Privacy Policy
Who we are, and what this covers
SendClipper sends email from domains you have verified, receives replies into mailboxes, and keeps a log of what happened to each message. This page explains what personal data passes through the service, why, how long it stays, and what you can ask us to do with it.
SendClipper is operated by Marseco SH.P.K., Lagja e Muhagjereve, Rr. Lordi Bajron, Blloku B II-I, 10000 Prishtinë, Kosovo, registration number 811367847. It covers the dashboard, the API, the documentation site and the mailbox app. We are the controller for your account data: write to support@sendclipper.com or by post to Lagja e Muhagjereve, Rr. Lordi Bajron, Blloku B II-I, 10000 Prishtinë, Kosovo about anything on this page.
Two different roles, and the difference matters. For your own account (your name, your sign-in, your billing), we decide what is collected, so we are the controller. For the mail you send and the contacts you upload, you decide who is emailed and why; we only carry it out. There we are the processor and you are the controller, which means the people on your list are your responsibility, and consent is the part of the Acceptable Use Policy we enforce most often. That processor relationship is governed by our Data Processing Agreement, which you enter into the moment you accept the Terms.
What we collect
Your account. Your name and email address, a hash of your password (Argon2id; the password itself is never stored), and, if you turn on two-factor authentication, an encrypted secret for your authenticator app. We record when you sign in, from what IP address and what browser, so you can see and end your own sessions.
Your workspace. The domains you verify, your API keys (stored hashed; we cannot show you a key again after it is created), your webhook endpoints and their signing secrets (encrypted), your templates, and your company postal address, which marketing email is legally required to carry.
The mail you send. The recipient, sender, subject, the message body, any attachments, and the delivery events that come back: accepted, delivered, opened, clicked, bounced, marked as spam. If you upload contacts, whatever fields you put in them.
The mail you receive. If you enable receiving on a domain, the messages sent to it, including their attachments, in full.
Usage. Server logs, error reports, and counts of messages sent per billing period.
Opens and clicks in the mail you send
When tracking is on, we add two things to an outgoing HTML message: a one-pixel image whose download tells us the message was opened, and rewritten links that pass through our server before continuing to their destination. That is how the Opened and Clicked rows on your log get there.
This means we, and you, can tell when a recipient opened your message and what they clicked, along with the time and the IP address the request came from. If you are emailing people in the EU or the UK, that is something your own privacy notice needs to tell them. It is your message and your relationship with them, not ours.
Why we are allowed to hold it
- To run the service you asked for: sending your mail, showing your logs, letting you sign in. Performance of our contract with you.
- To keep the service and its reputation safe: rate limits, the suppression list, detecting abuse, pausing an account that is harming deliverability for everyone else. Our legitimate interest, and the reason a mail provider is allowed to exist at all.
- To count visits to our public pages: Google Analytics, only once you accept it. Your consent, which you can withdraw from the cookies section above at any time.
- To comply with the law: answering an abuse report, honouring an unsubscribe.
- For the mail you send, the lawful basis for contacting each recipient is yours, not ours.
How long we keep it
- Message bodies: 30 days. After that a scheduled job deletes the body, the preview text and the archived copy of the raw message. The row itself, its status and its full event timeline stay, so your log and your statistics remain honest about what was sent.
- Received mail and drafts are kept for as long as your workspace exists. They are your mailbox, and we do not expire them on a timer. Moving a message to Trash files it there; it does not delete it. To have messages deleted, write to support@sendclipper.com.
- Suppressed addresses stay indefinitely, on purpose. An address that hard-bounced or reported you as spam is kept precisely so nothing can mail it again. Removing that record would undo the protection it exists for.
- Sandbox messages are trapped test mail and are deleted on the sandbox's own schedule (30 days by default), or when the sandbox fills and the oldest is dropped.
- Your account and workspace stay until you ask us to close them.
Who else sees it
We do not sell anything, and we do not share data for advertising.
- Amazon Web Services (SES): Delivers and receives your mail and reports what happened to it. Region: The region chosen for each sending domain: US East (N. Virginia), Europe (Ireland) or US West (Oregon).
- Hostinger: Runs the application, its database and the archived copies of messages and attachments on one server. Region: Germany.
- Microsoft Azure (Communication Services Email): Delivers the mail you send through it and reports what happened to it. Region: Europe (the data location of our Azure resource); delivery reports may be processed in other regions.
- Google (Google Analytics): Counts visits to our public pages, only if you accept analytics cookies (never the dashboard, the mailbox app or your mail). Region: Google's data centres, including in the United States.
- The people you email, obviously: their mail provider receives the message you asked us to send.
Where the service runs is also set out on the legal notice. We will also hand over data if the law requires it, and we will tell you when we are allowed to.
Where your data is, and who can reach it
Receiving, and every send Azure does not carry, run through Amazon SES in the AWS region chosen for each sending domain: US East (N. Virginia), Europe (Ireland) or US West (Oregon). A new domain starts in US East (N. Virginia) unless another region is picked, so mail through a domain in a US region is processed in the United States. Mail from an address Microsoft Azure Communication Services can send for your domain (for now, donotreply@) may be sent through Azure, whose data location is Europe; everything else is sent through Amazon SES, and all mail is received through Amazon SES. The application, its database and the archived copies of messages live on one server, run by Hostinger in Germany.
Marseco SH.P.K. is based in Kosovo, and our administrative access to that server is from Kosovo. Kosovo does not hold an EU adequacy decision. For the mail you send and receive, our Data Processing Agreement incorporates the EU Standard Contractual Clauses for that access. See International transfers in the DPA, or write to support@sendclipper.com with any question about where your data goes.
How it is kept
- The dashboard, the API and the mailbox app are served over HTTPS (TLS). Webhook deliveries are encrypted too, unless you register a plain
http://endpoint and confirm that you accept it is not. - Passwords are hashed with Argon2id. Two-factor secrets, webhook signing secrets and sandbox SMTP passwords are encrypted with AES-256-GCM.
- Each workspace's rows are isolated in the database itself, by row-level security: a query made on one workspace's behalf is limited by the database to that workspace's rows.
- An API key is stored only as a hash, which is why it can never be shown to you twice.
What you can ask for
If you are in the EU or the UK you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to it. Write to support@sendclipper.com and we will answer within a month.
If you are on somebody's mailing list and you reached this page from a message you did not want: we send that mail on behalf of the company whose name is on it, and that company decides who gets it. Use the unsubscribe link in the message. It works immediately and it does not need us. If you want to be sure, write to us with the message and we will pass it on and suppress the address.
You can also complain to your national data protection authority. We would rather you told us first.
Changes to this page
When this page changes in a way that matters, the version date at the top changes with it. Everyone who signs up after that accepts the new version, and everyone already signed in is asked to accept it the next time they open the dashboard; their earlier acceptance stays on record. We also email workspace owners about the change where we can deliver to them. The current version is always the one shown here.