Consent, unsubscribes and data requests, tracked in one place.
Mailnaptic gives you tooling to help you follow GDPR, CAN-SPAM, CCPA and CASL. It records consent, handles unsubscribes, keeps a suppression list and logs data requests. It does not replace legal advice.
Compliance tools and the audit log are on the Business plan.
Compliance (sample data)
86%
active
Active
86%
Suppressed
9%
Unsubscribed or withdrawn
5%
Recent automatic suppressions
Contact
Reason
Date
j.moller@example.com
Hard bounce
Today
sam@example.org
Spam complaint
Yesterday
Data Processing Agreement
Accepted
Consent status and an exportable consent log
Branded unsubscribe and preference pages
Suppression list for bounces and complaints
Access and deletion requests tracked
Consent log
Who agreed to what, and when
Every contact has a consent status: active, suppressed or withdrawn. The dashboard shows how your list splits across them, and the consent log records each event. Export it as CSV when a regulator or a customer asks.
Set a consent text version, so you know which wording a contact saw
Consent can be recorded per message type, such as newsletters and promotions
Double opt-in sends a confirmation email you can rewrite in your own words
Signup forms record consent with the source, the consent text version, the IP address and the time
The data processing agreement is accepted once and timestamped
Compliance / Consent
Consent log
Contact
Event
Version
anna@example.com
Opted in
v2.1
li@example.net
Confirmed (double opt-in)
v2.1
rob@example.org
Withdrawn
v2.0
mia@example.com
Opted in
v2.1
Export as CSV
Preference page (sample)
Email preferences
Choose what you want to hear about from Acme.
Weekly newsletter
On
Product updates
On
Promotions
Off
Receive fewer emails
Choose frequency
Unsubscribe from all emails
Unsubscribe and preferences
Leaving is easy, so people do it politely
The unsubscribe page uses your branding and you can preview it in settings. Before someone leaves for good, they can ask for fewer emails or pick the lists they still want. If they do leave, they can say why.
List-by-list preferences are optional, you switch them on
Subscribers can turn off open and click tracking for their address
Reasons are collected and shown on the dashboard, with an AI summary on request
Regional settings
Switch on the rules that apply to your audience
GDPR mode and CASL mode live in your organization settings. Turning one on adds the matching tools. The mailing address check works regardless: a campaign will not send if the sending domain has no physical address, which CAN-SPAM requires.
Settings / Privacy and compliance
GDPR mode
Consent tracking, right to be forgotten and data export.
CASL mode
Skips contacts whose implied consent is older than two years.
Email frequency capping
Maximum campaigns per contact, per day and per week.
Data retention
Retention period
730 days
When it expires
Or auto-delete, which cannot be undone
Suppress contact
Sending checks
Mailing address on domain
Present
Audit log
A record of who changed what
Sending a campaign, creating or revoking an API key, accepting the DPA, changing compliance, deliverability, preference or open tracking settings, and exporting or erasing contact data are logged automatically. So are team invites (created, resent, revoked and accepted), sending domain changes, plan and seat changes, webhook changes and webhook replays. The audit log is on the Business plan. The Business plan also adds an AI compliance review you can run on a campaign before you send it, which costs 8 credits.
Audit log
When
Who
Action
10:42
Dana
Sent campaign "Autumn offer"
10:15
Dana
Changed frequency cap
Yesterday
Omar
Created API key
Mon
Dana
Accepted the DPA
By regulation
What the product gives you for each
These are tools. Whether your sending is lawful depends on how you collect consent and what you send, so check with your own counsel.
GDPR
Consent tracking, a data subject request flow with erasure and export, a retention period, consent text versions and DPA acceptance.
CAN-SPAM
The mailing address check before sending, with the address added to campaign and automation footers when it is missing, unsubscribe handling that stays in force, and automatic suppression of bounces and complaints.
CCPA
Data export and deletion tools, a CCPA opt-out with restricted processing, an option to honor Global Privacy Control signals, and a preference page where subscribers can turn tracking off.
CASL
CASL mode, which skips contacts whose implied consent is more than two years old, plus double opt-in with your own confirmation email.
Setup
A first-day checklist
01
Add your mailing address
Put it on each sending domain. Campaigns are blocked at the send step without it.
02
Pick your modes
Turn on GDPR or CASL mode, set your consent text version and accept the DPA.
03
Check the dashboard
Watch consent status, suppressions and requests. Export the consent log when you need it.
FAQ
Questions, answered
Does Mailnaptic make me compliant?
No. It gives you tools that help you follow the rules. Compliance depends on how you collect consent and what you send, and we recommend asking a qualified professional about your case.
Can people unsubscribe from one list only?
Yes, if you switch on list-by-list preferences. Otherwise they can unsubscribe from everything or ask for fewer emails.
What happens when someone bounces or complains?
The contact is suppressed automatically and appears in the suppression summary. You can search the list and remove an address manually. Unsubscribed and bounced contacts are not added back by a contact import or the API. An account with a high bounce rate or several spam complaints is paused automatically, only Mailnaptic can lift the pause, and new accounts are reviewed by hand before they can send.
Which plan has the compliance tools?
The compliance tools, GDPR strict mode and the audit log are on the Business plan, as is the AI compliance review.
Is my data encrypted?
Yes. The database is encrypted at rest: every table in the Mailnaptic database uses InnoDB encryption with AES-256, and the key is kept apart from the data files and backed up outside the server. Backups are encrypted too, and traffic to the app and the API uses TLS. This protects the data files, copies of them and old disks. It does not replace access control, which is why API keys are scoped, changes go in the audit log and two-factor sign-in is available.
Get the compliance basics in place
Set up your domain, import your list and send your first campaign in minutes.
No credit card required. Free plan available.