Data processing addendum

This addendum (“DPA”) is part of the terms of service between you (“Customer”) and World United Studios Limited (“Sendocado”). It applies when Sendocado processes personal data for you while running the Service, and it is accepted when you accept the terms. If you need a signed copy, email support@sendocado.com.

1. Roles

For the personal data of your contacts and recipients (“Customer Data”), you are the controller and Sendocado is the processor. Words such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meaning given in the GDPR. Where the UK GDPR or other data protection law applies, the matching terms of that law apply.

2. Your instructions

Sendocado processes Customer Data only on your documented instructions. Your instructions are these terms and what you do in the Service: the contacts you add, the campaigns you set live, the emails you send through the app, the API, or an agent you connect. If we think an instruction breaks the law, we will tell you.

You are responsible for having a lawful basis for the processing, including consent where the law requires it, and for the accuracy of Customer Data.

3. Confidentiality

Everyone at Sendocado who can access Customer Data is bound by a duty of confidentiality and accesses it only when needed to run, support or secure the Service.

4. Security

Sendocado keeps the technical and organisational measures in Annex 2. We may improve them over time but will not make them less protective.

5. Subprocessors

You give general authorisation for Sendocado to use the subprocessors listed in Annex 3. We will update that list on this page and email account owners at least 14 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may close your account and we will refund any prepaid fees for the remaining period. Each subprocessor is bound by written terms at least as protective as this DPA.

The email provider you connect (for example Resend, Amazon SES, Postmark, SendGrid, Mailgun, an SMTP server or Gmail) is not our subprocessor. It works for you under your own agreement with it, and Sendocado sends Customer Data to it on your instruction.

6. Helping you answer data subjects

The Service lets you find, correct, export (as JSON) and erase a contact’s data, and records every unsubscribe. If a data subject contacts Sendocado directly about Customer Data, we will send them to you and will not answer for you unless you ask us to.

We will also give reasonable help with data protection impact assessments and consultations with authorities, as far as they concern the Service.

7. Personal data breaches

We will tell you without undue delay, and within 72 hours of becoming aware of a personal data breach affecting Customer Data. We will share what we know, what we are doing about it, and update you as we learn more.

8. Deletion

When you delete a contact, a project or your account, Sendocado deletes the Customer Data in it, in batches, until every record is gone. Records of unsubscribes, bounces, spam reports and blocks are kept so those addresses are never emailed again; after an erasure request they keep only a one-way hash of the address. Backups roll off on their normal schedule.

9. Audits

On request, Sendocado will give you the information you reasonably need to show compliance with this DPA. If that is not enough, you may audit once a year at your own cost, with 30 days’ notice, in a way that does not disrupt the Service or break confidentiality to other customers.

10. International transfers

Sendocado operates from Hong Kong and its subprocessors are mostly in the United States and the European Union. For Customer Data subject to the GDPR that is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 (Module 2, controller to processor; Module 3 where you are a processor), with Annexes 1 to 3 of this DPA as their appendices. For the UK, the UK International Data Transfer Addendum applies. If a clause in this DPA conflicts with the Standard Contractual Clauses, the clauses win.

11. Liability and term

The limits of liability in the terms of service apply to this DPA. This DPA lasts as long as Sendocado processes Customer Data for you.

Annex 1: Details of the processing

• Subject and purpose: storing contacts and sending email campaigns, broadcasts and transactional email for the Customer, and recording what happens to those emails.
• Duration: while the Customer’s account is open, then until deletion is complete.
• Data subjects: the Customer’s contacts and email recipients.
• Personal data: email address, name, time zone, tags and attributes the Customer sets, consent records, email content, delivery, open and click events with IP address and user agent, and replies with their attachments.
• Special categories: none intended. The Customer should not store special category data in tags or attributes.
• Retention: as set by the Customer, except that open, click and delivery events are deleted after 13 months and replies after 12 months.

Annex 2: Security measures

• Encryption in transit (TLS) and at rest.
• Email provider credentials encrypted with AES-256-GCM, with keys kept outside the database.
• API keys and access tokens stored only as SHA-256 hashes.
• Signed tracking, unsubscribe and reply links, so they cannot be forged.
• Every request checked against the project’s owner; projects are isolated from each other.
• Rate limits on the API and the MCP server.
• Staff access limited to what support and security need.
• Error monitoring and logging of security-relevant events.

Annex 3: Subprocessors

• Convex: database, file storage and sign-in.
• Amazon Web Services: app hosting, background jobs, and receiving replies with Amazon SES.
• Resend: receiving replies, when inbound mail runs on Resend.
• Anthropic: AI campaign drafts the Customer asks for.
• Sentry: error monitoring, which may include data in error reports.