Privacy Policy

1. Definitions

For the purposes of this Privacy Policy:

• Service means the simplysend.email website and the  Simply Send  email delivery service.
• Personal Data means data about a living individual who can be identified from those data.
• Usage Data is data collected automatically, generated by the use of the Service or from the Service infrastructure itself.
• Cookies are small files stored on your device (computer or mobile device).
• Data Controller means the natural or legal person who determines the purposes for which and the manner in which any personal data are processed. Simply Invent Labs LLC acts as Controller for its own account, billing, and business-administration purposes. For recipient lists, message content, and other data processed on a customer's behalf, we act as Processor or Subprocessor under our Data Processing Addendum. The role depends on the actual activity and applicable law.
• Data Processors (or Service Providers) means any natural or legal person who processes the data on behalf of the Data Controller.
• Data Subject is any living individual who is using our Service and is the subject of Personal Data.
• Sub-Processor means any third-party service provider engaged by us to process Personal Data on your behalf as part of delivering the Service.

2. Information We Collect

We collect several different types of information for various purposes to provide and improve our Service to you.

2.1 Information You Provide

When you use our Service, we may ask you to provide us with certain personally identifiable information, including but not limited to:

• Account information (name, email address, password)
• Contact information (email, phone number, address)
• Billing and payment information
• Email content, subject lines, and recipient addresses
• Contact lists and subscriber data: email addresses and subscription status of recipients you manage through the Service
• Campaign data: campaign names, schedules, targeting settings, and performance analytics you create within the Service
• Email event data: delivery, open, click, bounce, complaint, and unsubscribe events associated with emails you send through the Service
• Customer support communications

2.2 Information We Collect Automatically

We automatically collect certain information when you visit, use, or navigate our Service, including:

• Usage Data: Information about how you interact with our Service, including API calls, email delivery metrics, and feature usage.
• Log Data: Information that your browser sends whenever you visit our Service, including your IP address, browser type, and pages visited.
• Device Information: Information about your device, including hardware model, operating system, and mobile network information.
• Cookies and Tracking Technologies: We use cookies and similar tracking technologies to track activity on our Service.

2.3 Third-Party Tools

We use third-party services for infrastructure, communications delivery, support, selected AI functions, payments, and analytics. The central Subprocessors and Service Providers page identifies those providers, their functions, processing information, and applicable roles. It also explains which services apply only when selected or separately agreed. The Data Processing Addendum governs providers that Process Customer Data on your behalf.

2.4 Google Workspace Integration Data

If you choose to connect Google Contacts, Google Sheets, or Google Forms, we access only the Google data needed for the integration you select, such as selected contact groups, selected files, mapped fields, and the imported contact information. We use that data to perform the one-way import into the subscription group you choose and to operate, secure, and support that integration. Google access is read-only; Simply Send does not use Gmail as its sending path.

You may disconnect the integration in Simply Send. Disconnecting revokes Simply Send's connection to Google; contacts already imported into Simply Send remain subject to your workspace's retention and deletion controls.

2.5 Marketplace Listings and Subscription Data

Google Workspace Marketplace may be used to discover and install a Simply Send Google Workspace integration. It is separate from Google Cloud Marketplace, which may process a paid subscription if that purchase channel is offered. AWS Marketplace, Microsoft Azure Marketplace, and the Shopify App Store or another Shopify channel may also make Simply Send available for discovery, installation, or purchase. The applicable channel may provide us with your organization or store identifier, purchaser or account contact information, order or charge identifier, selected plan, subscription or entitlement status, renewal, cancellation, and billing-period information.

We use this information only to link the purchase to the correct Simply Send account or workspace, provision and administer the subscription, provide support, prevent fraud, meet tax, accounting, and legal obligations, and resolve purchase issues. We do not receive or store full payment-card numbers from Stripe or a marketplace. We do not sell marketplace subscription data or use it for advertising.

2.6 Sensitive and Biometric Data Disclaimer

The standard Service is not designed for special-category data, criminal-offence data, payment-card authentication data, or uses requiring a business associate agreement or other specialized safeguards. Do not submit such data without a separate written agreement establishing the permitted service and safeguards. Message content may contain personal information that we cannot identify in advance; if restricted data was submitted unintentionally, contact us so we can assist with the appropriate deletion or restriction.

2.7 Login and Identity Information

If you choose sign-in through Google, Microsoft, Amazon, GitLab, LinkedIn, or Slack, we receive identity information made available under the requested permissions, such as your provider account identifier, email address and verification status, name, and profile information, together with authentication tokens or assertions needed for the sign-in flow. We use it to authenticate you, link your identity to your Simply Send account, and secure access. The selected provider receives the sign-in request and technical information associated with it and handles its own account and security processing under its privacy terms. Sign-in alone does not authorize access to your email content or a separate integration.

Identity links and related account records are retained for account administration and security under Section 6. You may manage provider permissions in that provider's account controls and contact us for account-linking or deletion assistance. Revoking provider access may affect sign-in and does not by itself delete your Simply Send account or previously retained security records. Make sure you retain an available way to access your account.

2.8 Other Integrations and MCP Connections

We receive and exchange information needed for connections you authorize. Supabase setup uses OAuth authorization and project information to configure the selected project's authentication email settings, including Simply Send SMTP credentials; it does not itself import your entire Supabase database. A customer-installed WordPress plugin submits email addressing, content, applicable headers, and selected attachments for delivery. Zapier, Shopify, and webhook connections exchange the requests, source data, or event payloads selected in their configuration. Connection records can include provider or project identifiers, permissions, tokens, configuration, status, and operational logs needed to provide and secure the integration.

When you authorize a Model Context Protocol (MCP) client, the client can submit tool arguments and receive permitted results within the selected workspace, access scopes, and your workspace role. Results can include contact details, email previews or content, and operational information, depending on the tool. An AI client and its model or service providers may process information they receive under your arrangement with them. This differs from Simply Send's own OpenAI and Gemini API processing in Section 11. Review the client's permissions, privacy, retention, and model-use terms before connecting; Google Workspace Limited Use restrictions continue to apply.

Disconnect or revoke access through the available Simply Send and external-provider controls. Plugins, webhooks, and separately issued API/SMTP credentials may require separate disabling or revocation. Disconnection does not automatically delete imported data, sent messages, logs, or copies already received by an independent provider. Simply Send's copies follow Section 6 and your applicable deletion controls; request deletion of external copies from the relevant provider. Connections may involve processing outside your country or selected email region, subject to Section 10 and the applicable DPA safeguards. The central provider page explains roles and data flows.

2.9 Legal Agreement Records

Cookie preferences are separate from legal-agreement acceptance. When you save an optional-cookie choice, a necessary first-party cookie stores the selected categories, notice version, ISO choice timestamp, and available country/state codes for up to one year. This record contains no message content or payment details, is not an analytics event, and is kept in your browser rather than transmitted as an analytics event. Earlier rejection choices remain respected; affirmative consent is requested again when the applicable notice version changes.

When you confirm legal documents in your authenticated account, we record the account and workspace identifiers, the name and email associated with the account, your workspace role and acceptance capacity, the supplied customer legal name and postal address, document versions and links, the statement and acceptable-use acknowledgements confirmed, and a server-generated acceptance timestamp and request identifier. We use these records to administer the customer relationship, document agreement, support legal and security audits, and address contractual questions or disputes. The acceptance activity is visible through the account activity system, and your own receipt is available in Account → Documents. A receipt is not a handwritten or certificate-backed signature and does not complete missing SCC party or processing details.

3. How We Use Your Information

We use the collected data for various purposes, including:

• To provide and maintain our Service
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service
• To provide customer support via email, Zoho Desk ticketing, or Zoho SalesIQ chat
• To gather analysis or valuable information so that we can improve our Service (via Clarity and GA)
• To monitor the usage of our Service
• To detect, prevent and address technical issues, fraud, and abuse
• To provision, administer, and support subscriptions purchased directly or through an available marketplace channel
• To authenticate selected provider identities and perform the integrations or MCP operations you authorize and configure
• To conduct compliance and abuse inspections: We may access and review the content of emails sent through the Service on a random or targeted basis to verify compliance with our Acceptable Use Policy, applicable laws, and third-party provider requirements. Such access is limited to authorised personnel and is used solely for enforcement purposes.
• To enforce our Terms of Service and Acceptable Use Policy
• To provide you with news, special offers, and general information about other goods, services, and events which we offer (where you have consented or where we have a legitimate interest)
• To comply with our legal obligations

EU/EEA Roles and Legal Bases

For account administration, billing, our website, security, and our own business communications, Simply Invent Labs LLC acts as Controller. For message content, recipient lists, and related data processed only on a customer's documented instructions, we act as Processor or Subprocessor under the DPA. The customer determines and explains the lawful basis for its recipient data; an account owner's acceptance is not consent from message recipients.

Where we rely on consent, it can be withdrawn through the available preference controls or by contacting [email protected]. Direct-marketing processing stops upon objection; we do not require a reason. Necessary service/security notices are separate from promotional email. Where data comes from a marketplace, identity provider, integration, or an authorized customer representative, the categories and sources are described in Section 2; we provide any additional notice required by Articles 13 or 14.

4. Purpose Limitation

We are committed to using your data only for the purposes described in this policy. Below is a clear summary of what we do and do not do with your data:

5. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it, including:

• HTTPS/TLS protects supported website and API connections, and documented secure SMTP submission settings protect supported client connections. Onward email delivery depends on the delivery provider and recipient server; opportunistic TLS does not guarantee encryption on every recipient delivery leg. The Service does not provide end-to-end message encryption.
• AWS application databases and object storage use encryption at rest and cloud access controls. Other providers' encryption, key, retention, and location arrangements depend on the applicable service and configuration.
• Role-based access controls limiting data access to authorised personnel only
• Access logging for sensitive operations via AWS CloudWatch
• Infrastructure security provided by AWS and Cloudflare, including DDoS protection, TLS enforcement, and network-level controls
• Dead-letter queues and data retention controls to limit exposure of message data

6. Data Retention

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy:

• Account Information: After an account-deletion request, you have seven days to cancel. At the end of that period, we begin deleting or anonymizing account information and Service data. We may retain limited records where required for legal, billing, security, fraud-prevention, or audit purposes.
• Email Records, Mailboxes & Event Data: Retention depends on the record type and feature. Mailbox and received-message retention follows the workspace's applicable setting; available tiers range from 7 to 730 days. Sending and event records, temporary attachments, queued work, and exports have separate expiry or lifecycle rules. Contact and subscription data remains while needed for the active Service, subject to your deletion instructions. Ask us for the settings applicable to your workload; a sending region or event-record period does not determine every category's retention.
• Campaign Data: Campaign configuration and aggregate statistics are retained for as long as your account is active.
• Legal Agreement Records: We keep limited acceptance evidence while the agreement is active and for three years after account or workspace closure, to establish the agreement and address legal claims. This includes the accepting representative's identity and contact details, customer/workspace identifiers, supplied customer legal name and postal address, accepted statements and document versions, and the actual recorded acceptance time. It does not include recipient lists, message content, payment credentials, or integration tokens. Closure removes ordinary account access and activity feeds; it does not immediately delete this separate evidence. Retained evidence is used only for the relevant legal and agreement-administration purposes and is available only to authorized personnel through restricted administrative processes. It is scheduled for deletion after that period; automated expiry is asynchronous. A longer period requires a separately documented lawful need and appropriate retention controls; this standard period does not override a valid mandatory erasure requirement. Contact us for a receipt before closure or assistance with a later evidence request.
• Logs and Analytics: Retained only for the relevant security, audit, troubleshooting, or reporting purpose; some reporting and audit records have an expiry of up to one year. Provider-held analytics follows the active Google Analytics or Clarity configuration and applicable legal requirements. Aggregation or masking does not necessarily make records anonymous.
• Billing Information: Retained as required by tax and accounting laws (typically 7 years).
• Support and AI Data: Retained only as needed for the request or selected feature and the applicable provider configuration and contractual requirements. Customer Data supplied in support requests remains subject to the DPA; a provider's standard retention policy does not replace our obligations to you.

Deletion and expiry processes are asynchronous. After the relevant retention period or valid deletion instruction, remaining backup copies are protected from ordinary active use until their documented expiry cycle; deletion instructions are reapplied if data is restored. We can provide the relevant backup and provider retention details for your workload. We retain legally required records only for their lawful purpose and applicable retention period.

To help prevent fraud and unauthorized re-registration, we retain a deletion tombstone that includes a cryptographic hash of the deleted account's email address. That hash is used to enforce a six-month re-registration cooldown and is not used to restore access to the deleted account.

You can request deletion of your personal data by contacting us at [email protected] , subject to our legal obligations.

7. Data Sharing and Disclosure

We may share your information in the following circumstances:

• Service Providers and Purchase Channels: The central provider list identifies our service providers, business-operation providers, and customer-selected integrations or purchase channels, with their applicable roles and conditions. We disclose only the data reasonably necessary for the applicable service, subject to the provider's contractual terms and, where applicable, data-processing terms. This includes exchanging subscription, entitlement, account-linking, and purchase-status information with Stripe or an available marketplace only as needed to process, provision, administer, support, secure, or reconcile your subscription.
• Authorized Integrations and Identity Providers: We exchange identity information for selected sign-in and integration data or MCP tool results for connections you authorize, as described in Sections 2.7 and 2.8 and the central provider page. Independent providers may retain and process information under their relationship with you. These connections do not authorize unrelated data sharing, generalized AI training by Simply Send, or uses prohibited by Google Workspace Limited Use restrictions. Where Simply Send engages a provider to Process Customer Data on your behalf, the DPA applies regardless of the integration label.
• Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or a prominent notice on our website at least 30 days prior to any such transfer and the change in ownership.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency), and only to the extent required by applicable law.
• Protection of Rights: We may disclose your information when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

We do not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes.

8. Your Data Protection Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• Access: You can request a copy of your personal data.
• Correction: You can request correction of any inaccurate or incomplete data.
• Deletion: You can request deletion of your personal data (including data stored in our support and analytics tools), subject to our legal retention obligations.
• Objection: You can object to our processing of your personal data where we rely on legitimate interests as the legal basis.
• Portability: You can request a copy of your data in a structured, commonly-used, machine-readable format.
• Restriction: You can request that we restrict the processing of your personal data in certain circumstances — for example, while we verify the accuracy of your data or while you contest our grounds for processing.
• Withdraw Consent: Where we rely on your consent as the legal basis for processing, you can withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at [email protected] . We may need to verify your identity before processing your request. For EU/EEA rights requests, we respond without undue delay and normally within one month of receipt. Where permitted because of complexity or the number of requests, that period may be extended by up to two further months; we explain the extension and reasons within the first month. Requests are normally free. Any permitted refusal or fee must be justified, and a refusal includes reasons and information about supervisory-authority and judicial remedies. Identity checks are proportionate. Where we act only as Processor for a customer, we promptly pass the request to that customer and assist under the DPA rather than decide it independently.

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority (e.g., the relevant EU supervisory authority, or the UK Information Commissioner's Office).

9. California Privacy Rights (CCPA & CalOPPA)

If you are a California resident, you have the right to:

• Request access to the categories and specific pieces of personal information we have collected about you
• Request deletion of your personal information
• Opt-out of the sale of your personal information (we do not sell personal information)
• Not be discriminated against for exercising any of these rights

To make a request, please contact us at [email protected] . We will respond to your request within 45 days.

10. International Data Transfers

Where region-first signup is available, you select an available Service region before creating your login. Regional identity and account services, workspace records, domain configuration, and core email processing and storage use that selected region, including US East or Frankfurt where offered. A planned region is not available until released. Selecting Frankfurt does not mean that all information stays in the EEA. The current Simply Send SMTP bridge is hosted in the United States, so SMTP addressing, content, headers, and attachments transit and are processed there before forwarding to the configured delivery workflow. The bridge is not a long-term message archive; processing can use memory and temporary attachment files. Security and operational logs can contain IP addresses and account, session, message, domain, timestamp, and error metadata, which may be Personal Data. The applicable retention and transfer safeguards apply to those records. The regional account scope does not cover website delivery and associated metadata, external support or AI providers, or customer-selected integrations, which can involve processing outside the selected region as disclosed on the provider page. Regional SMTP deployment is a future change, not a current EEA-only processing commitment.

Simply Invent Labs LLC is headquartered in the United States. Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction.

Where we transfer Personal Data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries that have not received an adequacy decision from the relevant authority, we rely on the following safeguards:

• Transfer Mechanisms: Where required by applicable law, we use appropriate transfer mechanisms, which may include the European Commission-approved Standard Contractual Clauses and other safeguards recognized by applicable law.
• Data Processing Terms: We use the applicable contractual and data-processing terms offered by our service providers, and apply additional safeguards where required by applicable law.
• Transfer Assessments: Where required, we assess the circumstances of an international transfer and apply appropriate supplementary safeguards.

The Data Processing Addendum describes Customer Data roles, transfer safeguards, the incorporated SCC party and transfer details, and service-specific processing information. The selected account region governs the regional services described above; US SMTP transit, website delivery and associated metadata, external support and AI, and customer-selected integrations remain subject to their separately disclosed locations. Our full company postal address is included in the authenticated company-signed DPA and can also be requested through the privacy contact. If you have questions about the safeguards we use for international data transfers, please contact us at [email protected] .

11. AI/ML Data Usage

We use the following AI-assisted features only to provide visible Service functionality:

• AI template creation: When you choose an AI template feature, the prompt and template content you submit may be sent to OpenAI's API to generate or refine that template.
• Email-content review: We may use Google's Gemini API to help identify abusive, fraudulent, phishing, or otherwise unsafe email content. Before this review, Simply Send locally removes direct identifiers, known Google-imported contact values, recipient-specific URLs and tokens, and embedded data. If that de-identification cannot be completed, we withhold the content from Gemini and route the review for internal handling.
• Operational security: We use automated systems to detect abuse, fraud, and delivery-risk signals and to protect the Service.

The currently implemented AI template and review functions call OpenAI's API and Google's Gemini API directly. Their active account terms, no-training controls, retention, and processing locations must cover the applicable data; a provider's service name alone does not establish those settings. Any separately offered Telnyx AI or other intermediary feature requires its own disclosure and authorization of the selected service, upstream providers, data, retention, and countries before use under the DPA. It is not enabled merely by including Telnyx in a vendor list. Our prohibition on generalized model training and the Google Workspace Limited Use restrictions continue to apply.

Google Workspace Limited Use

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We use Google Workspace data only to provide and improve the Google integration that you choose, do not sell it or use it for advertising, and do not transfer Google Workspace data to create, train, or improve generalized AI or machine-learning models.

Simply Send's own AI template-generation function does not automatically retrieve Google Workspace integration data for its OpenAI API requests. Separately, an authorized external MCP client can receive permitted tool results that may contain imported contact information, as described in Section 2.8. Such access does not authorize uses prohibited by Google Workspace Limited Use requirements. For Gemini email-content review, Simply Send removes direct identifiers and known Google-imported contact values locally before any external request. We do not transfer raw, aggregated, anonymized, or derived Google Workspace user data to a third-party AI service for model training.

You may contact us at [email protected] if you have any questions about how we use automated systems in connection with your data.

12. Automated Decision-Making

We use automated systems to help operate, secure, and enforce our Service. The following automated processes may directly affect your account:

• Spam detection: Automated scanning of sending patterns (not message content) to identify and block spam or abusive traffic. This may result in automatic throttling or temporary suspension of sending.
• Sending-rate monitoring: Bounce rates above 1.25%, complaint rates above 0.05%, and unsubscribe rates above 0.1% may result in a sending pause. Bounce rates above 1.75%, complaint rates above 0.1%, and unsubscribe rates above 0.2% may result in account suspension.
• Fraud detection: Automated analysis of account activity may flag suspicious behaviour and result in account holds pending manual review.
• Rate limiting: Automated throttling of sending volume to protect infrastructure and prevent abuse.

Where an automated decision significantly affects your account (such as a suspension or restriction), you have the right to request human review of that decision. To do so, please contact [email protected] . We will review your case and respond within 5 business days.

Manual Compliance Inspections

In addition to automated systems, authorised Simply Send personnel may conduct manual, random, or targeted inspections of email content sent through the Service. These inspections are performed solely to:

• Verify compliance with our Acceptable Use Policy
• Investigate suspected violations of applicable law (including CAN-SPAM, CASL, GDPR)
• Respond to third-party provider compliance requirements or complaints
• Investigate reports of abuse, spam, or harmful content submitted by recipients or providers

Access is restricted to a limited number of authorised personnel, is logged for audit purposes, and the content accessed is not used for any commercial purpose. This access is limited to the lawful security and abuse-prevention purposes described above or the customer's documented processing instructions. Accepting the Terms is not treated as blanket consent for unrelated inspections, advertising, or new purposes.

13. Children's Privacy

Our Service is not intended for use by children. We do not knowingly collect personally identifiable information from:

• Children under the age of 16 if they are located in the European Economic Area or United Kingdom (as required by GDPR Article 8 and the UK GDPR).
• Children under the age of 13 in all other jurisdictions (including the United States, in compliance with COPPA).

If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us immediately at [email protected] . If we become aware that we have collected Personal Data from a child without verification of parental consent (where required), we will take steps to remove that information from our servers promptly.

14. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

For material changes that affect your rights or how we process your data, we will provide at least 30 days' advance notice via email to the address associated with your account.

You are advised to review this Privacy Policy periodically for any changes. The stated effective date controls. Material changes described above do not take effect earlier than the notified date. A notice does not itself obtain consent for a new purpose requiring consent, or replace agreement where a change requires it.

15. Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or to exercise your data rights, please contact us at: [email protected]

Simply Invent Labs LLC
Email: [email protected]