Privacy Policy

1. Who is responsible

Sently is operated by Sently. For privacy questions write to [email protected].

This policy explains what we collect, why we collect it, how long we keep it, and who else processes it on our behalf.

2. What we collect

Account data

• The email address you sign in with, and your display name if you set one.
• The clients, teams and user invitations you create, including the email addresses of people you invite.
• The sending domains you add, and the DNS records we generate so you can verify them.
• API keys, stored only as a hash with a short visible prefix so you can tell them apart.

Email data

• Metadata for every message: sender address, recipient addresses, subject, size, the sending domain, the status, and delivery events such as delivered, bounced, complained, opened or clicked where tracking is enabled.
• Message content, including the body and any attachments, stored temporarily so the message can be queued, sent, and shown to you in the dashboard while you debug.

Technical data

• Server logs holding request times, API endpoints, response codes and IP addresses, used for security and debugging.
• A session identifier stored as a hash, used to keep you signed in.

Payment data

Payments are collected by Razorpay. Card numbers, UPI identifiers and bank details are entered on Razorpay and are never sent to us. We store only the subscription and payment identifiers Razorpay returns, the plan, the amount, the currency and the status, which is what we need for invoices and access control.

3. Why we use it

• To run the service: authenticate you, accept your API calls, send your email and show its status.
• To bill you and to count usage against your plan limits.
• To protect the platform: detect abuse, stop spam, and keep bounce and complaint rates within provider limits.
• To support you when you ask for help.
• To meet legal, tax and accounting obligations.

We do not sell your data and we do not use your email content for advertising or for training machine learning models.

4. How long we keep it

• Email logs and stored message content are deleted after the retention period set on your account. The default is 30 days.
• Aggregate counters, such as how many messages you sent in a month, are kept for billing history.
• Account records are kept while your account is open, and deleted within 30 days of account deletion.
• Invoices and payment records are kept as long as tax law requires.

5. Controller and processor roles

For your own account data, we are the controller. For the recipient data you submit, you are the controller and we are your processor: you decide who receives your email and why, and we process it only to deliver the messages you ask us to send and to report what happened. You are responsible for having a lawful basis and consent where it is needed, and for answering requests from your own recipients.

6. Sub-processors

Amazon Web Services

Hosting, databases, object storage and email delivery through Amazon Simple Email Service. Region: us-east-1.

Razorpay

Payment processing and subscription billing.

We will update this list before adding a new sub-processor that handles personal data. Recipient mail servers also receive the message you send, which is inherent to email.

7. Security

• All traffic to the API and the dashboard uses HTTPS.
• Data at rest is encrypted, including databases and stored message content.
• API keys and session tokens are stored as hashes, never in plain text.
• Access to production systems is limited to the people who need it.
• Staff actions on customer accounts are written to an audit log.

No system is perfectly secure. If a breach affects your data we will tell you without undue delay.

8. Your rights

You can ask us to:

• tell you what personal data we hold about you;
• correct data that is wrong;
• export your account data and email logs in a machine readable form;
• delete your account and its data.

Most of this is available in the dashboard. For anything else write to [email protected] and we will respond within 24 hours. We may need to verify that the request comes from the account owner.

9. Cookies

We set one cookie, a signed session cookie that keeps you signed in. It is strictly necessary for the dashboard to work. We do not use advertising cookies, analytics cookies or third-party trackers, so there is no consent banner to click.

Separately, if you turn on open and click tracking for your own email, we add a tracking pixel and rewrite links in the messages you send. That is your choice and your responsibility to disclose to your recipients.

10. Children

The service is for business use. We do not knowingly collect data from children.

11. Changes to this policy

If we change this policy we will update the date at the top of the page, and tell you by email when the change is significant.

12. Contact

Privacy questions go to [email protected]. See the Contact page for our postal address and other policies.