Privacy policy

Last updated October 6, 2026. SendSend is currently in an invite-only beta.

This explains what personal data SendSend collects and handles, why, who we share it with and what choices you have. We keep it plain on purpose. If anything is unclear, write to us.

Two different roles

For your account (your email, organization, billing and how you use the dashboard) we decide how data is used. We are the data controller.
For the emails you send through us (their content, and the addresses of the people you email) you decide what is sent and to whom. We handle that data on your behalf, only to deliver and monitor your messages. You are responsible for having a lawful basis to send it.

What we collect

Account data: Your email address, name if you add one, your role, organization name, and the use-case application you submit (website, what you send, volume, a sample message, how recipients opt in).
Security data: One-time sign-in tokens and session records (stored as hashes), IP address and browser type at sign-in, API keys (stored as hashes; we cannot read them back), and audit-log entries of sensitive actions.
Message data: For every email you send: the sender, recipients, subject, body, tags, template variables you pass, delivery events (sent, delivered, bounced, complained), provider references and webhook delivery attempts.
Contact lists: If you use audiences and broadcasts: the contacts you add (email address, name, and any custom fields you define), their subscription choices, and what happened to each broadcast. You decide who is on your lists, and we handle them on your behalf.
Signup forms: If you use signup forms: the email address (and first name, if you ask for it) that a visitor types in, which becomes a contact on your list. To stop abuse we keep a salted hash of the visitor’s network address and of the email address for two days, to limit repeat signups.
Received email: If you use inbound email: the messages sent to your receiving address, with their content and attachments. Anyone can send to that address, so this can include personal data about people who are not our customers.
Billing data: Your plan, usage, and a Stripe customer reference. Cards are handled by Stripe; we never see or store card numbers.
Operational logs: Technical request logs (path, status, timing, IP address) used to run, secure and debug the service. We do not record query strings, cookies or authorization headers in them.

How we use it

To run the service: deliver your email, show you what happened to it, apply limits and bill you.
To keep it safe: review accounts, detect and stop abuse and fraud, suppress bad addresses, investigate incidents and meet our mail provider’s requirements.
To communicate: sign-in links, invitations, security and billing notices, and replies to your questions.
To improve and secure the product, using aggregated or operational data.

We do not sell personal data, and we do not use message content for advertising.

Who we share it with

Only the providers we need to run SendSend (our “subprocessors”), and only as needed:

Amazon Web Services — sends your email (Amazon SES) and queues work (Amazon SQS).
Railway — hosts our API, worker and database.
Vercel — hosts this website and the dashboard.
Stripe — processes payments and invoices.

We may also disclose data where the law requires it, to protect the rights, safety or security of our users or the service, or in a business transfer, in which case we will tell you.

Where data is processed

Our providers operate mainly in the United States, so your data is likely to be processed there. If you are elsewhere, that means it can be transferred across borders.

How long we keep it

Message content (the subject-free body and attachments of sent mail) is deleted after 30 days unless you choose a different period between 1 and 365 days in your organization settings. Recipients, status and the event history stay so you can see what happened.
Received email follows the same period, and you can delete a message sooner. Mail that fails the virus scan is discarded on arrival.
Contacts and broadcasts stay until you delete them or your account is closed.
Account data is kept while your account exists. After it closes we delete or anonymize it, except what we must keep for billing, tax, security or legal reasons.
Operational logs are kept for a limited period.
Suppression records (addresses that bounced or complained) are kept as long as needed to protect recipients from further mail.

Cookies and similar storage

The dashboard uses one essential session cookie to keep you signed in, plus browser storage for small preferences (such as your last organization and preferred code language). We do not use advertising or tracking cookies, and this website sets none.

Security

We use encryption in transit, hash keys and sign-in tokens, encrypt webhook secrets, limit access by role, keep an audit log, and apply rate limits and abuse controls. No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.

Your choices and rights

You can ask us to access, correct, export or delete your personal data, or to object to or restrict certain uses, subject to the law that applies to you. To do so, write to support@sendsend.email; we may need to confirm it is you. If you received an email that was sent through SendSend, the best way to stop it is to contact the sender, but you can also write to us and we will help, including adding your address to a suppression list. You may also complain to your local data protection authority.

People who receive email sent through SendSend

The sender is responsible for their message and for having your permission to send it. We process your address and the message only to deliver it and to record the outcome.

Children

SendSend is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

We will update this page when our practices change, and notify account holders of material changes. See also our Terms of service and Acceptable use policy.

Contact

SendSend — support@sendsend.email.