Privacy Policy | Sendsets

01. Who we are

Sendsets is operated by Mindroot Ltd, a company registered in England and Wales with company number 16543299. Our registered office is at 71-75 Shelton Street, London, England, WC2H 9JQ. We are the data controller for the personal data we collect about you as a user of Sendsets.

For your customers' data that you process through Sendsets, you are the controller and we act as a processor on your behalf, governed by the data processing terms we agree with you.

02. Scope of this policy

This policy describes how Mindroot Ltd handles personal data through the Sendsets platform, including the marketing website, the web application, the APIs, the workers, and any related services. It does not cover third-party services that you connect to Sendsets, which are governed by their own privacy policies.

03. Data we collect

Account data

Name and email address you sign up with.
Workspace name and role assignments.
Billing identifiers provided by our payment processor Stripe. We do not see or store full card numbers.

Mailbox data

OAuth refresh and access tokens, or encrypted IMAP and SMTP credentials, for mailboxes you connect.
Mailbox metadata such as folder structure, authentication status, and sender identity.

Message data

Cold outreach messages, warmup messages, and replies that pass through Sendsets.
Recipient addresses and contact records you upload or import.
Tracking events such as opens, clicks, bounces, complaints, and unsubscribes.

Usage data

Logs, error reports, and session events generated by your use of the Service.
Limited diagnostic information such as user agent, IP address, and request timing, retained for security and abuse prevention.

Website analytics

We measure visits to sendsets.com with PostHog, in its cookieless mode. Nothing is stored in your browser for this: no cookie, no local storage, no session storage, which is why you have not been asked to accept any. PostHog derives a visitor count on its own servers from a hash of a daily-rotated secret, your IP address, your browser's user agent and the site's domain. The secret is deleted at the end of each day, so the hash cannot be carried from one day to the next and cannot be turned back into you. On the website we record page views, clicks, scrolling, page performance, the country the visit came from and any script error, and no event carries your name, your email address or any account id. There is no session recording on the website.

Product analytics and session replay

Once you sign in to the dashboard, we measure how you use it under your account: which screens you open, what you click, how fast pages load, any error the app hits and where you are connecting from, together with your account id, email, name and organization. We also record your sessions in the dashboard as replays: a reconstruction of the screen, your clicks and the browser's console, kept by PostHog for the retention period configured there. Anything typed into a password field is masked in the browser before it is sent and never leaves your machine. PostHog stores an identifier in your browser for this, in local storage and a cookie, so that your sessions belong to you and not to a stranger.

We use this to find and fix problems, to understand which parts of the product are used and how, and to support you when something breaks. A self-hosted Sendsets instance loads none of this. Public forms hosted by Sendsets on behalf of a customer use only the cookieless website measurement above, plus three events that say a form was viewed, started and submitted, each carrying the form's public id and nothing about you; those pages are never recorded.

How you found us

When you create an account, we record how you arrived: the page on sendsets.com you clicked through from, the site that referred you, and any campaign parameters in the link (the standard utm_source, utm_medium, utm_campaign, utm_term and utm_content). These are read from the sign-up link's address at the moment you sign up, stored once on your organization, and never updated afterwards. Nothing is stored in your browser beforehand.

We keep this because knowing which channels bring customers is how we decide what to build and where to spend. It is part of your account record and is also set on your analytics profile, so it is exported and deleted with the rest of your data.

04. How we use your data

To operate, maintain, and improve the Service.
To send mail and warmup traffic on your behalf through your connected mailboxes.
To compute deliverability and mailbox health signals such as warmup health scores, suppression lists, and per-mailbox health states.
To prevent abuse, fraud, and breach of our acceptable use rules.
To bill you and to keep accurate financial records.
To respond to support requests and to communicate service updates.
To comply with legal obligations.

05. Google and Microsoft mailbox data

Connecting a Gmail or Microsoft 365 mailbox grants Sendsets access to that mailbox through the provider's API. What we do with what we read from it is deliberately narrow, and this section is the whole of it.

Limited use

Sendsets' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In practice that means:

We use Gmail data only to provide the features you connected the mailbox for: sending your campaign and warmup mail, syncing your inbox so replies appear in Sendsets, and detecting replies, bounces, and unsubscribes.
We do not transfer Gmail data to anyone except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition after obtaining your consent.
We do not use Gmail data for advertising, and we do not sell it.
We do not allow humans to read your mail, except where you have given explicit consent for specific messages (for example when you ask us to investigate a problem), where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymised.
We do not use your mail to train generalised artificial intelligence or machine learning models. Where you turn on an AI feature, the message in question is sent to the model provider only to produce the output you asked for.

Disconnecting a mailbox

You can disconnect a mailbox at any time from the Mailboxes screen, and doing so deletes the data we derived from it. Deleting the workspace holding it does the same for every mailbox in it. When you disconnect a Gmail mailbox we also call Google's revocation endpoint with the token we held, which invalidates it and removes Sendsets from the third-party access list on your Google account, so you do not have to remove it yourself. Deleting our copy of a token alone would not do this.

Microsoft publishes no equivalent endpoint for removing a single application, so for an Outlook or Microsoft 365 mailbox we destroy the stored tokens, which stops Sendsets using them, and you remove the app itself under your Microsoft account privacy settings.

Alongside the revocation, the mailbox's stored messages are deleted from our database and from object storage, together with its credentials, warmup history, and sync state. This normally completes within a minute of you disconnecting, and where a provider or storage service is temporarily unavailable it is retried until it completes. You can also revoke access directly at your provider, under Google third-party access; the mailbox then stops working in Sendsets and should be disconnected here as well so the stored data is removed.

06. Legal bases for processing

Contract. Processing necessary to deliver the Service you have signed up for.
Legitimate interest. Processing necessary to keep the platform secure, to prevent abuse, and to improve our product. This is the basis for the cookieless website measurement, the product analytics and session replay described above, and for recording how you found us when you create an account. You can object to processing based on legitimate interest; see your rights below.
Consent. Where required, for optional features such as marketing emails.
Legal obligation. Processing required to comply with applicable law, including tax, accounting, and lawful requests from authorities.

07. Encryption and storage

Sensitive credentials and message payloads are protected using envelope encryption. AWS Key Management Service is the root of trust. Each user gets a 32-byte data encryption key (DEK), generated by KMS. The encrypted DEK ciphertext is stored in PostgreSQL. The plaintext DEK is held only in memory, cached briefly in Redis with a short time-to-live, and used to encrypt and decrypt fields at the application layer with AES-256-GCM.

Control-plane state lives in PostgreSQL. Object storage uses S3. Workers do not hold a PostgreSQL connection and operate over Kafka, KMS, S3, and Redis only (reaching control-plane data such as encrypted DEKs over the backend's internal API). All traffic between you and Sendsets is protected in transit by TLS 1.2 or higher.

09. Data retention

Account data is retained while your account is active and for a reasonable period after closure to allow recovery and to comply with our legal obligations.
Mailbox credentials are deleted when you disconnect a mailbox, or when you delete the workspace holding it, and where the provider supports it the access grant is revoked with them. The mail we imported from that mailbox is deleted at the same time. See Google and Microsoft mailbox data.
Message and tracking data are deleted on a defined schedule after account closure, except where retention is required by law.
Suppression lists are retained for as long as needed to honour unsubscribe and complaint requests on your behalf.
Billing records are retained for the period required by applicable accounting and tax law.

10. Your rights

Subject to applicable law, you have the right to access, rectify, delete, restrict, port, and object to processing of your personal data. You also have the right to withdraw consent where consent is the basis for processing, and the right to lodge a complaint with a supervisory authority.

The UK supervisory authority is the Information Commissioner's Office. You can exercise your rights by emailing team@sendsets.com.

11. International transfers

Sendsets is operated from the United Kingdom and processes data through infrastructure providers that operate globally. Where personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or adequacy decisions where they apply.

12. Children

Sendsets is a business tool and is not intended for use by children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data to Sendsets, please contact us and we will remove it.

13. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. If we make material changes, we will notify you by email or through the Service before they take effect.

14. Contact

For privacy questions, data subject requests, or any other matter arising under this policy, email team@sendsets.com or write to Mindroot Ltd, 71-75 Shelton Street, London, England, WC2H 9JQ.

Questions about this document? Email team@sendsets.com.