MailerLite

The Data Protection Officer

Drag-and-drop plus HTML editors, reusable templates and genuinely deep segmentation — by engagement, geography, purchase history and signup source, with seven pre-built segments that self-update — go beyond the mid description, and automations run on form and group triggers with a webhook action available. We found no public information on a visual journey builder with branching, send-time optimisation, or campaign A/B testing that reports significance. 2 2 6 9 14

Report an error

The Data Protection Officer

SPF, DKIM and domain verification records are documented for both automatic and manual setup, hard bounces are automatically suppressed and three consecutive soft bounces are treated as hard, which is a real, documented bounce policy. We found no public information on DMARC guidance or complaint-loop handling, and nothing on warm-up or inbox-placement testing; a dedicated IP appears only as an Enterprise feature. 2 7 8

Report an error

The Data Protection Officer

Double opt-in is on by default on forms, customizable per form down to separate confirmation email and thank-you page, and extends to API and integration signups — the right default. But I found no public information on a stored consent record that would survive a complaint: nothing on source, IP or versioned wording per subscriber, and nothing on whether open and click tracking can be limited or switched off. Deletion within 30 days of an eligible request and a subscriber preference centre on paid plans are documented. 2 3 9

Report an error

The Data Protection Officer

Import arrives with field mapping, duplicate cleanup and a documented Mailchimp path, and export covers custom fields, subscription states including unsubscribed and bounced, per-campaign engagement and automation activity, in open CSV formats for administrators. Documented deletion within 30 days of an eligible request exists, though we found no public information on full-account export, contractual data return, or deletion that is evidenced rather than asserted. 3 11 12

Report an error

The Data Protection Officer

Webhooks are a mature surface — fifteen subscriber and campaign events, three retries at stated delays, HMAC-SHA256 signatures and batching — with named Shopify and WooCommerce integrations plus Zapier and a documented REST API with an MCP server. Gaps remain: no sandbox, rate limits only referenced in passing, transactional sending routed through a separate MailerSend account, and API sending excluded from the free plan. 1 2 3 13 14

Report an error

The Data Protection Officer

For EEA customers the contracting entity is MailerLite Limited in Dublin with hosting in Germany and the Netherlands and a published subprocessor list, but the EU-residency claim sits in FAQ and trust-page copy while the same page names Google Cloud Platform, a US-headquartered provider, as the infrastructure. The chain then runs through US processors — Intercom for support without a stated hosting region, OpenAI and Google Vertex AI for product features, Stripe and Oracle NetSuite — with the US entity leaning on the Data Privacy Framework, so answering where behavioural data lives still requires a transfer analysis. 3 3 4

Report an error

The Data Protection Officer

Prices are public with billing periods stated — the free plan at 250 subscribers and 2,500 monthly emails, paid tiers up to 500 subscribers — and overage is documented as an automatic tier upgrade charged to the card, with billing based on active subscribers only. But the captured prices stop at the 500-subscriber tier, the dedicated IP sits in an unpriced Enterprise plan, and VAT is addressed only as prices that "may be subject to applicable taxes". 2 2 2

Report an error