Privacy policy

Who we are

Sendlet is provided by Web Methods Ltd (company number 05824045), trading as Sendlet. For the data about your own account, we're the data controller under UK data protection law (UK GDPR). For your recipients' details and the emails your agents send, we process them on your behalf, to deliver your email. You can contact us about privacy at [email protected].

What we collect and why

Your account

Your email address and display name, to sign you in, run your account and email you about it.

Sign-in and devices

Sign-in codes (stored only in scrambled form), passkeys, and each signed-in device's IP address, browser and last use, to keep your account secure and show you where you're signed in.

Recipients

The addresses and labels of people you add, and whether they've accepted, declined or unsubscribed, so we only email people who agreed.

Sends

Each email's subject, body and attachments, and what happened to it, to deliver it and show it in your send log.

Billing

Your plan, and your Stripe customer and subscription details. Card details go straight to Stripe; we never see or store them.

Where you came from

When you sign up: the website that linked to Sendlet, or the campaign tag in the link you followed, so we know which places to tell people about Sendlet. Nothing is stored in your browser for this.

Visits

Anonymous counts of visits to the public pages (pages viewed, the linking site, country and device type), through Cloudflare Web Analytics. It uses no cookies and doesn't identify you.

Records

A log of important account changes, and rate-limit counters, to prevent abuse and investigate problems.

We use this data to provide the service you've asked for (our contract with you), to keep Sendlet secure and stop abuse (our legitimate interests), and to meet legal duties such as keeping tax records. We don't sell data, show ads, or use your emails to train AI models.

How long we keep it

• Attachments are deleted as soon as an email has been delivered.
• Email subjects and bodies are deleted after 30 days. The rest of the send record (who, when, what happened) is deleted after a year.
• Sign-in codes are deleted after 24 hours. Sessions end after 30 days without use.
• Your account data is kept until you delete your account, when we delete it.
• Payment records are kept by Stripe, and by us where tax law requires, usually for 6 years.

Who we share it with

We use these providers to run Sendlet. They may only use the data to provide their service to us:

Railway

Hosts Sendlet's servers and database.

Cloudflare

Protects and speeds up the website. It sees visitors' IP addresses and tells us their country, which we use to show prices in the right currency. Its Web Analytics counts visits to the public pages without cookies.

Postmark

Delivers emails: sign-in codes, invitations, alerts and the emails your agents send.

Stripe

Takes payments and manages subscriptions.

SendGrid

Only if you choose to send through your own SendGrid account, in which case your emails go through it.

Some of these providers process data outside the UK, including in the United States. Where they do, it's protected by safeguards approved under UK law, such as the UK's international data transfer agreement or the UK–US data bridge. We may also share data if the law requires it, or to protect people from harm or fraud.

If you receive email through Sendlet

A Sendlet user added your address and you accepted their invitation. You can decline an invitation, and every email has a one-click unsubscribe link. We remember that you unsubscribed or declined, so you aren't emailed or invited again against your wishes. For questions about why you're receiving emails, contact the sender. You can also email us.

Cookies

We only use cookies that Sendlet needs to work: to keep you signed in, to link a sign-in code or passkey sign-in to the browser that started it, to recognise a device you've signed in on, and to protect forms from forgery. Your light or dark theme choice is saved in your browser. Our visitor counts use no cookies, and we don't use advertising or tracking cookies, so we don't ask for cookie consent.

Your rights

You can ask for a copy of your data, or ask us to correct or delete it, restrict how we use it, or object to how we use it. You can also do much of this yourself on the Account page: Download my data gives you a copy, and Delete account deletes your account and its data, and cancels any subscription.

To make a request, email [email protected]. We'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Security and changes

Data is encrypted in transit, endpoint keys and sign-in codes are stored only in scrambled form, and any SendGrid key you give us is encrypted. If we change this policy in a way that matters, we'll email you before the change takes effect.