GDPR

DataSend.ai is built for the European market, so data protection is central to how we operate. This page summarises our approach; full detail is in our Privacy Policy.

Our roles

• Controller — for our website visitors and account holders, and for compiling the business database from public sources.
• Processor — when you use DataSend tools (CRM, campaigns, Unibox, warm-up) to process your own contacts and emails. In that case you are the controller and we process on your instructions.

Lawful basis

We rely on contract and legitimate interests to operate and protect the platform, on consent for marketing, and on legitimate interests (Art. 6(1)(f) GDPR) for the business database — limited to a professional context, balanced against individuals’ rights, with an always-available right to object. Our website analytics use no cookies and are not collected if you decline them.

Data subject requests

To access, correct, delete, restrict or port your data, or to object to processing, contact info@datasend.ai. We respond within one month, as required by the GDPR.

Removal from the database

If you appear in our database and want your record removed or suppressed, contact info@datasend.ai. We action verified requests without undue delay and keep a suppression record so the data is not re-added.

Emails sent by our customers

If you received an email sent through DataSend, the sender is our customer and is responsible for it. Use the unsubscribe link in the email, or contact us and we will suppress your address.

Data processing for customers

Where we act as your processor, our Data Processing Agreement governs that processing. The DPA is available on request at info@datasend.ai.

Sub-processors

• Stripe — payment processing
• Vercel — hosting of the website and the app
• Neon — managed database hosting
• Hetzner — sending, inbox processing, warm-up and email verification (EU)
• OpenAI — AI features
• Cloudflare — bot protection at registration
• Google — calendar synchronisation, only if connected

International transfers

Where data leaves the EEA — for example to providers based in the United States — we rely on the Standard Contractual Clauses and, where applicable, Data Privacy Framework certification.

Security

We apply measures appropriate to the risk, including encryption in transit, encryption at rest of mailbox credentials and CRM data, hashed passwords, access controls and regular verification of database records.

Supervisory authority and contact

You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local EU authority. For any GDPR matter: info@datasend.ai.