|
To the consent extremists here - if you're a FastMail customer - have you gained consent from every one of your correspondents to share their details with FastMail?
They could know you use FastMail by resolving the MX servers, and confirming that their emails are going to FastMail. Do you believe you have the right to leave FastMail and take your email to a different email provider without confirming explicit consent from every person who's emailed you?
Because that's what we're talking about here. Is FastMail allowed to use a third party to send email on our behalf, having assessed that third party's privacy policy and confirmed that it's compatible with the privacy guarantees we offer to our customers. I absolutely MUST reserve the right to do that in the future, because the alternative would be placing unreasonable constraints on our ability to do our jobs by using third party tools if that's the best choice at the time.
What I have promised is that we will document which third parties we're using and inform customers in advance about which data is processed by those third parties. An example of a fairly recently added third party is that we're using a company called Sentry (sentry.io) to process and monitor error reports, allowing our dev team to more easily see clusters of errors and collaborate over fixes. Sometimes crash traces include usernames and other personal data, so we rely on their privacy policy about how they act as a data processor on our behalf.
The only alternative would be to become experts in everything and build everything in-house. Over time, that has become less and less tenable as we found we were spending a lot more maintaining our own half-baked tooling than it would cost to use a solution run by experts in that space. This is exactly the same way our customers use FastMail rather than running their own mail server and writing their own webmail system.
|