Privacy & GDPR

Tratto is built on EU infrastructure by default, not retrofitted for compliance. This page covers what that means in practice, and what to expect if you're evaluating Tratto for a GDPR-sensitive workload.

EU-Native Infrastructure

Tratto runs on Google Cloud's EU region. Your data (contacts, email content, event logs) is stored and processed there, not exported to the US and synced back.

Cookie Consent & Analytics

The Tratto marketing site loads no analytics scripts by default. Google Analytics 4 (via Google Tag Manager) only activates after a visitor explicitly accepts the cookie banner, and is configured to avoid collecting personally identifiable information.

Unsubscribe and the Preference Page

Every campaign and flow email offers the recipient two ways out, and both work without any infrastructure on your side.

One-click unsubscribe in the mail client. Campaign and flow emails carry the List-Unsubscribe and List-Unsubscribe-Post headers, so mail clients that support one-click unsubscribe (Gmail, Outlook and others) show their own unsubscribe button. The header always points at Tratto's API, never at a web page, and a click unsubscribes the contact at once. Transactional emails sent with POST /v1/emails are not tied to a contact and do not carry these headers.

The preference page. The {{unsubscribe_url}} link in the email footer opens a page on app.tratto.email/preferences where the recipient can:

• unsubscribe from every email of that sender;
• turn off open and click tracking and keep receiving emails (see below);
• subscribe again, if they had unsubscribed. This is not offered to an address suppressed after a bounce or a spam complaint: those stay suppressed, and the page tells the recipient to contact the sender.

Each link is signed and belongs to one contact, so the page needs no login. Unsubscribe links in emails sent before the page moved to app.tratto.email still work: they redirect to it. If your workspace has set its own unsubscribe page (customUnsubscribeUrl on PATCH /v1/workspace), the footer link goes there instead, with contact and email added to the query string; the one-click header keeps pointing at Tratto.

Unsubscribing, from either path, moves the contact to unsubscribed and cancels the emails still waiting to go to them (they count as skipped in the campaign stats). See Contacts for the API.

Tracking Pixel Consent (Garante Privacy Order No. 284/2026)

Italy's Data Protection Authority (Garante Privacy), Order No. 284 of 17 April 2026 (doc. web no. 10241943), sets out obligations for anyone using tracking pixels in email. If you send campaigns or flows through Tratto, three obligations apply to you as the sender:

1. Clear, transparent notice: recipients must be told that opens and clicks are tracked.
2. Free, specific consent: general newsletter sign-up consent isn't enough, tracking needs its own consent.
3. Granular revocation: recipients must be able to withdraw tracking consent easily, without being forced to unsubscribe from everything.

What Tratto does technically: the open pixel (a transparent 1×1 GIF) and click tracking only fire for emails tied to a known contact (campaigns, flows), never for pure transactional sends like a password reset, where there's no engagement purpose to justify it. The open event never carries the recipient's address, only an internal identifier resolved server-side. Opens and clicks are recorded only within 30 days of sending: after that, a tracked link still takes the recipient to its destination, but the click is not recorded.

Revoking tracking consent: the preference page has a separate switch that turns tracking off while the recipient stays subscribed. From then on, campaign and flow emails reach that recipient with no open pixel and no click tracking: both stop together. The choice applies to emails sent after it, and the recipient can turn tracking back on from the same page.

What this means for you as the sender:

• The contact shows trackingOptOut: true in the Contacts API and in the dashboard.
• You can set the opt-out yourself (for example, to honour a request that reached you by email), but you cannot clear it: PATCH /v1/contacts/:id with trackingOptOut: false on a contact who opted out answers 403 FORBIDDEN. Only the recipient can turn tracking back on.
• Campaign stats count these recipients as untracked and leave them out of the open and click rates, which are never estimated for them: see Campaigns.

Controller vs. Processor

Who's responsible for a data subject request depends on who sent the email:

• Tratto sent it directly: waitlist confirmations, account/product emails, our own marketing. Tratto is the data controller. See Data Subject Rights below.
• A Tratto tenant sent it: a business using Tratto's API to send their own transactional or marketing email. Tratto is the data processor acting on that tenant's behalf; the tenant is the data controller for their own recipients. See If a Tenant Sent You an Email below.

If you're not sure which applies, check who the email is from: that's the controller.

Data Subject Rights (Tratto as Controller)

For emails Tratto sends directly (waitlist, account, our own marketing), you can request access to, rectification of, or deletion of your data by writing to privacy@tratto.email.

If a Tenant Sent You an Email

If you received a transactional or marketing email sent by one of Tratto's customers through our API, Tratto processed that email on their behalf but does not control it: the sending business is the data controller and is responsible for honoring your access, rectification, or erasure request within the timeframe required by applicable law (GDPR: generally one month). Contact the sender directly, not Tratto.

---

Questions about a specific compliance requirement? Write to privacy@tratto.email.