Privacy Policy
Last updated: November 5, 2026
1. Who we are
SendAnchor is a product of ByteVault Enterprise, 18/1 Banerjee Para Road, Barrackpore - Kolkata - 700122, India. ByteVault Enterprise is the controller of account, workspace, and support data described in this policy. For contact data that you upload to a workspace, you are the controller and SendAnchor is a processor.
Privacy questions and requests: privacy@sendanchor.org.
2. What we collect
- Account data: your name, email address, password hash, recovery-key hash, workspace membership, and account preferences.
- Workspace data: contact records, lists, tags, consent source, campaigns, templates, forms, automations, events, suppressions, analytics, webhook URLs, and branding settings that you or your team enter.
- SMTP configuration: host, port, username, password, and related settings for the SMTP account you connect. Passwords are encrypted at rest with AES-256-GCM and decrypted only inside the sender that needs them.
- Usage and technical data: IP address, user agent, timestamps, request logs, error logs, security events, and feature usage needed to operate and protect the service.
- Billing data: Creem, our merchant of record, collects payment details and billing information. We receive transaction status, plan, invoice metadata, and limited customer details needed to provide the plan. We do not receive or store full card numbers.
- Support data: emails and attachments you send to support, abuse, security, or legal addresses.
3. How we use data
- Provide the service, including storing contacts, sending campaigns through your SMTP account, tracking engagement, and maintaining suppression and bounce records.
- Authenticate users, manage workspaces and permissions, and provide account recovery.
- Operate, secure, debug, and improve the service, including abuse prevention and deliverability checks.
- Process payments, invoices, refunds, and chargebacks through Creem.
- Respond to support, privacy, security, and legal requests.
- Comply with law and enforce our Terms of Service.
4. Legal bases
Where GDPR or similar law applies, we rely on: performance of a contract (providing the service you requested); legitimate interests (security, abuse prevention, service improvement, and business operations); legal obligation (tax, accounting, and lawful requests); and consent where required (for example, optional communications). You can withdraw consent at any time, without affecting processing that happened before withdrawal.
5. Sharing and subprocessors
We do not sell contact data. We share data only as needed to operate SendAnchor:
- Cloudflare for hosting, compute, database, object storage, email routing, and security.
- Creem / Armitage Labs OÜ for payment processing, invoicing, tax, refunds, and chargebacks.
- Google / Gmail for the support inbox that receives mail sent to our published addresses.
- Your SMTP provider when SendAnchor sends email through the SMTP account you connected. That provider is selected and controlled by you.
- Professional advisers, authorities, or courts where required by law, or where necessary to protect rights, safety, and security.
We may add or change subprocessors as the service evolves. Material changes will be reflected in this policy. A data processing agreement is available on request.
6. International transfers
Our providers may process data in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent transfer mechanisms offered by the provider.
7. Retention
We keep account and workspace data while your account is active. When you delete a workspace, we remove the workspace and its related records from the active service, subject to short-lived backups, security logs, and legal retention obligations. Operational logs are kept only as long as needed for security, debugging, and abuse prevention. Billing records are retained by Creem and by us as required for tax and accounting law.
8. Security
We use technical and organisational measures designed to protect data, including TLS in transit, AES-256-GCM encryption for SMTP passwords, hashed passwords and API keys, access controls, rate limits, and security headers. No service is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password, recovery key, API keys, and SMTP credentials safe.
9. Your rights
Depending on your location, you may have the right to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent. Workspace owners can export or delete a workspace from Settings. For other requests, email privacy@sendanchor.org. We may need to verify your identity before acting. You may also complain to your local data protection authority.
10. Cookies and local storage
SendAnchor uses essential cookies and browser storage for sign-in sessions, workspace selection, and interface preferences. We do not use advertising cookies or sell data to ad networks. If we add non-essential analytics or marketing cookies, we will update this policy and, where required, ask for consent.
11. Children
SendAnchor is a business tool and is not directed to children. You must be at least 18 years old, or the age of majority in your jurisdiction, to create an account.
12. Changes
We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date. Material changes will be notified by email or in the product where practical.
13. Contact
ByteVault Enterprise, 18/1 Banerjee Para Road, Barrackpore - Kolkata - 700122, India. Email: support@sendanchor.org. Founder: Jacob Silva.