How We Handle Your Data

We collect information you provide directly to us when you engage our services, including your name, email address, phone number, company name, billing address, and payment information. When you connect your Mailchimp account to our platform, we access specific data within your account solely to deliver our managed services — this includes subscriber lists, campaign analytics, audience segments, and template designs.

We also collect information automatically when you visit our website, such as your IP address, browser type, operating system, referring URLs, device information, and pages visited. This data helps us understand how our site is used and improve your experience.

If you communicate with us via email, chat, or otherwise, we retain those communications and the metadata associated with them to provide support, improve our services, and maintain accurate records.

We use the information we collect to deliver and maintain our Mailchimp management services, including designing, writing, scheduling, and optimizing your email campaigns. This includes accessing your Mailchimp account to create campaigns, manage audiences, and report on performance.

Your contact information is used to communicate with you about your account, send service updates, respond to support inquiries, and share important notices regarding your subscription or changes to our terms.

With your consent, we may use your email address to send occasional marketing communications about new features, tips, or industry insights. You may opt out of these at any time by clicking the unsubscribe link in any such email or by contacting us directly.

We use aggregated, anonymized data for analytics and service improvement — for example, analyzing campaign performance trends across our client base to refine our strategies and benchmarks. This data cannot be used to identify any individual client or subscriber.

We share your data only with trusted third-party service providers who are essential to delivering our services. These include Mailchimp (our core email marketing platform), Vercel (our website hosting provider), Stripe (payment processing), and Google Workspace (internal communications and document storage).

Each third-party provider is contractually obligated to protect your data and use it solely for the purposes we specify. We do not sell your personal information to anyone, and we never share subscriber data from your Mailchimp audience lists with any third party for their own marketing purposes.

We may disclose your information if required by law, such as in response to a court order, subpoena, or other valid legal process, or to protect the rights, property, or safety of SendCraft, our clients, or others.

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you cancel your subscription, we will retain your account data for a period of 90 days to allow for account reactivation or data export, after which it will be securely deleted or anonymized.

Your subscriber list and audience data remain the property of you, the data controller, and live within your own Mailchimp account at all times — we never store a separate, standalone copy of your subscriber list on our systems. When you cancel, our access to your Mailchimp account is relinquished upon cancellation confirmation, and any cached or working copies of subscriber data, campaign analytics, or audience segments held by us in the course of delivering the service are securely deleted within 90 days. Should you request it sooner, we will delete such data without undue delay, subject only to legal retention requirements. We do not retain or process your subscribers' personal data for any purpose after the engagement ends.

Certain information may be retained longer where required by applicable law or for legitimate business purposes such as tax records, fraud prevention, and dispute resolution. In such cases, access to the data is restricted and it is kept only for as long as legally necessary.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• visibility
  Right to Access: Request a copy of the personal data we hold about you.
• edit
  Right to Rectification: Request correction of inaccurate or incomplete data.
• delete
  Right to Deletion: Request deletion of your personal data, subject to legal retention requirements.
• block
  Right to Restrict Processing: Request restriction of how we process your data in certain circumstances.
• download
  Right to Data Portability: Request transfer of your data to another service provider in a structured format.
• cancel
  Right to Withdraw Consent: Withdraw any consent you have previously given for data processing.

To exercise any of these rights, please contact us at hello@sendcraft.io. We will respond to your request within the timeframe required by applicable law.

We use cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and understand where our visitors come from. Cookies are small text files stored on your device by your web browser.

We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired). The types of cookies we use include:

• cookie
  Essential Cookies: Required for the website to function properly. These cannot be disabled.
• cookie
  Analytics Cookies: Help us understand how visitors interact with our site by collecting anonymous information.
• cookie
  Preference Cookies: Remember your settings and preferences for a more personalized experience.

You can control and manage cookies in your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

We implement industry-standard security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include 256-bit AES encryption for data at rest, TLS 1.3 for data in transit, regular security audits, and strict access controls limited to personnel who require the data to perform their duties.

All third-party services we use — including Mailchimp, Vercel, and Stripe — maintain SOC 2 Type II compliance and adhere to rigorous security standards. We conduct periodic reviews of their security practices to ensure ongoing compliance.

Despite these measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected parties in the event of a data breach as required by applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will notify you by email (if you have an active account) and by posting a prominent notice on our website.

We encourage you to review this page periodically for the latest information on our privacy practices. The “Last Updated” date at the top of this policy indicates when it was last revised.