Legal
Privacy.
What happens to your data.
This policy covers the Arowana website, the platform in which customers manage their communication, and the emails Arowana sends itself. We describe what actually happens – not what would theoretically be possible.
Last updated October 18, 2026
This is an English translation for your convenience. Only the German version is legally binding; where the two differ, the German version prevails.
Who is responsible
The controller within the meaning of Art. 4 No. 7 GDPR is Colortreat GmbH & Co. KG, Gerhofstraße 1-3, 20354 Hamburg, Germany (see imprint).
- Email for privacy questions
- info@colortreat.de
- Phone
- 040 60056752
Two roles: controller and processor
We are the controller for our website, for the accounts of our customers and their teams, for payments, support and our own emails. The following sections up to and including product analytics are about this.
When customers use Arowana to manage their own contacts and send them messages, publish sign-up pages or use the tracking on their website, we process that data on their behalf and on their instructions (Art. 28 GDPR). The controller is then the customer, with whom we conclude a data processing agreement. If you receive messages from a sender who uses Arowana, please contact that sender first about your data – their contact details are in every message and on their pages. We still describe openly under what the platform processes for customers what the platform does technically.
Visiting the website
When you open one of our pages, our hosting providers process technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the status code, the page you came from (referrer), and your browser and operating system (user agent). Without this data the page cannot be delivered or protected against attacks.
The legal basis is our legitimate interest in a secure, working service (Art. 6 (1)(f) GDPR). The hosting providers' logs are deleted according to their retention periods (see retention).
We serve fonts from our own server; no third party is contacted for them when our pages load. Signing in also runs through our own pages and servers; your browser loads no third-party script for it (cookies). The API documentation at /docs/api loads its viewer (Scalar) from the jsDelivr content delivery network and its fonts from Scalar's servers (fonts.scalar.com); jsDelivr and Scalar receive your IP address and browser data in the process. The legal basis is our legitimate interest in working documentation (Art. 6 (1)(f) GDPR).
We use no ad networks, no social media plugins and no maps.
Sign-up, sign-in and your account
For an account we need your email address; first and last name are optional. If you sign in with another account (for example Google), we receive your name, email address and, where available, a profile picture from it. The sign-in accounts themselves (email address, password as a hash, connected Google account, sign-in times) are kept by Google Cloud Identity Platform in our own Google Cloud project (service providers); we do not store passwords ourselves. We send sign-in links and confirmation emails ourselves. We also store your language, your organisations and workspaces with your role in them, invitations you send or receive, your answers while getting started (such as what you want to use the platform for) and a log of important actions in the team (for example who started a campaign or changed a setting).
The legal basis is the performance of the contract for using the platform (Art. 6 (1)(b) GDPR); the activity log also serves our and your team's legitimate interest in traceability and security ((f)).
When you delete your account, we delete your sign-in account at Google Cloud Identity Platform and remove your name, email address and profile picture from your profile with us; an anonymous entry remains so that earlier actions in the team stay traceable. Organisations in which nobody else works are closed: their workspaces are archived and send nothing more. Their data stays stored for now – write to us if it should be deleted. We keep invoices and bookings for as long as the law requires.
Payment and invoices
You pay for credit, phone numbers and other paid services through Stripe. You enter card numbers and bank details directly at Stripe; we neither see nor store them. We keep the organisation's billing details (company name, billing address, billing email, VAT ID), the credit bookings and the invoices. Stripe calculates VAT (Stripe Tax) and has a VAT ID you provide checked with the competent authority.
The legal basis is the contract (Art. 6 (1)(b) GDPR) and our duty to keep books and records ((c), § 147 AO, § 257 HGB). Stripe analyses payment data to prevent fraud ((f)).
Emails from Arowana
Arowana itself emails you when your account needs it: invitations to a team, notices about senders, numbers, approvals and your credit, replies to support requests and test messages you send to yourself. We send them through our email service provider (service providers). We add no open pixel and no redirected links to these emails.
The legal basis is the contract (Art. 6 (1)(b) GDPR); invitations to people who do not have an account yet are sent in the legitimate interest of the inviting team ((f)). We do not send promotional newsletters.
Support and contact
When you write to us or open a support request in the platform, we store your details, your message and our reply to handle your request (Art. 6 (1)(b) GDPR, otherwise (f)).
Spam reports
On the “Report spam” page (linked at the bottom of our website and under every marketing email sent through Arowana) you can report a sender who sent you a message through Arowana that you didn't want. We store what you enter (channel, sender, the day you received it and, if you like, a description), your email address and a reference, and send you an email with an address to forward the message to. Amazon SES receives the forwarded message for us — with everything it contains, including your own address and attachments — and puts it in Amazon S3 (Amazon Web Services, Frankfurt); we copy it into our storage (providers) and link it to your report. Against misuse of the form we count reports per hash of your IP address and of your email address (built with a secret key); we don't store the IP address itself.
The purpose is to look into misuse of our platform and to enforce our rules towards our customers. The legal basis is our legitimate interest, and that of recipients, in a platform without spam (Art. 6 (1)(f) GDPR) and, where laws oblige us to act against illegal content, Art. 6 (1)(c) GDPR.
Recipients: only the staff of our Trust & Safety team see the forwarded messages. If we open a case against the sender — our customer — they learn that there is a report and what it is about, but not your name and not your address. Retention: we delete your address, your description and the forwarded messages 12 months after the case is closed; a report nothing is forwarded to is closed after 90 days. The copy at Amazon S3 is deleted after 90 days.
Product analytics
To understand which features are used and where getting started is hard, we may analyse use of the platform pseudonymously with PostHog (servers in the EU, Frankfurt). Recorded are page views with a cleaned address, clicks without text, technical device details, selected events (for example “campaign started”) and your internal user ID with us – no names, no email addresses, no content and nothing about our customers' contacts. No cookie is set and nothing is stored permanently in the browser; on start the script briefly creates test entries in browser storage, deletes them right away and reads its own settings. The data travels through our own domain; your IP address is passed to PostHog in the process (for coarse location and bot detection). If your browser sends “Do Not Track” or “Global Privacy Control”, no analysis takes place. Product analytics never runs on customers' published pages or unsubscribe pages.
The legal basis is our legitimate interest in improving the product (Art. 6 (1)(f) GDPR). You can object at any time – an email to us is enough, or switch on “Do Not Track” or “Global Privacy Control” in your browser.
What the platform processes for customers
Here we are a processor (two roles). Customers store contacts in Arowana (for example email address, phone number, name, consents with time, source and proof, attributes and notes) and send them emails, SMS and RCS messages. The platform stores which message went to whom and when, whether it was delivered, replies, unsubscribes and complaints. It automatically blocks undeliverable addresses and spam complaints from further emails.
Email opens
Our customers' newsletters and other bulk emails may contain an invisible image (open pixel). If your email program loads it, the platform stores, for that message, only the time and whether the request probably came from a machine (such as a security filter or Apple Mail's privacy proxy) – no IP address and no user agent. The IP address is only used briefly, as a hash, to limit abuse. Many email programs load such images automatically or through a proxy, so an open does not reliably mean that someone read the email. If you do not load images automatically, no open is recorded. Individual emails such as confirmations, receipts or codes contain no pixel. While emails are sent through Resend, Resend counts opens the same way with a pixel of its own. Customers can switch the pixel off by switching off link tracking for email.
Link clicks
Links in messages may be redirected through an address of the platform. On a click the platform stores the time, the link clicked, whether the click probably came from a machine, and a hash of your IP address made with a secret key – not the IP address itself and not the user agent – and forwards you immediately. If the link leads to the sender's website, an identifier (aw_c) may be added; it contains no email address or phone number but refers to the message, so the sender can attribute a later purchase or sign-up within up to 90 days to the message. Redirected links work for two years.
Analyses for the sender
From opens, clicks, replies, sign-ups and purchases the platform builds figures for the sender, assigns contacts to stages by rules the sender sets (for example “new”, “active”, “dormant”) and calculates an activity score to show the most active contacts. Such stages can automatically trigger further messages. Beyond that this has no legal or similarly significant effect on you.
Tracking on customers' websites
Customers can include a script of ours on their own website. Without consent it works without cookies and without browser storage and only reports page views and events (for example a purchase) with the address and referring page. Only after a consent obtained by the website's operator does it store a random visitor ID and the aw_c identifier in the browser's local storage to recognise visits; if your browser sends “Global Privacy Control”, it stores nothing. The IP address is only used as a hash against abuse. Whether and how the script is used is decided by the operator of the website; their privacy policy describes it.
Sign-up pages and privacy center
Customers can publish sign-up pages with the platform. What you enter there goes to the page's operator; with it the platform stores a hash of your IP address, your user agent, the referring page and campaign parameters, as proof of consent and against abuse. Page views are only counted as a daily total. The platform sets no analytics or advertising cookies there, product analytics does not load there, and fonts come from our own server. Videos from YouTube or Vimeo only load when you press “play”. In a sender's privacy center you can, after confirming with a code, see your data, change consents and request deletion; for this the platform sets a technically necessary cookie (aw_privacy) for 15 minutes.
Mailbox (landline numbers)
If a sender uses a landline number with a mailbox, the platform stores, for calls, the caller's number, the time, the duration and the message left as a recording. Recordings are deleted after the period the sender sets (90 days by default).
Connected services
On our customers' instructions the platform exchanges contact and order data with services they connect themselves – such as Shopify, HubSpot, Google Sheets, their own systems through APIs and webhooks, or their own PostHog. The customers are responsible for these services.
What the platform passes to service providers to deliver messages (email sending, SMS and RCS networks) is listed under service providers and recipients.
Service providers and recipients
We work with the following service providers. With each we have concluded a data processing agreement under Art. 28 GDPR; they process data only on our instructions. Where data goes to a country outside the EU/EEA, the basis is stated. Beyond that we only pass data on where the law obliges us to (for example to tax authorities) or where you initiate it (for instance by connecting another service).
Vercel
- Provider
- Vercel Inc., San Francisco, USA
- Purpose
- Hosting of the website, the platform's interface and customers' published pages.
- Data
- Connection data (IP address, time, address, user agent), server logs, all data transmitted through the pages.
- Legal basis
- Art. 6 (1)(b) and (f) GDPR
- Where
- Data centre in the EU (Frankfurt am Main); access by the provider from the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
Google Cloud
- Provider
- Google Cloud EMEA Limited, Dublin, Irland / Ireland
- Purpose
- Running the interfaces and background jobs (Cloud Run, Cloud Tasks), database (Cloud SQL), file storage (Cloud Storage), logs and monitoring; the platform's sign-in accounts (Identity Platform: sign-up, sign-in by link, password or Google, sessions).
- Data
- All platform data (accounts, organisations, our customers' contacts and messages), connection data and logs of the interfaces; for sign-in: email address, name, profile picture, password hash, connected Google account, sign-in times.
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- EU (Frankfurt am Main, region europe-west3); database backups in the EU. Access by Google LLC (USA) cannot be ruled out; the EU Standard Contractual Clauses and the adequacy decision for the EU-U.S. Data Privacy Framework apply.
Stripe
- Provider
- Stripe Payments Europe, Limited, Dublin, Irland / Ireland
- Purpose
- Payments, invoices, VAT calculation (Stripe Tax), VAT ID checks, fraud prevention.
- Data
- Billing email, company or workspace name, billing address, VAT ID, payment data (card, direct debit), amounts.
- Legal basis
- Art. 6 (1)(b), (c) and (f) GDPR
- Where
- EU; partly processed by Stripe, Inc. in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
Resend
- Provider
- Plus Five Five, Inc. (Resend), San Francisco, USA
- Purpose
- Sending emails – our own and our customers' – and delivery feedback.
- Data
- Sender, recipient address, subject and content of the email, delivery, bounce and complaint reports; for customer mail Resend also counts opens (see email opens).
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- Processed in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
- When
- While emails go through Resend; we are switching to Amazon SES.
Amazon Simple Email Service (SES)
- Provider
- Amazon Web Services EMEA SARL, Luxemburg / Luxembourg
- Purpose
- Sending emails – our own and our customers' – and delivery feedback.
- Data
- Sender, recipient address, subject and content of the email, delivery, bounce and complaint reports.
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- EU (Frankfurt am Main, region eu-central-1).
- When
- Once sending through Amazon SES is switched on.
Upstash
- Provider
- Upstash, Inc., Santa Clara, USA
- Purpose
- Cache for counters and limits against abuse (Redis); where used, a queue for background jobs (QStash).
- Data
- Keyed hashes of IP addresses and contact details with a short lifetime; for calls to the programming interface without a key, the IP address for 60 seconds; job identifiers (no content).
- Legal basis
- Art. 6 (1)(f) GDPR (legitimate interest)
- Where
- Processed in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
Cloudflare R2
- Provider
- Cloudflare, Inc., San Francisco, USA
- Purpose
- File storage.
- Data
- Brand logos and images, pictures visitors upload through forms on customers' pages, mailbox recordings (callers' messages), proof documents for ordering landline numbers.
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- Processed in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
- When
- While files are kept at Cloudflare rather than in Google Cloud Storage (Frankfurt).
Twilio
- Provider
- Twilio Ireland Limited, Dublin, Irland / Ireland
- Purpose
- German landline numbers for the mailbox: providing the numbers, calls and greetings.
- Data
- For the registration of the number required by regulation: company name, address, name and email of the representative, proof document. For calls: the caller's number, time, duration and the recording (we fetch it and then delete it at Twilio). No transcription.
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- Partly processed by Twilio Inc. in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
- When
- Only for customers who use a landline number.
mdex (SMS-Netz)
- Provider
- mdex (Deutschland)
- Purpose
- Delivering SMS through our own mobile numbers and receiving replies and delivery reports.
- Data
- Recipient's number, sender, text of the SMS, replies and delivery reports.
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- Germany.
- When
- Once SMS are sent through our own numbers.
BulkGate
- Provider
- TOPefekt s.r.o. (BulkGate), Tschechien / Czech Republic
- Purpose
- Delivering SMS and RCS messages through a partner and receiving replies and delivery reports.
- Data
- Recipient's number, sender, message content, replies and delivery reports.
- Legal basis
- On behalf of our customers (Art. 28 GDPR); otherwise Art. 6 (1)(b) and (f) GDPR
- Where
- EU.
- When
- Currently only for tests with approved test numbers; in regular operation once switched on.
PostHog
- Provider
- PostHog, Inc., San Francisco, USA
- Purpose
- Pseudonymous product analytics of the platform (see product analytics).
- Data
- Internal user ID (ours), cleaned page addresses, events, device and browser details, IP address (for coarse location and bot detection).
- Legal basis
- Art. 6 (1)(f) GDPR (legitimate interest)
- Where
- EU (Frankfurt am Main); access by the provider from the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
- When
- Only when product analytics is switched on.
Axiom
- Provider
- Axiom, Inc., San Francisco, USA
- Purpose
- Collecting and analysing error and operations logs.
- Data
- Log lines with internal identifiers (for example user and workspace ID), error messages.
- Legal basis
- Art. 6 (1)(f) GDPR (legitimate interest)
- Where
- Processed in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where the provider is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).
- When
- Only when log forwarding is switched on.
How long we keep data
- Account: as long as it exists. After deletion your profile is anonymised and your sign-in account (Google Cloud Identity Platform) deleted.
- Invoices, bookings and records: until the statutory retention periods end (up to ten years, § 147 AO, § 257 HGB).
- Support requests: as long as needed to handle them and possible follow-up questions.
- Spam reports: your address, your description and forwarded messages until 12 months after the case is closed; reports without a forwarded message are closed after 90 days.
- Our hosting providers' logs: according to their periods, usually a few weeks.
- Counters against abuse (hashes of IP addresses): minutes up to 26 hours at most.
- Data we process for customers: as long as they keep it in the platform and the contract runs. Independently, the platform deletes automatically: email open and delivery events after 180 days; clicks and website events after the period the sender chooses (30, 90, 180 or 395 days, 180 by default); SMS events and inbound messages after 35 to 180 days; mailbox recordings after the period set (7 to 365 days, 90 by default); proof documents for landline numbers 30 days after the order is completed; uploads on sign-up pages that were never submitted after 24 hours; privacy center confirmation codes after two hours.
- When a sender deletes a contact, the platform removes the contact with its events and empties the content and link of messages already sent; what remains is a non-reversible hash so the person is not contacted again by mistake.
- Database backups: 14 days, plus seven days for restoring any point in time.
Your rights
You have the right
- of access to the data we process about you (Art. 15 GDPR),
- to rectification of inaccurate data (Art. 16 GDPR),
- to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR),
- to data portability (Art. 20 GDPR),
- to withdraw a consent at any time with effect for the future (Art. 7 (3) GDPR).
Right to object: where we process data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop, unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
Just write to us at info@colortreat.de. If your request concerns data a sender processes through Arowana (see here), please address it to that sender or use their privacy center; if such a request reaches us, we forward it to them.
Complaint to a supervisory authority
You may lodge a complaint with any data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work. The authority responsible for us is:
The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 7. OG, 20459 Hamburg, datenschutz-hamburg.de
Obligation to provide data, no automated decisions
You can use the website without giving any personal details. For an account we need your email address, for payments your billing details – without them we cannot perform the contract.
There is one automatic decision in our customers' sending: if a sender's bounce or complaint rates over 30 days exceed set thresholds, the platform automatically issues a warning; after three warnings it pauses the workspace's sending until our team reviews the case. This protects recipients and the deliverability of all customers (Art. 6 (1)(b) and (f) GDPR). You can appeal a warning or pause in the platform within 30 days; a person decides on the appeal. Sending is likewise paused automatically if the credit falls below zero after a chargeback, until it is topped up again. Beyond that we make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
Changes
When the platform or the law changes, we update this policy. The version published here applies; its date is shown at the top.