Privacy Policy

RAPID SMTP is a self-serve platform that lets you send transactional and bulk email through your own SMTP credentials. The service is operated by RapidHost BD, Dhaka, Bangladesh. For any privacy question, write to support@rapidhostbd.com. Security-specific reports should go to company@rapidhostbd.com.

We collect the minimum data needed to run the product. Concretely:

• Account data — your name, email address, hashed password, optional avatar, and the workspace plan you selected.
• SMTP credentials — host, port, username, password, encryption mode and the "from" address you configure. Passwords are stored encrypted at rest.
• Contact lists — recipient names, email addresses, groups, custom fields and unsubscribe state that you upload or add manually.
• Sending metadata — recipient address, subject line, template used, timestamp, delivery status, SMTP response codes, opens and clicks when you enable tracking.
• Operational logs — IP address, user agent, authentication events and admin actions for fraud prevention and abuse handling.
• Billing data — invoices and payment references; we do not store full card numbers.
• Support communication — anything you send to support@rapidhostbd.com.

We do not read the body of emails you send unless you explicitly share an example for support.

• Contract — to provide the dashboard, deliver your emails through the SMTP server you configured, and produce delivery reports.
• Legitimate interest — to keep the platform secure, prevent spam and abuse, debug failed sends, and improve the product.
• Legal obligation — to respond to lawful requests and keep tax/billing records.
• Consent — for optional newsletters and for cookies that are not strictly necessary.

• Account data — for the life of your account, then up to 30 days after deletion for backup expiry.
• SMTP credentials — until you remove the account or delete the workspace.
• Email logs — by default 12 months, after which they are aggregated and the recipient address is removed.
• Contacts — until you delete them; unsubscribe records are kept as long as the workspace exists to honour opt-outs.
• Audit logs — 12 months for security investigations.
• Billing records — as required by Bangladesh tax law (currently 5 years).

• SMTP passwords are encrypted with AES before being written to the database and never appear in plaintext in logs.
• All HTTP traffic is forced over TLS 1.2+; SMTP connections you configure use STARTTLS or SSL according to the encryption mode you pick.
• Database access is gated by row-level security so one workspace can never read another workspace's rows.
• Administrative access to production is limited to named engineers and is logged.
• Passwords are hashed using a modern, salted algorithm; we never store them in clear.
• Backups are encrypted and rotated automatically.

No system is perfectly secure. If you believe an incident has occurred, contact company@rapidhostbd.com and we will respond within 48 hours.

We share the minimum data needed to operate the platform with these categories of providers:

• Cloud hosting & edge network — to serve the dashboard and run server functions.
• Managed database & auth provider — to store your account, contacts and logs with row-level isolation.
• Transactional email provider — only for system notifications we send to you (password resets, billing receipts, failure alerts).
• Payment processor — to take card or mobile-wallet payments for paid plans.
• Analytics — privacy-respecting product analytics on the marketing site only. The authenticated dashboard is not tracked by third-party analytics.

We do not sell your data and we do not share it with advertising networks.

Some providers we rely on operate globally. When data leaves Bangladesh it is protected by contractual safeguards with the relevant provider. You can request the list of current subprocessors at any time.

Regardless of where you live, you can:

• Access a copy of the personal data we hold about you.
• Correct anything that is wrong.
• Export your contacts and email logs as CSV from within the dashboard.
• Delete your account, which removes your workspace data within 30 days.
• Withdraw consent for marketing emails at any time.
• Lodge a complaint with a data-protection authority where you live.

To exercise these rights, email support@rapidhostbd.com from the address on your account.

The service is not designed for anyone under 16. We do not knowingly create accounts for children.

We use a small set of cookies that are strictly necessary to keep you signed in and remember your theme. The marketing pages may set an anonymous analytics cookie. No advertising cookies are placed at any time. You can clear cookies through your browser; doing so will sign you out.

We will post any material change on this page with an updated date and, where appropriate, send a notice to your account email. Continuing to use the service after a change means you accept the updated policy.

Questions, requests or complaints: support@rapidhostbd.com. Postal address: RapidHost BD, Dhaka, Bangladesh.