Privacy notice
Draft — the final version will be published before paid plans open.
Last updated:
This notice describes the data Sendalto handles and how it flows. It is a draft; the final notice will name the operator and the privacy contact.
1. Data the product handles
Account and membership records; brand information; contacts, companies and their source and consent records that you import; email content, delivery events and threads from connected mailboxes; product events; integration credentials; billing references; audit and usage records.
What is actually stored depends on the features and connections your workspace uses.
2. Why we use it
To sign people in, enforce workspace permissions, prepare and send approved email, process replies, measure outcomes, run billing and keep the service secure.
The final agreement will state where Sendalto acts as controller and where as processor, the legal bases and your instructions. A product description cannot decide every customer’s lawful basis.
3. Providers and location
Connections you authorise can send the relevant data to email, CRM, AI, storage and billing providers. AI processing happens only when it is configured and authorised, and is reviewed against the provider’s actual terms; turning off response storage is not a zero-retention guarantee.
Where Sendalto is hosted does not mean every provider processes data only in the EU. The exact companies, locations and transfer mechanisms will be listed on the subprocessors page.
4. Cookies
Signing in uses session cookies. The product remembers your active workspace and your interface language (the sendalto_locale cookie, kept for up to a year).
This public website has no advertising pixels and no third-party analytics scripts. Any non-essential tracking would need its own assessment and notice first.
5. Retention and your rights
People with the right permissions can export or erase a person’s data from the workspace. When a person is erased, their opt-out is kept so they are not emailed again; accounting and security duties may also require limited retention.
The final notice will list retention periods by category, how long backups last, how requests are verified and answered, and the supervisory authority where applicable.