Privacy Policy

When a business ("Customer") uses the Service to send messages to its own contacts ("Recipients"), the Customer decides who to message, what to say, and why. For that processing the Customer is the controller and Sent is its processor. We handle Recipients' data only on the Customer's instructions and under our Data Processing Addendum with them, which also sets how long it's kept and names the sub-processors involved.

If you're a Recipient and want to exercise your rights over a message you received, contact the business that sent it. They hold the relationship with you and the record of why they messaged you. If you contact us instead, tell us which business it was. We'll verify the Customer, pass your request to them, and help them answer it.

For a narrow set of purposes we decide ourselves and so act as a controller of Recipient data: routing and delivering messages over telecommunications networks, billing our Customers for them, keeping our platform and the networks we connect to free of spam, fraud, and abuse, and meeting the obligations carriers and regulators place on us. Our legal basis is our legitimate interest in operating a lawful messaging service and our legal obligations as a communications provider. We keep the data for those purposes no longer than section 9 says.

From account holders and the people who use an account

• Identity and contact details: name, work email address, phone number, job title, and company.
• Business verification details you submit when you register to send messages: business name, registration or tax identifiers, address, website, the industry you operate in, and a description of your use case. Carriers and registries require this before they let a business send.
• Billing details: billing address, payment method type and its last four digits, and invoices. Card numbers go to our payment processor and never reach our systems.
• Account activity: the messages, contacts, templates, and settings you create in the Service, the API keys you generate, and the actions taken in your account and by whom.
• Support and sales correspondence: what you write to us by email, chat, or form, and our notes on it.

From visitors to sent.dm

• What you type into a form: a contact request, a demo request, a newsletter signup, or an application.
• Device and usage data collected automatically: IP address, browser and operating system, the pages you visit and for how long, the page that referred you, and the identifiers in cookies described in section 6.

Collected automatically when you use the Service

• Device and connection data for your sessions: IP address, browser, operating system, and device identifiers, which we also use to detect accounts created to abuse the platform.
• Usage data: the features you use, when, and from where, and the API requests your integration makes.

From other sources

• From verification and fraud-prevention providers: whether an email address or phone number is valid and reachable, the risk signals associated with an IP address, and the public registration details of a business.
• From public sources and business data providers, where we research a company before contacting it.
• From social networks, where you interact with our pages there.

What you have to provide

Providing the account, business verification, and billing details we ask for is required to create an account and use the Service; without it we can't provide the Service or register you with carriers. Everything else, such as marketing preferences and optional form fields, is voluntary.

Under the GDPR we need a legal basis for every purpose. These are ours.

Where we rely on legitimate interests, we've weighed them against your rights and concluded they aren't overridden. You can ask us for that assessment, and you can object; see section 10.

We share personal data with the categories of recipients below, each only for the purpose stated and under a contract that binds them to protect it. We don't sell it.

• Hosting and infrastructure providers that run our platform, store our data, and deliver our site.
• Messaging platforms and telecommunications providers that carry the messages you send to their recipients. Carriers act under their own telecommunications obligations.
• Payment processors, for billing.
• Customer support, sales, and relationship management tools, which hold your contact details and our correspondence with you.
• Business verification, identity, and fraud-prevention providers, which check registration details, email addresses, phone numbers, device signals, and IP addresses.
• Analytics and marketing measurement providers, as described in section 6.
• Artificial intelligence model providers, for two purposes: the template drafting assistant, when you choose to use it, which receives the text you give it; and the review of business registrations described in section 7, which receives the registration details you submit. Nothing about the people our Customers message goes to them.
• Professional advisers: lawyers, accountants, auditors, and insurers.
• Public authorities, regulators, courts, and carriers, where the law or our obligations as a communications provider require it.
• A buyer or successor, in a corporate transaction.

The sub-processors that handle Recipient data on behalf of our Customers are named on our Sub-processors page at https://www.sent.dm/legal/sub-processors, linked from the Data Processing Addendum.

We're based in the United States and our servers are there. If you're in the EEA or the UK, your personal data is transferred to the United States when you use our site or the Service.

We rely on the European Commission's Standard Contractual Clauses for that transfer, and for transfers to the providers in section 4, with the UK International Data Transfer Addendum for data from the UK, and we've assessed that the transfer is protected in practice. You can ask us for a copy of the clauses we use.

Messages travel to the country of the person receiving them, by the nature of the Service. That transfer is necessary to perform the contract under which the message is sent.

We use cookies, local storage, and similar technologies on sent.dm, on docs.sent.dm, and in the Service at app.sent.dm. They fall into three groups.

On this marketing website, analytics and advertising measurement run when you visit. You can manage stored cookies through your browser settings.

In the Service we also collect device signals to tell real accounts from fraudulent ones. That's necessary processing for the security purpose in section 3.

Necessary

Analytics

Advertising and attribution

When you register a business to send messages, we use automated tools to review the details you submit and to score the risk that an account is fraudulent or would be used for spam. These tools help us decide whether to approve a registration and whether to limit or block traffic.

For the review of registration details we use models from OpenAI, which receive the business and contact details you submitted and nothing about the people you message. Fraud and spam scoring runs on models we host on our own infrastructure, so that data doesn't leave Sent.

A decision to decline a business registration is reviewed by a person before it takes effect. If an automated decision affects you, you can ask us to explain it, give your side, and have a person review it. Write to privacy@sent.dm.

We encrypt data in transit and at rest, limit access to the people and systems that need it, log that access, and review our controls regularly. No system is perfectly secure, and we can't guarantee that yours or ours won't be breached, but if a breach affects your personal data we'll tell you and the relevant authorities as the law requires.

We keep personal data only as long as the purpose needs it, then delete or anonymize it. The main periods are:

• Your account data: for as long as your account exists, and up to 60 days after you close it. Invoices and payment records: 7 years, for tax and accounting law.
• Messages you send through the Service, their content, and their delivery records: up to 13 months after sending, or less if you set a shorter period on your account. You can also choose not to have message content stored at all.
• Business verification records: for as long as your account exists and as long after as carriers and registries require us to keep them.
• Support and sales correspondence: 3 years after our last contact with you.
• Marketing contacts: until you unsubscribe, or 2 years after you last engaged with us.
• Security and access logs: 1 year. Application logs: 30 days.
• Backups: 30 days after the data they contain is deleted.

We may keep data longer where a legal obligation, a legal claim, or a request from an authority requires it.

If you're in the EEA or the UK, you have the right to:

• Access the personal data we hold about you and get a copy.
• Correct it if it's wrong or incomplete.
• Have it erased, where we no longer need it or you've withdrawn consent or objected.
• Restrict how we use it while a dispute about it is resolved.
• Receive the data you gave us in a portable format, or have us send it to another provider.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent you've given, without affecting what was done before.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, as section 7 explains.

To exercise a right, email privacy@sent.dm or use the request portal run by our EU and UK representatives, linked in section 13. We'll need to confirm it's you. We answer within one month, or tell you within that month if a complex request needs up to two more. Exercising a right costs nothing.

You can also complain to a data protection authority. We have no establishment in the European Union, so you can complain to the authority of any member state, including the one where you live or work. In the UK, that's the Information Commissioner's Office. We'd appreciate the chance to resolve a concern first.

If you're a Recipient of a message sent by one of our Customers, section 1 explains how to exercise these rights.

You can stop marketing emails by using the unsubscribe link in any of them or by writing to privacy@sent.dm. We'll still send you messages about your account, such as invoices, security notices, and changes to our terms, because the Service needs them.

We don't sell, rent, or share mobile phone numbers, SMS opt-in data, or consent records with third parties for their marketing, and every category of sharing in this notice excludes them.

We do pass them to the messaging platforms, telecommunications carriers, and delivery providers that transmit text messages, because that's what sending a text requires.

The controller of your personal data is Sent, Inc., at the address in section 16. Questions about data protection go to privacy@sent.dm.

We don't have an establishment in the European Union or the United Kingdom, so under Article 27 of the GDPR and the UK GDPR we've appointed representatives there. You can contact them about your personal data, and you can verify the appointment and submit a data subject access request, a deletion request, or any other GDPR request through their portal. Requests submitted there are logged and tracked.

The Service is for businesses and our site isn't directed at children. We don't knowingly collect personal data from anyone under 16, or under 13 in the United States. If you think a child has given us personal data, email privacy@sent.dm and we'll delete it.

We'll update this notice when our practices change. The date at the top tells you when. For a material change we'll email account holders before it takes effect, and we'll never apply a change retroactively to data we collected under an earlier version without your consent where the law requires it.