Privacy Policy

1. Information We Collect

• Account data: name, email address, company name, login credentials (stored hashed), and session tokens.
• Billing data: subscription status, invoices, and payment metadata processed by Stripe (we do not store full card numbers).
• API and usage data: API key metadata, send volume, domain configuration, webhook settings, and product usage logs.
• Message data: email content, recipients, delivery events, suppressions, and inbound messages you route through the Service.
• Technical data: IP address, browser type, device information, and activity logs for security and operations.

2. Why We Collect Data

We collect and process data to provide and operate the Service, authenticate users, deliver email, bill accounts, prevent abuse, improve reliability, and comply with legal obligations.

3. Legal Bases for Processing

• Contract necessity: to provide the Service you request.
• Legitimate interests: security, abuse prevention, service improvement, and infrastructure operations.
• Consent: where required for optional communications or features.
• Legal obligation: to comply with applicable laws and lawful requests.

4. How We Use Your Information

• Operate accounts, domains, API keys, templates, webhooks, and billing.
• Send, receive, track, and troubleshoot transactional email on your behalf.
• Monitor abuse, enforce limits, and protect shared infrastructure reputation.
• Provide support and communicate about the Service.

5. Data Sharing & Subprocessors

We use trusted service providers to operate the Service. Categories include cloud hosting (Google Cloud), mail delivery infrastructure, payment processing (Stripe), caching/queues (Redis), error monitoring (Sentry), and demo scheduling (HubSpot Meetings) when you book a demo.

We may disclose data when required by law, to prevent fraud or abuse, or to protect rights and safety.

Customer data may be processed in the United States and other regions where our providers operate. For EU/UK transfers, contact us regarding applicable safeguards.

For a Data Processing Agreement or subprocessors list, contact dpo@supersend.io.

6. Data Retention

• Active accounts: retained while your account is active and as needed to provide the Service.
• Message and event logs: retained for operational, billing, and abuse investigation purposes according to plan and configuration.
• Deleted accounts: account data is deleted or anonymized within a reasonable period after deletion request, subject to legal retention requirements.

7. Security

We implement technical and organizational measures including encryption in transit, access controls, monitoring, and incident response procedures.

No method of transmission or storage is completely secure. You are responsible for securing your API keys and account credentials.

8. Cookies

We use cookies and similar technologies for authentication, session management, and essential site functionality. We do not use advertising cookies on the core product without consent where required.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data.

To exercise these rights, contact support@supersend.io or dpo@supersend.io. We will respond within applicable legal timeframes.

10. Children's Privacy

The Service is not directed at children under 16 in the EEA/UK or under 13 in the US. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a revised effective date and communicated as appropriate.