Moosend

GDPR overview

GDPR compliance is claimed in plain terms. The Trust Center states that Moosend runs a privacy programme built to comply with applicable data protection laws including GDPR, and the FAQ repeats it. The commitments are contractual rather than merely declarative: a public Data Processing Addendum is incorporated into the Terms by reference, a separate GDPR Addendum covers EEA and UK users, and international transfers rest on the 2021/914 Standard Contractual Clauses together with the ICO's UK Addendum, the clauses themselves governed by Irish law. A Data Protection Officer has been appointed, though not named. Rights are exercised through a dedicated request form, privacy@moosend.com, or the Legal and Compliance team. ISO 27001 certification, annual third-party audits and NIST SP 800-171 and PCI alignment round it out. No Article 27 EU representative is named anywhere on the site.

Who owns the data?

The Terms and Conditions are explicit: Customer Data — contact lists, campaign content and, expressly, generative AI inputs and outputs — belongs to and is controlled by the customer, with Moosend acting only as a processor. The customer grants Moosend a non-exclusive, non-transferable licence limited to the subscription term and to performing the contract. Ownership splits elsewhere: Moosend owns the Usage Data drawn from the account, such as login frequency, feature use, campaign counts and open rates, and may use it internally to improve the service provided the customer is not identified. Any feedback submitted becomes Moosend's under a perpetual, worldwide, royalty-free licence.

Reuse rights

Customers may reuse their own data freely and without asking: Moosend claims no ownership over it, and its licence covers only what running the service requires. On written request the company will return a complete copy by secure file transfer, or delete it and have its sub-processors do the same, subject to legal retention duties. Because generative AI inputs and outputs are classed as Customer Data, subject lines and copy produced by the AI Writer can be published and reused without further permission — though the terms warn that other customers may generate identical outputs, over which no exclusivity is granted. Two limits apply: restricted data such as payment card details, health records or GDPR special categories must not be uploaded without prior written consent, and Usage Data stays with Moosend.

Data retention & training

Hosting summary

Moosend runs entirely on Amazon Web Services. The Trust Center states that customer contact data is hosted in the EU, and the published sub-processor list is more specific: AWS and Microsoft Azure both operate from Ireland and Germany, while Neverbounce, used for list validation, sits in the United States. AWS data centres are described as certified against ISO 27001 and SOC 2. All data is encrypted in databases and in transit, and encrypted backups are stored off-site. The Data Processing Addendum is more expansive on jurisdiction: it states that Moosend transfers customer personal data to its servers in the United States and anywhere else its affiliates and sub-processors maintain processing operations. Those transfers rely on the 2021/914 Standard Contractual Clauses, the ICO's UK Addendum and Swiss equivalents, with Irish law governing the clauses themselves. Organisations with strict residency requirements should read the EU-hosting claim as applying to contact data in particular, and seek written confirmation for the rest.