For Users & Visitors
SendCopy acts as a data controller for personal data collected about our system users, website visitors, and marketing contacts. This includes signup info, account configurations, and communication preferences.
Trust & Transparency
GDPR Compliance
How SendCopy protects your data, upholds security commitments, and complies with the General Data Protection Regulation.
Updated June 2026 | Safe & Secure Infrastructure
Roles & Contact
Who We Are
For Campaign Data
SendCopy acts as a data processor for personal data that our users upload, import, or generate through outreach campaigns (including lead profiles, sequences, and unified inbox syncs).
Privacy Contact: [email protected]
Data Protection Officer: [email protected]
User Responsibilities
GDPR and
Under GDPR, users automating B2B outreach retain direct obligations. To ensure your platform activity remains compliant, you must review and satisfy the following commitments.
01
Lawful Basis
Ensuring you establish a valid lawful basis (typically Legitimate Interest under Article 6.1.f) for processing and contacting prospects.
02
Permitted Uploads
Not uploading, importing, or scraping data that you do not have permission to process or that violates specific data regulations.
03
Subject Rights
Promptly responding to Data Subject Requests (access, deletion, object) from your leads within the mandatory 30-day timeframe.
04
Clear Outreach
Ensuring outreach sequences are transparent, non-misleading, and provide clear mechanisms for recipients to opt out.
Article 6 Processing
Lawful Basis for
| PROCESSING ACTIVITY | LAWFUL BASIS | EXPLANATION |
|---|---|---|
| Account registration and login | Contract (Art. 6.1.b) | Necessary to provide and maintain the service |
| Delivering the platform features | Contract (Art. 6.1.b) | Running campaigns, storing sequences, executing inbox syncs |
| Customer support & assistance | Contract (Art. 6.1.b) | Addressing inquiries and resolving service tickets |
| Billing and invoicing processing | Contract (Art. 6.1.b) | Managing subscriptions and transaction workflows |
| Product updates & security notices | Contract (Art. 6.1.b) | Fulfilling contractual service obligations |
| Analytics & product improvement | Legitimate interest (Art. 6.1.f) | Understanding product usage to refine UX |
| Marketing to existing customers | Legitimate interest (Art. 6.1.f) | Notifying users of relevant new features and services |
| Marketing to new prospects | Consent (Art. 6.1.a) | Requires explicit opt-in confirmation |
| Analytics & advertising cookies | Consent (Art. 6.1.a) | Active acceptance via localized cookie banner |
| Fraud prevention & security monitors | Legitimate interest (Art. 6.1.f) | Protecting systems and infrastructure |
| Fulfilling legal obligations | Legal obligation (Art. 6.1.c) | Complying with statutory laws and regulations |
Transparency Details
Personal Data We
| DATA CATEGORY | WHAT IT INCLUDES | USED FOR | RETENTION PERIOD |
|---|---|---|---|
| Account data | Name, email, job title, company | Registration, billing, support | Duration of contract + 30 days |
| Billing data | Invoice details, payment references | Payments, financial compliance | 7 years (statutory requirement) |
| Campaign data | Encrypted credentials, sequences, lead lists | Delivering automation services | Duration of contract + 30 days |
| Usage data | Login timestamps, sessions, feature usage | Product improvement, security audits | 13 months |
| Support data | Support histories, account diagnostics | Resolving user inquiries | 3 years after ticket resolution |
| Marketing data | Email, opt-in status, interactions | Marketing communication workflows | Until unsubscribe action is taken |
| Analytics data | Anonymised traffic and behavior patterns | Understanding usage trends | 26 months |
Articles 15-21
Your Rights
SendCopy fully supports individual rights. You can exercise any of these rights by emailing [email protected] directly.
Right of Access (Article 15)
Request confirmation on whether we process your data and receive copies of all associated personal details.
Right to Rectification (Article 16)
Correct inaccurate personal data or complete deficient information stored in our system databases.
Right to Erasure (Article 17)
Obtain the erasure of your data under specific grounds (such as withdrawal of consent or data processing objections).
Right to Restriction of Processing (Article 18)
Limit how we process your personal data during dispute verifications or pending object requests.
Right to Data Portability (Article 20)
Acquire your data in a structured, commonly used format, or request transmission to another processor.
Right to Object (Article 21)
Object to processing activities based on legitimate interests or direct marketing operations.
Right to Withdraw Consent (Article 7.3)
Withdraw processing consents at any time. This action will not affect the lawfulness of past consent-based operations.
Right to Lodge a Complaint
File standard formal complaints with supervisory authorities if you believe processing violates GDPR requirements.
Technical Safeguards
Data Security
Robust protection for every pipeline
We apply state-of-the-art measures to insulate account operations, credentials, and lead details from security vulnerabilities.
SECURITY INQUIRIES
[email protected]Encryption
Data is protected via TLS 1.2+ during transit and AES-256 standards at rest.
Encrypted Credentials
All integrated LinkedIn authorization credentials are encrypted using secure key management.
Strict Access Controls
Internal database access is limited strictly to authorized personnel following principal-of-least-privilege guidelines.
Regular Assessments
We coordinate recurring external penetration audits and vulnerability scanning routines.
Incident Response
Established procedures trigger within 72 hours under GDPR Article 33 guidelines in the event of a breach.
Authorized Vendors
Current
SendCopy coordinates with select sub-processors to fulfill service agreements. We provide users 30-day advance notice before onboarding any new sub-processing vendor.
| SUB-PROCESSOR | LOCATION | SERVICE TYPE | PURPOSE |
|---|---|---|---|
| Stripe | USA | Payment processor | Subscriptions and billing transactions |
| AWS | USA/EU | Cloud infrastructure | Application hosting and datastore storage |
| Google (GA4) | USA | Analytics platform | Analyzing site performance with Consent Mode v2 |
| Intercom | USA | Support & messaging | Direct in-app messaging, support, onboarding chat |
| HubSpot | USA | CRM & marketing | Contact pipeline management & promotional operations |
| Postmark | USA | Transactional email | Notifications, billing updates, password resets |
Data Safeguards
For personal data transfers outside the EEA, UK, or Switzerland, SendCopy ensures compliant protection safeguards are maintained through:
Data Processing Agreement (DPA)
Our standard DPA defines structural processing roles, processor constraints, sub-processor frameworks, and breach obligations.
Specific Guidance
LinkedIn Outreach
GDPR and B2B LinkedIn Outreach
· Lawful Basis (Article 6.1.f)
Direct B2B cold messaging under LinkedIn channels is typically recognized under Legitimate Interest. Ensure your outreach is highly relevant.
· Transparency Obligations
Provide clean transparency by maintaining an active link to your own Privacy Notice on your LinkedIn Profile or initial outreach template.
Consent and Cookies
· Strict & Essential Cookies
We automatically load strictly essential session cookies to maintain core platform login states. These cannot be disabled.
· Opt-in Analytics (Consent Mode v2)
Analytics and marketing trackers are only initialized after active consent is selected. Adjust your options at sendcopy.ai/legal/cookie-policy.
Administration
Additional Disclosures
Children's Data
SendCopy is a dedicated B2B tool. We do not knowingly target or collect personal details from anyone under the age of 16.
Updates to Document
We modify this documentation when operational, technical, or statutory requirements change. Material changes will trigger direct email warnings.
Response Commitments
Standard requests are addressed within 30 days. Complex issues may justify extension by an additional 2 months.