• GDPR — processor role defined in writingYou are the controller and determine purposes and means; Popupsmart processes only on your documented instructions.
• CCPA rights honouredCalifornia residents can access, delete, and opt out of the sale or sharing of their personal information.
• Data Processing Addendum in forceThe DPA forms part of the Terms of Use, so it applies without a separate negotiation.
• Standard Contractual Clauses for transfersWhere personal data leaves the EEA, EU Commission-approved SCCs or another lawful mechanism applies.
• Purpose limitationPersonal data submitted through the Service is processed for providing that Service, not repurposed.

Measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure.

• Encryption in transitTraffic between browsers and our services runs over HTTPS/TLS; plaintext requests are redirected.
• Network and infrastructure securityServices run inside the security boundaries of our cloud providers rather than self-managed hardware.
• Data minimisationWe collect the data needed to operate the Service and campaigns you configure — not more.
• Private form storageForm submissions from popupsmart.com are written to private object storage, not a public bucket.

Access to systems holding personal data is restricted and granted on a least-privilege basis.

• Access controls and least privilegeStaff receive the minimum access their role requires, and no more.
• Confidentiality obligationsEveryone authorised to process personal data is bound by contractual or statutory confidentiality.
• Access reviewed on role changeAccess is revisited when someone changes role and revoked when they leave.

We build on established cloud providers and inherit their physical and platform security controls rather than running our own hardware.

• AWS — Dublin, Ireland (EU region)Cloud infrastructure and data hosting for the application.
• Microsoft Azure — North EuropeAdditional cloud infrastructure and hosting.
• Vercel — marketing site deliverypopupsmart.com is deployed as a static export on Vercel.
• Cloudflare — DNS, CDN and edgeCloudflare fronts the site with DNS, caching, and edge security.

Public endpoints sit behind Cloudflare, and every form on the site verifies that a human sent it.

• Cloudflare edge protectionTraffic passes through Cloudflare's network before reaching origin.
• Cloudflare Turnstile on every public formInvisible bot verification runs on contact, enterprise, ebook, opt-out, newsletter and feedback forms.
• HTTPS enforced site-wideEvery Popupsmart surface is served over HTTPS.

We monitor our services so that unusual activity surfaces quickly rather than sitting undetected.

• Monitoring and incident detectionListed among the technical and organizational measures in section 5 of the DPA.
• Availability monitoringService availability is monitored on an ongoing basis.

If personal data is affected by a security incident, our obligations to you are written into the DPA rather than left to goodwill.

• Notification without undue delayPopupsmart notifies the customer without undue delay after becoming aware of a personal data breach.
• Assistance with your obligationsWe assist the controller in meeting its own breach-notification duties under applicable law.
• Named privacy contactSecurity and privacy reports reach us at [email protected].

Payments are handled end to end by Stripe. Card data does not transit or rest on Popupsmart infrastructure.

• Stripe processes all paymentsStripe is our payment sub-processor for processing and billing.
• No card numbers on our serversFull card numbers are never stored by Popupsmart.

The people with access to systems are trained and contractually bound before they get it.

• Employee confidentialityAll persons authorised to process personal data are subject to appropriate confidentiality obligations.
• Security trainingEmployee security training is listed among the measures in section 5 of the DPA.

Whether you are a customer or an end user whose data passed through a campaign, the same rights apply.

• Access, rectification and erasureRequest a copy of your personal data, correct it, or ask us to delete it.
• Data subject requests routed to youIf an end user contacts us directly, we notify the customer rather than acting unilaterally on their data.
• Deletion or return on terminationAt the end of the Service, personal data is deleted or returned in line with the DPA.
• Opt out of sale or sharingCalifornia residents can opt out through the Do Not Sell My Personal Information form.

Third parties that touch personal data on our behalf are bound before they are onboarded, and we stay responsible for them.

• General authorisation with published listYou authorise sub-processors generally; the current list is published on this page.
• No-less-protective obligationsEach sub-processor is bound by data protection obligations no less protective than our DPA.
• Popupsmart remains responsibleWe stay fully responsible for the performance of our sub-processors.