Privacy policy

Last updated: November 2026

1. Who we are

Astonish Email Ltd ("Astonish", "we", "us") runs this website and the Astonish email marketing service. We are a company registered in England and Wales under number 08605617. Our registered office is Unit 4 Walworth Enterprise Centre, Andover, Hampshire, SP10 5AP, and our VAT number is GB165918573.

For anything about your personal data, email [email protected] or write to us at the address above.

2. What this policy covers

This policy explains how we use personal data about:

• people who visit our website;
• people who sign up for and use Astonish (our customers and their users); and
• people who use our free tools, such as the deliverability checker.

For this data we are the controller.

It does not cover the contacts our customers email through Astonish. For that data, our customer is the controller and we process it on their behalf, under the Data Processing Agreement in our terms and conditions. If you received an email sent through Astonish, the sender's privacy notice applies.

3. What we collect

• Account details: your email address and password (we store only a one-way hash of the password), and anything you add in your account settings, such as your name, company name, address and phone number.
• Billing details: your plan, payments and invoices. You enter card details with our payment processor; they do not reach our servers.
• What you create in Astonish: your campaigns, landing pages, images and contact lists. We process the contact data in them for you, as section 2 explains.
• How you use the website and service: your IP address, browser and device type, the pages you visit and the actions you take, with dates and times.
• Where you came from: if you accept analytics cookies, the campaign tags and referring page of your first visit. We store them with your account if you sign up.
• Messages: what you send us by email or through our contact form.
• Our free tools: see section 12.
• Ads on Facebook and Instagram: if you ask us to run ads for you, see section 13.

4. How we use it, and our legal basis

5. Automated checks for spam and fraud

When you edit or send a campaign, automated checks look for spam, phishing and fraud. One of these checks uses an AI model, which reads the campaign's content. If the checks find a serious problem, your account is suspended automatically and we email you to say why. You can appeal using the link in that email, and a person reviews every appeal.

6. Who we share it with

We use these kinds of service providers. Each one processes personal data only to provide its service to us.

• Our hosting provider, which runs our servers and database in Germany.
• Our cloud file storage provider, which stores the images and files you upload, in Ireland.
• Our email delivery provider, which sends your campaigns and our own emails (United States).
• Our email providers, which receive the messages you send us.
• Our network and security provider, which carries all traffic to our website (United States, with servers worldwide).
• Our payment processor (Ireland and United States).
• Our AI model provider, which processes the text of a campaign or page when you use an AI feature, and for the checks in section 5 (United States).
• Our error-monitoring provider, which receives technical details when something goes wrong (United States).
• Google Analytics, only if you accept analytics cookies (United States).
• Google Fonts, which receives your IP address when a page loads our fonts (United States).
• Wistia, which hosts our tutorial videos with its tracking turned off (United States).
• A web-page analysis service, which receives only the web address you give it when you import a design for a landing page (United States).
• Meta (Facebook and Instagram), which receives the ads we create for a customer who asks us to. It also receives the lead event described in section 13, only where the person ticks the Meta box on the form (Ireland and United States).
• Mail Deliveri, which runs the test mail server for our deliverability checker (section 12).

If you connect another service to your account, such as an accounting or CRM system, we exchange data with it on your instruction.

We may also share personal data with our professional advisers, with authorities when the law requires it, and with a buyer of all or part of our business, who would have to use it as this policy describes.

We do not sell personal data. We may publish statistics about how the service is used, but they never identify anyone.

7. Transfers outside the UK

Our main systems are in Germany and Ireland. The UK recognises the European Economic Area as giving personal data adequate protection.

Some of the providers in section 6 are in the United States. For each of them, we rely on the UK–US data bridge where the provider is certified under it. Otherwise, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in that provider's terms. Contact us for a copy of the safeguard that applies.

8. How long we keep it

• Account data and what you create in Astonish: while your account is open. If you ask us to delete your account, we delete this data within 30 days, apart from anything the law requires us to keep.
• Invoices and accounting records: six years after the end of the financial year they relate to, as tax law requires.
• Backups: we take a database backup every day and keep each one for 14 days.
• Server logs and error reports: up to 90 days.
• Deliverability checker: see section 12.

9. How we protect it

• Every page and login on our website uses HTTPS.
• Passwords are stored only as salted one-way hashes.
• Our servers accept website traffic only through our network and security provider. Administrative access goes over a private network, with key-based login.
• Sign-in and public forms are rate-limited.
• Only staff who need it for support and operations can see customer data.
• We back up the database daily to separate storage.
• Application errors are reported to us as they happen.

No system is completely secure. If a breach puts your personal data at risk, we will tell you and the Information Commissioner's Office where the law requires it.

10. Your rights

Under UK data protection law you have the right to:

• ask for a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• object to our use of it, including for marketing at any time;
• receive the data you gave us in a portable format; and
• withdraw your consent at any time, where we rely on it.

To use any of these rights, contact us as set out in section 15. We reply within one month.

You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.

11. Cookies

When you first visit our website, a banner asks whether you accept analytics cookies. Nothing that needs your consent is set until you accept. You can change your choice at any time with "Cookie settings" at the foot of every page.

The account area also stores a few display preferences in your browser, such as which editor tips you have seen.

Our tutorial videos are hosted by Wistia with its tracking turned off. The page shown to suspended accounts carries Facebook and Twitter buttons, which load only if you accept marketing cookies there.

You can also block or delete cookies in your browser settings. If you block essential cookies, you will not be able to log in.

12. Deliverability Checker Tool

Our free deliverability checker (www.astonishemail.com/tools/deliverability-checker) looks up your domain's public DNS records. When you use it, we store the domain you enter, a salted, one-way hash of your IP address (not the IP address itself), and the result of the check, for 30 days, after which it is deleted. Our legal basis for this is our legitimate interest in running the tool and preventing abuse of it.

If you paste a bounce message to have it explained, that text is stored alongside the result for the same 30 days and is not used for any other purpose.

If you choose to send a test email to the address the tool gives you, that message is received by a test server run by Mail Deliveri (maildeliveri.es), which provides this part of the tool on our behalf. We keep the test message there for 7 days, then delete it. The report built from it, which includes the sending server's IP address and name, the From: address and subject line, and the authentication results read from the message headers, is kept for 30 days like any other result. Mail Deliveri also checks the HTML of the message to see how email apps display it. The message is not shared with anyone else. Our legal basis is our legitimate interest in running the tool at your request.

We do not store an email address from this tool unless you tick the consent box and ask us to email you a copy of the report. If you do, we keep that email address, together with the domain you checked, for 12 months, then delete it. We use it to send you the report. This is a one-off email with no unsubscribe link; to have your email removed sooner, please contact us as set out in section 15 below. Our legal basis for the email address is your consent.

13. Ads on Facebook and Instagram

A customer can ask us to run Facebook and Instagram ads for their business. Our staff then set up and manage those ads, using the customer's own Meta ad account. The customer shares that ad account and its Facebook Page with our Meta business account, and we manage the ads through Meta's Marketing API. The customer keeps the ad account and pays Meta directly. We do not ask for the customer's Facebook password, and we do not use Facebook Login or collect data from anyone's Facebook or Instagram profile.

Each ad points to a landing page the customer has built in Astonish. The customer is the controller of the people who respond. We process that data for them, as section 2 explains.

What we get from Meta. For each ad, we get daily totals: how many times it was shown, how many people it reached, how many clicked its link, how much was spent and how many leads Meta counted. We also get whether Meta has approved each ad and, if it refused one, Meta's reason. These are totals. They do not identify the people who saw or clicked an ad.

What a landing page form records. When a visitor reaches a landing page from an ad and submits the form, we store what they typed into the form. If the web address they came from carries tracking tags (the utm_ tags) or Meta's click identifier (fbclid), we store those with the submission. They let the customer see which ad produced a lead. Section 8 sets out how long we keep this data.

Telling Meta about a lead. A landing page form used for ads shows a separate box, unticked, asking the visitor to agree to share their details with Meta so the ad can be measured. If it is not ticked, we send nothing about that visitor to Meta. If it is ticked, and the customer has connected a Meta dataset to their ad account, we send Meta one "Lead" event through its Conversions API. The event contains:

• a one-way hash (SHA-256) of the visitor's email address, not the address itself;
• the time of the submission, and the address of the landing page;
• the visitor's browser type; and
• Meta's click identifier, if the visitor arrived by clicking an ad.

We never send an IP address, a name or a phone number. Our legal basis is the visitor's consent, given by ticking the box. Meta receives the event as a recipient, and its own privacy policy explains what it does with it. We cannot recall an event once Meta has it, but ticking the box is never required to use the form.

Asking us to delete or stop. To have a form submission deleted, or to withdraw your consent to sharing with Meta, email [email protected] with the email address you used on the form and the page you used. We delete the submission from our systems and pass your request to the business that ran the form. We reply within one month. You can also manage how Meta uses your information in your Facebook and Instagram ad preferences.

14. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change materially affects how we use your data, we will also email account holders.

15. Contacting us

If you have any questions about this policy or your data, email [email protected] or write to Astonish Email Ltd, Unit 4 Walworth Enterprise Centre, Andover, Hampshire, SP10 5AP. If you are asking for a copy of your data, please tell us which email address your account uses.