1. Introduction

SakuraOcean LLC ("Company," "we," "our," "us") operates Sendly, an email delivery platform located at https://usesendly.app ("Services"). This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it.

By using Sendly, you agree to the collection and use of information as described in this policy. If you have questions, contact us at help@usesendly.app.

2. Information We Collect

We collect the following categories of information:

a. Account Information

When you register for an Account, we collect your name, email address, company name, and password. If you upgrade to a paid plan, we also collect billing details, which are processed directly by Stripe. We do not store your full credit card number on our servers.

b. Usage Data

We automatically collect information about how you interact with Sendly, including pages visited, features used, API requests made, timestamps, IP addresses, browser type, and device information. This helps us operate and improve the platform.

c. Email Sending Data

When you send emails through Sendly, we log metadata and content associated with those sends, including recipient addresses, subject lines, message content, delivery status, bounce events, open and click tracking (if enabled), and spam complaint reports. These logs are used to provide the Services, troubleshoot delivery issues, enforce our Acceptable Use Policy, and maintain sending infrastructure health.

d. Recipient Data

You may upload or provide us with contact lists and recipient information as part of using the Services. You are the data controller for that information. We process it solely on your behalf as a data processor, in accordance with our Data Processing Agreement.

e. Communications

If you contact us by email or through our support channels, we retain those communications to resolve your inquiry and improve our support.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your Account and provide access to the Services.
• Process payments and manage your subscription through Stripe.
• Deliver, monitor, and troubleshoot email sending on your behalf.
• Enforce our Terms of Use and Acceptable Use Policy, including monitoring bounce and complaint rates.
• Detect and prevent fraud, abuse, and security threats.
• Send you transactional emails such as billing receipts, account alerts, and security notifications.
• Send you product updates and announcements (you may opt out at any time).
• Analyze usage patterns in aggregated or anonymized form to improve platform features and deliverability.
• Comply with legal obligations.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the Services you signed up for, including account management, email delivery, and billing.
• Legitimate interests: Processing necessary for fraud prevention, platform security, abuse detection, and service improvement, where those interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable laws and regulations.
• Consent: Where we send marketing communications, we rely on your consent, which you may withdraw at any time.

5. Third-Party Services

We use the following third-party services that may receive or process your data:

Stripe

We use Stripe to process payments. When you enter billing information, it is transmitted directly to Stripe and governed by their privacy policy at https://stripe.com/privacy. We receive only a token and summary of your payment method from Stripe.

Umami

We also use Umami, a privacy-focused analytics tool, to collect anonymized website usage statistics. Umami does not use cookies and does not collect personally identifiable information. No data is shared with third parties through Umami.

6. Data Retention

We retain your account information for as long as your Account is active. If you close your Account, we will delete or anonymize your personal data within 90 days, except where we are required to retain it for legal, compliance, or fraud prevention purposes.

Email sending logs, including delivery status, bounce events, and complaint reports, are retained for up to 90 days by default. You may request earlier deletion by contacting help@usesendly.app.

7. International Data Transfers

Sendly's servers and infrastructure are located in the United States. If you are accessing the Services from the European Economic Area, the United Kingdom, or other regions with data protection laws, please be aware that your information will be transferred to and processed in the United States.

For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as a lawful transfer mechanism. By using Sendly, you consent to this transfer. If you have questions about our transfer safeguards, contact us at help@usesendly.app.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request that we limit how we process your data in certain circumstances.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at help@usesendly.app. We will respond within 30 days. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

9. Cookies

We use cookies and similar tracking technologies to operate the Services and understand usage patterns. Specifically:

• Essential cookies: Required for authentication, session management, and platform functionality. These cannot be disabled.

Our analytics tool, Umami, does not use cookies and collects no personally identifiable information.

Stripe may set cookies on your device when you interact with payment forms on our platform. These cookies are managed by Stripe and are subject to their privacy policy at https://stripe.com/privacy. We do not control or have access to the data collected through Stripe's cookies.

10. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

If you become aware of any security issue or unauthorized access to your Account, please notify us immediately at help@usesendly.app.

11. Children's Privacy

Sendly is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly. If you believe a minor has registered an Account, contact us at help@usesendly.app.

12. Links to Other Websites

Our Services may contain links to third-party websites. This Privacy Policy applies only to Sendly. We are not responsible for the privacy practices of any external sites and encourage you to review their policies before sharing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page and update the "Last updated" date at the top. For material changes, we will notify you by email. Your continued use of Sendly after any update constitutes acceptance of the revised policy.

14. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us at help@usesendly.app. We aim to respond to all privacy-related inquiries within 30 days.