1. Who we are and what this covers
ModularMail (“ModularMail”, “we”, “us”) provides an email marketing and booking request service for dental practices. This policy explains how we handle personal information. It covers two different roles, and which one applies to you depends on who you are:
- Practice owners and their staff (the people who sign up for and use ModularMail), and visitors to our website. Here we decide how and why your information is used, so we are the controller (in Australia, the “APP entity”). Most of this policy is about you.
- A practice’s patients and contacts (the people a practice emails, or who submit a booking request on its page). Here the practice decides how and why your information is used, and we handle it on the practice’s behalf as its processor. See section 4.
You can reach us about privacy at support@modularmail.io. Our address is 623 New South Head Road, Rose Bay, New South Wales 2029, Australia.
2. What we collect about practice owners and visitors
- Account details: your name, work email address, password (stored only as a one-way hash by our sign-in provider), and your practice’s website address.
- Practice and brand details: what we read from your public website or you tell us: practice name, address, phone, logo, colours, services, photos, opening hours and offers. These are mostly business details, but may include the names of practitioners.
- What you create: campaigns, emails, images, settings, and your conversations with our campaign assistant.
- Billing details: your billing contact, tax details and purchase history. Card details go straight to Stripe and we never see or store them.
- Usage and device data: pages and features you use, actions taken, approximate location from your IP address, browser and device type, and error logs, so we can run and secure the Service.
- Messages to us: support emails and anything else you send.
- Integrations you turn on: for example, the workspace details Slack shares with us when you connect it, or the audience details from Mailchimp.
We collect this from you, from your public website (using a website-reading provider), and from our service providers (for example, delivery and payment events).
3. How we use it, and why
| What we do | Our basis (GDPR and UK GDPR) |
|---|---|
| Create your account, set up your brand, generate and send your campaigns, host your booking page, and provide support | Performing our contract with you |
| Take payment, keep tax and accounting records | Contract, and legal obligation |
| Keep the Service secure, prevent spam and abuse, monitor sending health and fix problems | Our legitimate interests in a safe, working service |
| Understand how the Service is used and improve it (using aggregated or de-identified data where we can) | Our legitimate interests |
| Send you service messages (verification, receipts, important changes) | Contract, and legitimate interests |
| Send you tips and product news | Your consent, or our legitimate interests where the law allows. You can opt out at any time |
| Comply with the law and respond to legal requests | Legal obligation |
We do not sell your personal information, and we do not use it for advertising. We do not make decisions about you that have legal or similarly significant effects by automated means alone.
4. A practice’s patients and contacts
When a practice uploads contacts, we hold each person’s name, email address, and consent details the practice records (for example, how and when they agreed to receive email). We also hold what happens to the emails sent to them (delivered, opened, clicked, bounced, unsubscribed). When a patient submits a booking request on a practice’s page, we hold what they enter: their name, phone number, the service they are interested in, preferred day and time, and any email address or note they choose to add, along with the technical details of the request (such as IP address, used to stop spam).
The practice is the controller of this information. We use it only to deliver the practice’s emails, to pass booking requests to the practice, to report results to it, and as the practice instructs, under our Data Processing Addendum. We do not use it for our own marketing. We do not send it to our AI provider: names are merged into emails when they are sent.
If you are a patient or contact, your relationship is with the practice. To see, correct or delete your information, or to ask the practice to stop emailing you, contact the practice directly. Every email includes an unsubscribe link that works immediately. If you contact us instead, we will pass your request to the practice and help it respond, or tell you who to ask. If you tell us you do not want email from a practice, we make sure that practice cannot email you again through ModularMail.
5. How we use AI
We use an AI provider to write campaign copy and create images. What we send it is the campaign brief and practice details such as name, services and offers, plus the instructions that shape the output. We do not send your contact list or your patients’ details. Our provider does not use content sent through its business API to train its models by default.
AI output is reviewed against our compliance checks and by you before anything is sent. See our Compliance page.
7. Where information goes
We and our providers process information in several countries, including the United States, Canada, Australia, the European Union and the United Kingdom. When personal information leaves Australia, the UK or the European Economic Area, we make sure it is protected by an approved safeguard, usually the European Commission’s Standard Contractual Clauses (with the UK Addendum where needed), and in Australia by contracts that require providers to handle it consistently with the Australian Privacy Principles.
8. How long we keep it
- Account and practice data: while your account is open. After it closes, we delete or anonymise it within 30 days, except what we must keep.
- Contacts and booking requests: while the practice keeps them in its account, and on the same closing timeline. A practice can erase a contact at any time.
- Unsubscribes and erasures: we keep only a one-way hash of the email address (not the address), indefinitely, so the person can never be re-added by mistake.
- Billing and tax records: as long as tax and accounting law require, typically up to seven years.
- Security and usage logs: for a limited period needed for security and troubleshooting.
Our providers keep information for their own periods (for example, email delivery logs). Backups are overwritten on a rolling schedule.
9. Keeping it safe
We use encryption in transit and at rest, strict separation between practices’ data, access controls and signed, rate-limited endpoints. See our Security page. No system is perfectly secure. If we confirm a breach that affects your personal information, we will tell you and, where required, the regulator, as the law requires.
10. Your rights
Depending on where you live, you can ask us to:
- give you a copy of the personal information we hold about you;
- correct it, or delete it;
- restrict or stop how we use it, or object to a use based on our legitimate interests;
- give it to you, or to another provider, in a usable format (portability);
- stop sending you marketing, and withdraw consent you gave us.
Email support@modularmail.io. We may need to confirm who you are first. We aim to reply within one month (30 days) and will not charge a fee unless a request is clearly excessive. California residents have similar rights under the CCPA/CPRA, including to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell or share personal information for advertising, and we will not treat you worse for using your rights.
If you are not happy with our response, you can complain to your regulator: in Australia the Office of the Australian Information Commissioner (oaic.gov.au); in the UK the Information Commissioner’s Office (ico.org.uk); in the EU, your national data protection authority; in the US, the Federal Trade Commission or your state attorney general. We would like the chance to fix it first.
12. Children
ModularMail is for businesses and is not directed to anyone under 18. We do not knowingly collect their information as a customer. A practice may email its contacts, including parents, but it is responsible for doing that lawfully and for not uploading children’s details without a lawful basis.
13. Changes to this policy
We will update this policy when our practices change. If a change is material we will tell you by email or in the app before it takes effect. The date at the top shows the latest version.
14. Contact us
ModularMail, 623 New South Head Road, Rose Bay, New South Wales 2029, Australia. Privacy questions and requests: support@modularmail.io.