GDPR Postmark
In an indie stack, Postmark is used for Transactional emails. Entity cited: AC PM, LLC. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Postmark
Yes. Public DPA.
Stated role
Processor (and service provider) of the personal information contained in contact data. The user is the controller.
Personal data
Email metadata, email address, message content, name and attachments added by the user, IP address, location, system, browser, device, and mail client, spam complaints.
Sub-processors of Postmark
List published on the EU privacy page.
Transfers outside the EU
Hosting / location
Primary data and servers at the Deft data center (near Chicago) and on Amazon Web Services. Postmark states that it does not plan to have servers in the EU.
EU–United States Data Privacy Framework
ActiveCampaign, LLC is registered, EU-U.S. Data Privacy Framework status: Active. AC PM LLC is listed as a covered entity.
Cookies
The policy indicates cookies, web beacons, and session replay for analytics, usage measurement, and improvement of the service. The browser can refuse cookies.
Typical use, written by StackLégal and not by the vendor: Transactional emails.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Postmark a processor within the meaning of the GDPR?
Processor (and service provider) of the personal information contained in contact data. The user is the controller.
What DPA does Postmark publish?
Yes. Public DPA. https://postmarkapp.com/dpa
Which further sub-processors does Postmark publish?
List published on the EU privacy page. https://postmarkapp.com/eu-privacy#sub-processors
Where does Postmark state that it processes data, including outside the EU?
Primary data and servers at the Deft data center (near Chicago) and on Amazon Web Services. Postmark states that it does not plan to have servers in the EU.
Is Postmark registered under the EU–United States Data Privacy Framework?
ActiveCampaign, LLC is registered, EU-U.S. Data Privacy Framework status: Active. AC PM LLC is listed as a covered entity. https://www.dataprivacyframework.gov/participant/4495
Which personal data does Postmark mention?
Email metadata, email address, message content, name and attachments added by the user, IP address, location, system, browser, device, and mail client, spam complaints.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.