Privacy policy
This policy covers two things: the website at spamex.dev, and the API at api.spamex.dev that processes contact-form submissions on behalf of our customers. Plain language first, legal detail where it matters.
1. Who we are
The service is operated by ShipMyForm, Building 16, Dubai Internet City, Dubai, UAE ("spamex", "we"). Contact for privacy matters: [email protected].
2. Two roles
For the website and your account, we are the controller of your data. For submissions your site sends to the API, you are the controller of your visitors' data and we act as a processor on your instructions. The API terms (in your dashboard) contain the data-processing terms; this page describes what actually happens.
3. Data we process through the API
When your backend calls /v1/classify we receive the fields you send: typically the visitor's name, email address, subject, message, IP address, user agent, and two timestamps from the form. We use them only to produce a verdict. What we keep afterwards depends on your key's settings:
| Data | Default | If "retain raw text" is on | Retention |
|---|---|---|---|
| Message text | SHA-256 hash and a 64-bit similarity fingerprint (SimHash). The text itself is discarded. | Stored in full so you can review verdicts and so the model can be retrained on your corrected examples. | Until you delete it (DELETE /v1/submissions/{id}) or close the account. |
| Verdict, score, stage, reason codes | Stored | Stored | As above |
| Visitor email address and IP | SHA-256 hash plus a masked display form (e.g. 203.0.113.x, m***@example.com) with decayed spam/ham counters shared across customers. | Same, plus the raw values inside the retained submission. | Counters halve every 14 days; a sender not seen for months effectively disappears. |
| Email domain | Stored in clear with counters (free-mail providers such as gmail.com are excluded). | Same | As above |
| Usage counts per key and month | Stored | Stored | Life of the account |
Language-model processing. Submissions the model cannot place confidently (about one in twenty) are sent to Google's Gemini API for a verdict, together with the site description you configured. We send only the fields needed to classify and do not send the visitor's IP. Google's terms for API data apply to that transfer; we do not permit training on it where the provider offers that control.
No selling, no third-party training. We do not sell submission data or use it to train models for anyone else. Hashed fingerprints and reputation counters are shared across customers because that sharing is what makes the filter work; nothing in them identifies a person.
4. Data we process for your account
- Email address, to sign you in with magic links and to send service notices. No password is stored; sign-in links are single-use, expire after 15 minutes, and are stored hashed.
- Session cookie (
sx_session): a random identifier, HttpOnly, 30 days. It is strictly necessary; there are no analytics or advertising cookies on this site. - API key metadata: a prefix and a hash of each key, its quota and settings. We never see or store the full key after creation.
- Contact-form messages you send us through this site: name, email, message, and the verdict our own API gave it. Kept until answered and for up to 12 months after.
5. Sub-processors
Provider Purpose Location Google (Gemini API) Gray-zone classification Per Google's API terms Cloudflare (Email Service) Transactional email (sign-in links, notices) Cloudflare's global network; see Cloudflare's data-processing terms Creem Subscription payments as merchant of record; we never see card details Per Creem's terms
6. Your rights
If you are in the EU, UK or a jurisdiction with similar law you can ask for access, correction, deletion, portability, or restriction of your personal data, and object to processing. Email [email protected]. Customers can delete individual submissions with the API and their whole account from the dashboard. If your data reached us through a customer's contact form, please contact that site; we will help them fulfil the request.
7. Security
Traffic is TLS-only. API keys and session identifiers are stored as SHA-256 hashes. Submission text is hashed by default. Access to production systems is limited to the operator. The service has been through a security review; its findings and fixes are available to customers on request. We will notify affected customers without undue delay if we become aware of a breach involving their data.
8. Legal bases (GDPR)
Account data: performance of a contract. API processing: performed on the customer's instructions under the processing terms. Reputation counters and duplicate fingerprints: legitimate interest in preventing abuse, balanced by hashing and decay. Contact messages: legitimate interest in answering you.
9. Changes
We will announce material changes to this policy by email to account holders and by updating the date at the top. Earlier versions are available on request.