Privacy Policy

Last updated: 19 June 2026

1. Who we are

Duta is a transactional email infrastructure platform operated by Duta ("we", "us", "our"). We provide developers and businesses ("tenants") with a REST API and dashboard to send transactional emails to their own end users ("recipients").

Our platform website is duta.indra.sh. For privacy enquiries, contact us at privacy@duta.indra.sh.

2. Information we collect

From tenants (developers and businesses)

  • Name and email address (used for your Duta account)
  • GitHub OAuth identity (if you sign up via GitHub)
  • Sending domain names you register with us
  • API keys you create (stored as hashed values — we cannot recover the plaintext)
  • Billing information (processed by our payment provider; we do not store card details)
  • Email sending activity: recipient address, subject, send time, delivery status

From recipients (end users of our tenants)

When a tenant sends an email through Duta, we process the recipient's email address and the content of the email solely to deliver it. We also receive bounce and complaint notifications from Amazon SES, which we use to maintain per-tenant suppression lists.

We do not build profiles on recipients, sell recipient data, or use it for any purpose other than delivery and bounce/complaint management.

Usage and technical data

  • API request logs (timestamp, endpoint, HTTP status, API key ID)
  • Email event logs (sent, delivered, bounced, complained) — retained for 30 days
  • Standard web server logs for duta.indra.sh and app.duta.indra.sh

3. How we use your information

  • To provide and operate the Duta platform
  • To deliver transactional emails on behalf of tenants
  • To enforce sending quotas, rate limits, and plan restrictions
  • To maintain suppression lists that protect sender reputation
  • To detect and prevent abuse, spam, and policy violations
  • To process billing and send account-related communications
  • To respond to your support requests

We do not use your data for advertising. We do not sell your data to third parties.

4. Bounce and complaint handling

Duta operates an automated bounce and complaint suppression pipeline. When Amazon SES notifies us that an email has hard-bounced or a recipient has marked a message as spam, we immediately add that address to the relevant tenant's suppression list. Suppressed addresses are blocked from receiving further emails from that tenant.

This process is required to maintain deliverability standards and comply with Amazon SES acceptable use policies.

5. Data sharing

We share data only with the following third parties, and only as necessary to operate the platform:

  • Amazon Web Services (AWS) — email delivery via Amazon SES; infrastructure hosting
  • Neon — managed PostgreSQL database hosting
  • Cloudflare — API edge hosting and DDoS protection
  • Upstash — Redis for rate limiting and job queuing

We do not share data with any other third parties unless required by law or to protect the rights and safety of Duta and its users.

6. Data retention

  • Email event logs: retained for 30 days, then permanently deleted
  • Suppression list entries: retained until the tenant removes them or closes their account
  • Account data: retained for the duration of the tenant's account, and deleted within 30 days of account closure on request

7. Your rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data
  • Export your data

To exercise any of these rights, email us at privacy@duta.indra.sh.

8. Security

We use industry-standard security measures including TLS encryption in transit, hashed API key storage, and access controls. Our infrastructure runs on Cloudflare Workers and AWS, both of which maintain SOC 2 compliance.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify active tenants by email. Continued use of Duta after changes take effect constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or requests, contact us at privacy@duta.indra.sh.