Privacy Policy

Sendridge (“we”, “us”) runs sendridge.com, the Sendridge dashboard, and the email API at api.sendridge.com (together, the “Service”). This policy explains how we handle personal information about two groups of people:

• Customers and visitors — anyone who visits our website or creates a Sendridge account. For this information we decide how it is used, and we are responsible for it.
• Recipients — people who receive email that our customers send through Sendridge. Our customer decides what to send and to whom; we process recipients’ data on that customer’s instructions. If you received such an email, see If you received an email sent through Sendridge.

You give us

• Account details: your name, email address and password. Passwords are stored only as a one-way hash; nobody at Sendridge can read them.
• Sign-in with Google or GitHub: if you choose it, the account identifier, name and verified email address that provider shares with us. We do not receive your Google or GitHub password.
• Sending profile: the organisation name and postal address you enter, which we print in the footer of your marketing emails as the law requires.
• Domains and API keys: the domains you add and their DNS records. API keys are stored only as a one-way hash; we show you a short prefix so you can tell keys apart.
• Billing: your plan, payment amounts, currencies, dates and the payment provider’s reference for each payment, plus any credit balance. Card and bank details are entered on the payment provider’s own page and are never sent to us.
• Messages to us: what you send through our contact and feedback forms or by email.

Created when you use the Service

• Email you send: recipients, sender, subject, the content of the message, any tags and metadata you attach, and what happened to it — queued, sent, delivered, bounced, complained or failed.
• Audience contacts you upload: email addresses, names, tags, subscription status, and the record of how each contact consented.
• Opens and clicks: HTML emails sent through Sendridge include a small tracking image and links that pass through our servers. When a recipient opens an email or clicks a link, we record the time, their IP address, their browser’s user agent and, for clicks, the link.
• Suppression list: addresses that hard-bounced, complained, or unsubscribed, so they are not emailed again.
• Security and usage records: sign-in history (time, IP address, browser), API request logs (endpoint, response, IP address) and server logs.

From our website

• Analytics: we use Vercel Web Analytics and Speed Insights to count page views and measure page speed. They do not use cookies and do not identify you across sites.
• reCAPTCHA: our sign-up form uses Google reCAPTCHA v3 to tell people from automated sign-ups. It collects information about your device and how you use the page and sends it to Google. Google’s Privacy Policy (opens in a new tab) and Terms of Service (opens in a new tab) apply to it.

• To provide the Service: run your account, verify your domains, deliver your email and show you what happened to it.
• To protect deliverability and recipients: process bounces and complaints, keep the suppression list, and add unsubscribe links to marketing email.
• To keep the Service secure: detect automated sign-ups, fraud, spam and abuse, and investigate misuse.
• To bill you and manage your plan, including reminders before a paid plan ends.
• To send you service email: address verification, security notices, plan and billing notices, and replies to your requests.
• To meet legal obligations, such as keeping financial records and responding to lawful requests.
• To improve the Service using aggregated, non-identifying statistics.

We do not sell personal information, share it for cross-context behavioural advertising, or use the content of your email or your recipient lists for our own marketing.

Where laws such as the EU and UK GDPR or the Nigeria Data Protection Act 2023 require a legal basis, we rely on:

• Contract — to provide the Service you signed up for.
• Legitimate interests — to secure the Service, prevent abuse, protect deliverability for all customers, and improve the product, balanced against your rights.
• Legal obligation — for example, keeping billing records.
• Consent — where we ask for it. You can withdraw consent at any time.

For recipient data, the customer who sent the email is responsible for having a lawful basis to email each recipient.

We share personal information only with the service providers that run parts of Sendridge for us, under contracts that limit their use of it, and only as far as each one needs:

Email you send is, by its nature, delivered to your recipients’ mail providers. We may also disclose information when the law requires it, to protect the rights and safety of people or of the Service, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

Our main servers are in the European Union (Ireland and Germany), and some providers process data in the United States and other countries. Where the law requires it, transfers are protected by safeguards such as the European Commission’s standard contractual clauses or an equivalent mechanism.

• Account, sending and contact records: for as long as your account is open, so you can see your history.
• After you ask us to delete your account: we delete or anonymise your data within 30 days, except as below.
• Billing records: for as long as tax and accounting law requires.
• Suppression entries: kept so that an address that bounced, complained or unsubscribed is never emailed again. Deleting them would undo the recipient’s choice.
• API request logs: deleted automatically after 30 days.
• Verification and sign-in links: email verification links expire after 24 hours; sign-in handover codes expire within minutes.

We use no advertising or cross-site tracking cookies. What your browser stores for Sendridge:

These are needed for the Service to work, so they do not require consent.

We encrypt traffic to and from the Service with TLS, store passwords and API keys only as one-way hashes, store verification tokens hashed, and limit staff access with role-based permissions. No system is perfectly secure; if a breach affects your personal information, we will tell you and the relevant authorities as the law requires.

Depending on where you live, you may have the right to:

• see the personal information we hold about you and get a copy of it;
• have it corrected, or deleted;
• object to, or ask us to restrict, how we use it;
• receive it in a portable format;
• withdraw consent you have given; and
• complain to a data protection authority, such as your EU or UK supervisory authority or the Nigeria Data Protection Commission.

To use any of these rights, email support@sendridge.com. We reply within 30 days and may need to confirm your identity first. We will not treat you differently for using your rights. Residents of California: we do not sell or share personal information as those terms are defined in California law.

The organisation named in the email’s “From” line sent it and is responsible for it; Sendridge delivered it on their behalf.

• To stop marketing email: use the unsubscribe link at the bottom. It works with one click, and we stop that sender emailing you through Sendridge.
• To access or delete your data: contact the sender first, as they control it. If you cannot reach them, write to us and we will help.
• To report spam or abuse: email support@sendridge.com with the message. We investigate every report and suspend senders who break our sending rules.

The Service is for businesses and developers. It is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

When we change this policy we update the effective date at the top. If a change is significant, we will tell account holders by email before it takes effect.

Questions or requests about privacy: support@sendridge.com.

By post: Sendridge, 17928 142nd Avenue, Jamaica, NY 11434, United States.