Overview
This Policy describes how TLJ Apps handles information in connection with the Email Campaigns application for Bitrix24 (the “Application”). The Application lets you create and send email campaigns to your CRM contacts and send messages via automation rules, using the sending-provider credentials that you configure yourself. Unlike other TLJ Apps applications, this service necessarily processes and stores email addresses and engagement metrics in order to function.
Roles: Controller and Processor
You (the subscriber) are the controller of recipient data and responsible for having an adequate legal basis to contact them, including opt-in consent where required. TLJ Apps acts as processor, handling such data solely to perform the Application's functions per your instructions. You are solely responsible for the content sent and for the legitimacy of the lists used.
Data Processed and Stored
To operate, the Application processes and stores the following data per Bitrix24 portal:
- Recipients: email addresses and, when available, first and last names of the contacts you select in the CRM or enter manually, used to assemble and send the campaigns.
- Campaign content: subject, HTML body, images you upload, and sending settings (scheduling, pacing, and saved segments).
- Tracking events: delivery, open, and click records associated with the email address and campaign, used to produce the reports.
- Suppression list: addresses that bounced, complained, or unsubscribed, kept to prevent further sending to them.
- Sending credentials: your provider credentials (Amazon SES access key or SMTP username and password) that you provide, stored to authenticate sends on your behalf.
- Technical account record: portal identifier (member_id), domain, Bitrix24 access tokens, send counter, and Stripe subscription status/identifiers.
How We Use the Data
Data is used solely to: assemble and send the campaigns and automation messages you request; display performance reports; maintain the suppression list; and operate the subscription. We do not use recipient data for any purpose of our own, do not share it with third parties for advertising, and do not sell it.
Third-Party Services
- Your sending provider (Amazon SES or the SMTP server you configure): receives the emails for delivery. Sending reputation and compliance with the provider's policies are your responsibility.
- Amazon Web Services (SNS): when you use Amazon SES, bounce and complaint notifications may be sent to the Application to feed the suppression list.
- Stripe: processes subscription payments. Payment details are provided by you directly to Stripe, subject to Stripe's privacy policy (stripe.com/privacy). We have no access to card data.
- Cloudflare: the Application's runtime and storage infrastructure (Cloudflare Workers and KV), with communication exclusively over HTTPS/TLS.
Tracking and Unsubscribe
Campaigns include an open-tracking pixel and rewritten links to measure opens and clicks, plus a mandatory unsubscribe link in every message. Unsubscribing adds the address to your portal's suppression list, preventing further sending. This tracking is a feature under your control as the sender and is limited to your own campaigns.
Retention and Security
Campaign, recipient, event, suppression, and credential data are retained while the Application is installed on your portal. All communication happens over HTTPS with TLS. Sending credentials and Bitrix24 tokens are used only to carry out your operations. You may request deletion of your portal's data at any time, and uninstalling the Application stops processing; records can be erased upon request.
Your Rights and Recipients' Rights (LGPD)
Under Brazil's General Data Protection Law (Law No. 13.709/2018), data subjects have the rights of access, correction, deletion, and objection. As processor, we honor requests forwarded by you, as controller. Recipient requests (for example, deletion or unsubscribe) should be directed to you; we can assist technically with removal. To request deletion of your portal's data, contact us at contato@tlj.net.br.