Privacy Policy
Effective [EFFECTIVE DATE]
This policy explains what personal data Send At ("Sendat," "we," "us") collects when you use sendat.app and our email service, and what we do with it. Questions go to [email protected].
1. Our two roles
- Your account and usage data. For data about you and how you use Sendat, we decide how and why it is used. Under laws like the GDPR we are the "controller," and under the California Consumer Privacy Act we are the "business."
- Your messages and domain content ("Your Content"). For the emails you send, receive, and store through Sendat, you decide what is done with them, and we handle them on your behalf. We are your "processor" or "service provider." People who email you should contact you, not us, about the content of those messages. If someone asks us for data that sits in your mailbox, we will refer them to you.
2. What we collect
You give us: - Account details: name or username, email address, and password or sign-in link - Domain details: the domains you add and their DNS records - Payment details, if you buy a paid plan (handled by our payment provider, which we will name before you pay) - Messages to our support team
Created when you use Sendat: - Your messages and attachments: sender and recipient addresses, subject, body, headers, and delivery status - Technical and security data: IP address, browser type, timestamps, and API request logs - Settings and API key metadata (we store only a hashed version of each API key)
From others: - Email addresses and content of people who send mail to you or receive mail from you through Sendat - Delivery information from our email delivery provider, such as bounces and complaints
3. How we use it, and why
| What we do | Why (legal basis under GDPR) |
|---|---|
| Create your account, set up your domains, send and receive your email | Contract: we need this to provide the Service |
| Keep the Service secure, prevent spam, phishing, and abuse, fix problems | Legitimate interests in running a safe service, and our legal duties |
| Scan messages automatically for spam, malware, and abuse | Legitimate interests in protecting you, recipients, and the Service |
| Answer your questions and send service notices | Contract and legitimate interests |
| Handle billing and taxes | Contract and legal obligation |
| Comply with the law and respond to valid legal requests | Legal obligation and legitimate interests |
| Send product news | Consent or legitimate interests, and you can opt out any time |
What we do not do with your messages. We do not sell your data. We do not use your message content for advertising. We do not use your message content to train AI models. We do not read your messages except as described in our Terms of Service.
4. Who we share it with
- Service providers (subprocessors) that help us run Sendat, such as email delivery, hosting, and DNS companies. They are listed on our Subprocessors page and may only use data to serve us.
- Authorities and legal requests. We may disclose data if we believe the law requires it, for example a valid subpoena or court order. We review requests, push back on ones that are too broad, and tell you about them unless the law forbids it.
- Safety and legal protection. We may share data to stop fraud, abuse, or threats to anyone's safety, and to report child sexual abuse material as the law requires.
- Business changes. If Sendat is involved in a merger or sale, data may transfer to the new owner, who must honor this policy.
We do not "sell" or "share" personal data as those terms are defined under California law.
5. International transfers
We are based in the United States, and our providers may process data in the United States and other countries. When we move personal data from the European Economic Area, the United Kingdom, or Switzerland, we use approved transfer tools such as the European Commission's Standard Contractual Clauses. If we appoint an EU or UK representative, we will list them here: [EU/UK REPRESENTATIVE, IF REQUIRED].
6. How long we keep data
| Data | How long |
|---|---|
| Account and domain details | While your account is open, then deleted within 30 days of closing |
| Messages and attachments | Until you delete them or close your account, then removed from our active systems within 30 days |
| Backups | Overwritten on a rolling basis within 90 days |
| Security and access logs | Up to 90 days |
| Billing records | Up to 7 years, as tax law requires |
| Abuse and enforcement records | As long as needed to enforce our rules, up to 3 years |
We may keep data longer where the law requires it or to resolve a dispute.
7. Your rights
Depending on where you live, you may have the right to:
- see the personal data we hold about you
- correct it, delete it, or restrict how we use it
- receive a copy of it in a portable format
- object to certain uses, or withdraw consent
- appeal our decision if we refuse a request
- complain to your data protection authority (for example, a supervisory authority in the EU or the UK Information Commissioner's Office)
- not be treated worse for using your rights, if you live in California or another U.S. state with a privacy law
To use a right, email [email protected]. We may ask you to confirm your identity first. We aim to reply within 30 days (45 days in California, with possible extensions where the law allows). If your request is about messages in someone else's mailbox, we will refer you to the account holder.
8. Security
We protect data with measures such as encrypted connections (HTTPS/TLS) to our website and API, hashed passwords and API keys, and limited access to production systems. No system is perfectly secure. Email is not end-to-end encrypted. If a breach affects your data, we will notify you and the authorities as the law requires.
9. Children
Sendat is for people 18 and older. We do not knowingly collect data from children. If you believe a child has given us data, email [email protected] and we will delete it.
10. Cookies and tracking
We use only the cookies needed to keep you signed in and secure. See our Cookie Policy. We do not use advertising trackers. We do not currently respond to "Do Not Track" signals because we do not track you across sites, and we honor Global Privacy Control signals.
11. Changes to this policy
When we change this policy, we will update the date above. For material changes, we will notify you by email or in the dashboard before they take effect.
12. Contact
Send At, [email protected]