In short: We use your account data to run the service and bill you. Email passing through Spambil is scanned automatically on our servers in Türkiye. Nobody reads it, and it is not used for marketing or sold to anyone. Analytics only load if you accept them. We do not see your card details: international payments are handled by Paddle.
1. Who we are
Spambil is operated by JusBil Yazılım Teknoloji Otomotiv Ltd. Şti. ("JusBil", "we", "us"), Fevzi Çakmak Mah. Büklü Sk. No:16 İç Kapı No:2, Pendik / İstanbul, Türkiye (MERSİS 0484234383100001, tax number 4842343831). You can reach us about privacy at info@spambil.com or +90 850 242 16 23.
2. Our role: controller and processor
- Controller. We are the controller of the personal data described in this policy: data about website visitors, and about customers and their users who hold a Spambil account (for example contact, account, billing and security data).
- Processor. When we scan, relay and quarantine email for a customer's domain, we process the content and metadata of that email on the customer's behalf and on its instructions. The customer is the controller of that data, and our Data Processing Addendum applies. If you have sent an email to, or received one at, a domain protected by Spambil and have a question about it, please contact the organisation that owns that domain first. We will help them respond.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, company name, phone number | You, when you sign up or contact us |
| Account and service | Protected domain(s), mail server address, plan and subscription status, panel settings (such as allow/block lists and daily summary preference) | You, and our systems |
| Billing | Plan, amount, currency, payment status, Paddle customer/subscription/transaction IDs, billing country | Paddle (international orders) or PayTR (Turkish orders) |
| Security and sign-in | IP address, one-time sign-in codes, session records, timestamps | Your browser and our systems |
| Quarantine metadata shown to you | Sender, recipient, subject, date and spam score of filtered messages | Email received for your domain (processed as your processor, see section 2) |
| Correspondence | Messages you send to us, reseller applications | You |
We do not collect your full card details. Card payments for international customers are processed by Paddle and, for Turkish customers, by PayTR.
4. Why we use it and our legal bases
If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, providing the Service, customer support | Performance of a contract (Art. 6(1)(b)) |
| Passwordless sign-in, fraud and abuse prevention, keeping our systems secure | Legitimate interests in securing the Service (Art. 6(1)(f)), and contract |
| Service emails: sign-in codes, setup and payment notices, daily quarantine summaries | Performance of a contract (Art. 6(1)(b)) |
| Billing, invoicing, accounting and tax records | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Improving the Service, handling disputes and legal claims | Legitimate interests (Art. 6(1)(f)) |
| Responding to lawful requests from authorities | Legal obligation (Art. 6(1)(c)) |
We do not use personal data for automated decision-making that produces legal or similarly significant effects on you. Spam scoring is applied to messages, not to decisions about people. We do not send marketing emails without your consent.
5. Email that passes through Spambil
Email sent to a protected domain is received on our servers in Istanbul, Türkiye, and scanned automatically for spam, viruses and phishing. Clean messages are relayed to the customer's own mail server. Suspicious messages are kept in quarantine for up to 2 years and are then deleted automatically, unless the customer releases or deletes them first. Scanning is fully automated. Our staff do not read message content, except where a customer asks us to investigate a specific message or where we are required to by law. Email content is never used for advertising and never sold.
6. Who we share data with
We do not sell personal data. We share it only with the service providers we need to run Spambil, and only as much as they need:
| Recipient | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website and panel hosting, content delivery, DNS, security, account database and logs | Global network (including the USA and EU) |
| SMTP2GO | Sending service emails (sign-in codes, notices, daily quarantine summaries) | SMTP2GO data centres (see their privacy notice) |
| Paddle.com Market Limited | Reseller and Merchant of Record for international orders: payment, invoicing, tax, and billing support. Paddle acts as an independent controller under its own privacy notice. | United Kingdom, and Paddle's providers |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Card payments for customers billed in Turkish lira | Türkiye |
| Authorities, courts, professional advisers | Where required by law, or to establish or defend legal claims | Mainly Türkiye |
If we are involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner, subject to this policy.
7. International transfers
We are based in Türkiye, and email scanning and quarantine take place on our servers in Istanbul. Türkiye has not received an adequacy decision from the European Commission or the UK. When we receive personal data from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum) together with additional safeguards, as set out in our Data Processing Addendum.
Some of our service providers process data outside the country where you are located, including in the USA (Cloudflare). Where required, those transfers rely on appropriate safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework where the recipient is certified. You can ask us for more information about these safeguards.
8. How long we keep data
- Account and service data: for as long as your account is active, then deleted or anonymised, except where we must keep it longer.
- Billing and accounting records: for the periods required by Turkish tax and commercial law, currently up to 10 years.
- Quarantined email: for up to 2 years, then deleted automatically. After a subscription ends, remaining quarantine data and message metadata are deleted within 90 days.
- Sign-in codes and sessions: codes are short-lived and single-use. The session cookie expires after 30 days, or earlier when you sign out.
- Correspondence: for as long as needed to handle your request and any follow-up.
9. Security
We protect personal data with measures appropriate to the risk, including encrypted connections (TLS) for the website, the panel and mail transfer where the other server supports it, restricted and authenticated administrative access, passwordless sign-in with short-lived codes, HttpOnly and Secure session cookies, regular software updates, and automatic deletion of quarantined messages. No system is completely secure. If a personal data breach affects you, we will notify you and the authorities where the law requires it.
10. Your rights
EEA, UK and Switzerland
Under the GDPR and UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests), to data portability, and to withdraw your consent at any time without affecting earlier processing. You also have the right to complain to the data protection authority in your country of residence or work, or where an alleged infringement took place.
California and other US states
If US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA apply to you, you have the right to know what personal information we collect and how we use and disclose it, to access it, to have it corrected or deleted, and not to be discriminated against for using these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it. The categories we collect, their sources, purposes and recipients are listed in sections 3 to 6 above. You can use your rights yourself or through an authorised agent.
Türkiye
If you are in Türkiye, you also have the rights set out in Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK). Our Turkish-language information notice gives more details.
How to exercise your rights
Email info@spambil.com from the address registered to your account, or tell us how we can verify your identity. We respond within one month (GDPR), or within the period the applicable law requires (for example 45 days under the CCPA), and we will tell you if we need to extend it. For email processed on behalf of a customer, we will pass your request to that customer.
11. Children
Spambil is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Cookies
We use a strictly necessary session cookie for the panel and security cookies from Cloudflare. The English site uses no analytics or tracking cookies. Our Turkish-language pages (the site root, not /en/) use Google Analytics, Google Ads conversion measurement and Yandex Metrica only after the visitor accepts them in the Turkish cookie bar; that use is described in our Turkish cookie policy. See our Cookie Policy for the full list and how to change your choice.
13. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change significantly affects how we use your personal data, we will tell account holders by email before it takes effect.
14. Contact
For any privacy question or request: info@spambil.com, +90 850 242 16 23, JusBil Yazılım Teknoloji Otomotiv Ltd. Şti., Fevzi Çakmak Mah. Büklü Sk. No:16 İç Kapı No:2, Pendik / İstanbul, Türkiye. You can also use our contact page.