Privacy Policy
How we collect, use, and protect your personal information.
1. Overview
Sendbound, Inc. ("Sendbound," "we," "our," or "us") provides an email delivery platform, API, and related services ("Services"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.
This policy applies to: (a) visitors to our website at sendbound.com; (b) registered users of the Sendbound platform; (c) contacts of Sendbound customers whose data is processed through our Services; and (d) recipients of emails delivered through our infrastructure.
By using our Services, you acknowledge you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our Services.
2. Data Controller
Sendbound, Inc. is the data controller for personal data collected through our website and account registration. For personal data processed on behalf of our customers (i.e., data about their end users and email recipients), Sendbound acts as a data processor and the customer is the data controller.
Our registered address is: Sendbound, Inc., 123 Market Street, San Francisco, CA 94105, United States.
For privacy inquiries, contact our Data Protection Officer at privacy@sendbound.com.
3. Data We Collect
3.1 Account and Registration Data
When you create an account or contact us, we collect:
- Name, email address, and password (hashed)
- Company name, job title, and business address
- Billing information (credit card numbers are tokenized; we never store raw card data)
- Communication preferences and account settings
- Support tickets, chat logs, and correspondence with our team
3.2 Usage and Telemetry Data
We automatically collect certain data when you interact with our platform:
- IP address, browser type, device identifiers, and operating system
- Pages visited, features used, and time spent in the dashboard
- API request logs (endpoints called, request timestamps, error codes)
- Clickstream data and user interaction events
- Referring URLs and UTM parameters
3.3 Email Sending Data
When you use our API to send emails, we process:
- Sender and recipient email addresses
- Email subject lines and metadata (not message body content, unless you use our template storage)
- Delivery events (sent, delivered, bounced, complained)
- Open and click tracking data (when enabled by the sender)
- Webhook event payloads you configure
3.4 Customer-Provided Data
Our customers may upload contact lists, audience segments, and email content to our platform. As a data processor, we handle this data strictly on our customers' instructions. Customers are responsible for ensuring they have the legal right to share this data with us.
3.5 Cookies and Similar Technologies
We use cookies, pixels, and local storage to operate and improve our Services. See Section 11 for full details.
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases:
- Contract performance — Processing necessary to provide the Services you have subscribed to (Art. 6(1)(b) GDPR)
- Legitimate interests — Fraud prevention, security, improving our Services, and marketing to existing customers (Art. 6(1)(f) GDPR)
- Consent — Marketing communications to prospects and optional analytics cookies (Art. 6(1)(a) GDPR). You may withdraw consent at any time.
- Legal obligation — Compliance with applicable laws, including financial record-keeping and law enforcement requests (Art. 6(1)(c) GDPR)
5. How We Use Your Data
We use personal data to:
- Create and manage your account, and authenticate your access
- Provide, operate, and improve the Sendbound platform and API
- Process payments and manage billing
- Send transactional emails (receipts, password resets, usage alerts)
- Provide customer support and respond to inquiries
- Send product updates, feature announcements, and marketing emails (opt-out available)
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Enforce our Terms of Service and other policies
- Comply with legal obligations and respond to lawful requests
- Conduct analytics and research to improve our services
- Aggregate and anonymize data for benchmarks and industry reports
We do not sell your personal data, and we do not use it to train AI/ML models without your explicit consent.
7. International Data Transfers
Sendbound is based in the United States. If you are located outside the US, your data will be transferred to and processed in the United States and other countries where our service providers operate.
For transfers from the EEA or UK, we rely on: (a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) adequacy decisions where applicable; and (c) other lawful transfer mechanisms under GDPR Chapter V.
Our Data Processing Agreement (DPA), available at sendbound.com/legal/dpa, incorporates the applicable SCCs. Enterprise customers may request a countersigned DPA at privacy@sendbound.com.
8. Data Retention
We retain personal data for as long as necessary to provide our Services and comply with our legal obligations:
- Account data — Retained for the duration of your account plus 3 years after closure (for legal and financial compliance)
- Email sending logs and events — Retained for 90 days on the dashboard; aggregate statistics retained indefinitely in anonymized form
- Billing records — Retained for 7 years as required by US tax law
- Support tickets — Retained for 2 years after resolution
- Marketing opt-out records — Retained indefinitely to honor your preference
- Cookies and analytics data — See Section 11
When data is no longer needed, we securely delete or anonymize it. You may request early deletion subject to our legal obligations (see Section 9).
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
9.1 Rights Under GDPR (EEA/UK Residents)
- Right of access — Request a copy of the personal data we hold about you
- Right to rectification — Request correction of inaccurate or incomplete data
- Right to erasure ("right to be forgotten") — Request deletion of your personal data, subject to legal retention obligations
- Right to restrict processing — Request that we limit how we use your data while a dispute is resolved
- Right to data portability — Receive your data in a structured, machine-readable format
- Right to object — Object to processing based on legitimate interests or for direct marketing purposes
- Right to withdraw consent — Withdraw consent at any time without affecting the lawfulness of prior processing
- Right to lodge a complaint — File a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France)
9.2 How to Exercise Your Rights
Submit a request to privacy@sendbound.com or through your account settings under Settings → Privacy. We will respond within 30 days (or 45 days for complex requests). We may verify your identity before processing requests.
10. California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:
- Right to know — Request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell
- Right to delete — Request deletion of personal information we have collected, subject to exceptions
- Right to opt out — Opt out of the "sale" or "sharing" of personal information. We do not sell personal information.
- Right to correct — Request correction of inaccurate personal information
- Right to limit use of sensitive information — Limit our use of sensitive personal information to what is necessary to perform services
- Right to non-discrimination — We will not discriminate against you for exercising your rights
To exercise CCPA rights, contact us at privacy@sendbound.com or call our toll-free number listed on our contact page. We will respond within 45 days.
Shine the Light: California Civil Code § 1798.83 allows California residents to request information about sharing of personal information with third parties for direct marketing. We do not share personal information for direct marketing purposes.
12. Children's Privacy
Our Services are not directed to children under 16 years of age (or 13 in jurisdictions where COPPA applies). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@sendbound.com and we will promptly delete it.
13. Security
We implement industry-standard security measures to protect your personal data:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- SOC 2 Type II certified infrastructure
- Role-based access controls and least-privilege principles
- Regular penetration testing and vulnerability assessments
- Employee security training and background checks
- Incident response plan with 72-hour breach notification (GDPR compliant)
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. See our Security page for more detail, or report vulnerabilities to security@sendbound.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will: (a) update the "Last updated" date at the top; (b) send an email notification to registered account holders; and (c) post a notice in the Sendbound dashboard for 30 days.
Your continued use of our Services after changes take effect constitutes acceptance of the revised policy. If you disagree with any changes, you may close your account.
We maintain an archive of prior versions of this policy, available upon request.
15. Contact Us
For questions, concerns, or to exercise your rights:
- Email: privacy@sendbound.com
- Mail: Sendbound, Inc., Attn: Privacy Team, 123 Market Street, San Francisco, CA 94105
- EEA Representative: For GDPR inquiries, contact our EU representative at eu-rep@sendbound.com
We aim to respond to all privacy inquiries within 5 business days and resolve requests within 30 days.
Still have questions?
Our team responds within one business day.