Privacy Policy

Sendemail Tech Private Limited, registered at Office no 16, Kanakpur, Thane, Mumbai, Maharashtra 431302, is the data controller for account and website data, and a data processor for prospect data you upload into the platform.

We collect three broad categories of data:

We process data to provide and secure the Service, authenticate users, send emails on your instruction, verify addresses, monitor deliverability, generate analytics, provide support, bill your subscription, and comply with legal obligations.

We do not sell personal data. We do not use your Customer Data to train shared AI models. AI features process your content transiently to generate output for your workspace only.

Where the GDPR applies, we rely on performance of a contract (providing the Service), legitimate interests (security, product improvement, B2B communications), consent (marketing cookies and optional communications), and legal obligation (tax and accounting records).

When you connect Gmail, Google Workspace or Microsoft Outlook, we request the minimum scopes needed to send email and read replies to your campaigns. OAuth tokens are stored encrypted and can be revoked at any time by disconnecting the mailbox or from your provider's security settings. We never request or store raw mailbox passwords for OAuth providers.

We share data with vetted sub-processors that support the Service: cloud hosting, email infrastructure, verification providers, AI model providers, analytics, payment processing and customer support tooling. Each is bound by contractual confidentiality and data protection obligations. A current sub-processor list is available on request to legal@sendemail.tech.

Data may be processed outside your country. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards. Enterprise customers may select India or EU primary data residency.

Account data is retained for the life of the subscription and for up to 12 months afterwards. Customer Data is deleted within 30 days of termination unless you request earlier deletion. Financial records are retained for eight years to meet Indian statutory requirements. Diagnostic logs are retained for 90 days.

We use TLS 1.2 or higher in transit, AES-256 encryption at rest, role-based access control, least-privilege internal access, audit logging, regular dependency scanning and periodic penetration testing. Suspected breaches are investigated immediately and notified to affected customers and authorities within the timelines required by law.

Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to certain processing, and withdraw consent where processing is consent-based.

Requests can be sent to legal@sendemail.tech and are answered within 30 days. If you are a prospect who received an email sent through our platform, we will route your request to the relevant customer, who controls that data, and assist them in fulfilling it.

The Service is a business tool and is not directed to individuals under 18. We do not knowingly collect data from children.

We will notify customers of material changes by email or in-app notice at least 15 days before they take effect, and update the “last updated” date above.