Privacy Policy

This Privacy Policy explains how Data Holdings OÜ (registry code 17512052, registered at Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Estonia), which operates the website datasend.ai and the DataSend.ai platform (“DataSend”, “we”, “us”), processes personal data. Contact: info@datasend.ai.

1. Overview

We process personal data in four contexts, each with its own role and legal basis:

• Platform users — people who register for and use DataSend (we are the controller).
• The business database — companies and their publicly listed business representatives (we are the controller).
• Our customers’ contacts and emails — data customers upload or send through DataSend (we are a processor on the customer’s behalf).
• Website visitors — people who visit datasend.ai (we are the controller).

2. Platform users

For account holders we process account data (name, work email, phone number, company, password in hashed form), billing data (processed by Stripe; we do not store card numbers), usage and technical data (IP address, device and log data) and data needed to prevent abuse, such as sign-up signals used to detect automated or duplicate accounts and a bot check at registration.

If you connect email accounts, we store their access credentials in encrypted form and process the messages sent and received through them as needed to run campaigns, show replies in Unibox and run warm-up. If you connect Google Calendar, we process the calendar events needed for synchronisation.

Google Calendar: we only read and write the events of the calendar you connect, to keep your meetings in DataSend and in Google Calendar in sync. We do not use this data for advertising, do not sell it, do not use it to train AI models and nobody reads it, except with your permission, for security reasons or where the law requires it. DataSend’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis

• Contract (Art. 6(1)(b) GDPR) — to provide the service you sign up for.
• Legitimate interests (Art. 6(1)(f)) — security, fraud and abuse prevention, deliverability protection and product improvement.
• Consent (Art. 6(1)(a)) — marketing messages; you can withdraw at any time.
• Legal obligation (Art. 6(1)(c)) — accounting and tax records.

3. The business database

Our database contains company information — names, registration data, industry, revenue, headcount and websites — together with business contact details such as role-based or publicly listed work emails and phone numbers. Where a record relates to an identifiable individual, it constitutes personal data.

Sources

This information is compiled from publicly available sources, including official business and trade registers, company websites and other lawful public sources. We verify email addresses technically (without sending messages) to keep the data accurate.

Legal basis

We process this data on the basis of our legitimate interests (Art. 6(1)(f) GDPR) in operating a business-to-business prospecting service, limited to a professional context and balanced against the rights of the individuals concerned. Individuals may object at any time (see section 9) and we act on opt-out and erasure requests.

4. Our customers’ contacts and emails

When customers use DataSend to manage contacts, run campaigns, read replies or use warm-up, they are the controller of that data and we process it on their instructions. This includes contacts they import, the content of their emails, replies, and delivery data such as bounces, unsubscribes and — where the customer enables it — opens and clicks. Customers are responsible for having a lawful basis for their outreach.

If you received an email sent through DataSend and want to stop receiving them, use the unsubscribe link in the email or contact the sender. You may also contact us at info@datasend.ai and we will forward your request and suppress your address.

5. Website visitors and cookies

The website uses no advertising or third-party tracking cookies. We measure visits with our own privacy-friendly analytics without cookies: pages viewed, the referring site or campaign, country, device type, a temporary session ID kept in your browser tab and a daily-changing hashed form of your IP address. If you decline in the cookie bar, or your browser sends a Global Privacy Control signal, this data is not collected.

The DataSend app uses an essential cookie to keep you signed in and local browser storage for your settings. These are necessary for the service and do not require consent.

6. How we use data

• To provide, secure and improve the platform and database.
• To run search, CRM, campaigns, Unibox, warm-up, analytics and AI features.
• To monitor and protect deliverability, including checks of your sending domains’ public DNS records and blacklist status.
• To process payments and administer subscriptions.
• To prevent fraud and abuse, such as automated or duplicate accounts.
• To send service communications and, with consent, marketing.
• To meet legal and regulatory obligations.

7. Recipients and processors

We share data only with service providers that act on our instructions under data-processing agreements:

• Stripe — payment processing.
• Vercel — hosting of the website and the app.
• Neon — managed database hosting.
• Hetzner — servers for sending, inbox processing, warm-up and email verification (EU).
• OpenAI — AI features (the AI assistant, email writing and personalisation); only the content needed for the request you make is sent.
• Cloudflare — bot protection at registration.
• Google — calendar synchronisation, only if you connect Google Calendar.
• Our email provider — delivery of account, security and billing emails.

We do not sell personal data. We may disclose data where required by law.

8. International transfers

Some providers (such as Stripe, Vercel, Neon, OpenAI, Cloudflare and Google) are based in the United States or process data there. Such transfers are governed by the European Commission’s Standard Contractual Clauses and, where applicable, the providers’ Data Privacy Framework certification.

9. Your rights

You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. Where we rely on legitimate interests you may object at any time; where we rely on consent you may withdraw it at any time.

Removal from the database. If you appear in our database and wish to be removed, contact info@datasend.ai. We action verified requests without undue delay and record the suppression so the data is not re-added.

To exercise any right, contact info@datasend.ai. We respond within one month. You may also lodge a complaint with your supervisory authority; in Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

10. Retention

We keep account data for as long as the account exists. After an account is deleted, its data is removed within a reasonable period, except records we must keep by law — in particular accounting records for seven years under the Estonian Accounting Act. Suppression records are kept so that removed people are not contacted or re-added. Database records are re-verified regularly and invalid records are removed.

11. Security

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest of mailbox credentials and CRM data, hashed passwords, access controls and regular review.

12. Changes

We may update this Policy. Material changes will be published here with a revised date and, for account holders, announced by email or in the app.

13. Contact

Data Holdings OÜ
Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Estonia
info@datasend.ai