Skip to content
Sendocado

Privacy policy

Effective October 4, 2026

1. Who we are

Sendocado is run by World United Studios Limited, a company registered in Hong Kong (“Sendocado”, “we”, “us”). This policy explains what we collect when you use sendocado.com, the Sendocado app, its API and its MCP server (together, the “Service”), and what we do with it. Questions go to support@sendocado.com.

2. Two kinds of data, two roles

Your account. For the details of your own account, billing and how you use the Service, we decide how the data is used. We are the controller.

Your contacts and your emails. The people you add to a project, and the emails you send them, belong to you. We handle them only to run the Service for you. For this data you are the controller and we are your processor. Our Data processing addendum sets out those terms. If you are one of our customers’ recipients, contact the sender of the email first; we will help them answer you.

3. What we collect

Account

Your name, email address and profile picture from Google when you sign in with Google, or your email address when you sign in with an email link. Your plan, and the projects you own.

Project data you add

Contacts (email address, name, time zone, tags and attributes you set), consent records you send us, campaigns, broadcasts, templates, images you upload, and the content of every email.

Sender credentials

The API keys, AWS access keys, SMTP passwords and Gmail authorization you give us to send through your provider. We encrypt them with AES-256-GCM before we store them, and we never show them back to anyone.

Email activity

For each email sent through the Service: when your provider accepted it, deliveries, bounces and spam reports your provider reports, opens (through a tracking pixel) and clicks (through a redirect link), with the IP address and user agent of the request, and replies sent to the reply address, including their text and attachments.

API and MCP use

API keys are stored only as a one-way hash. For connected MCP apps we keep the app’s name and hashed access tokens. We log requests for security and rate limiting.

Billing

Your Stripe customer and subscription status. Card details go straight to Stripe; we never see or store them.

Logs and product analytics

Server and error logs (IP address, user agent, request path, time) and product usage events, such as which pages you open and when a campaign goes live.

4. Why we use it

  • To run the Service: store your projects, send your emails through your provider, record what happens to them, and show you replies and stats. (Contract.)
  • To bill you. (Contract and legal duty.)
  • To keep it secure: stop abuse and spam, enforce rate limits and our acceptable use policy. (Legitimate interest.)
  • To improve it: understand which parts of the product are used. (Legitimate interest.)
  • To write to you about your account, sign-in links, billing and changes to the Service. (Contract.)

We do not sell personal data. We do not use your contacts or your emails to advertise, and we do not use them to train AI models.

5. AI drafts

When you ask Sendocado to draft a campaign, we send your request and the project details it needs to Anthropic, which writes the draft. Anthropic processes it for us under terms that do not allow it to train on the data.

6. Google user data (Limited Use)

Sendocado’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • Sign in with Google gives us your name, email address and profile picture. We use them only to create and secure your account.
  • Gmail sending asks for one scope, https://www.googleapis.com/auth/gmail.send. We use it only to send the emails you write or schedule in Sendocado from your own Gmail address. We cannot read, search or delete the mail in your inbox.
  • We do not use Google user data to serve ads, and we do not sell it.
  • We do not transfer Google user data to anyone else, except as needed to provide the sending you asked for, to comply with the law, or as part of a merger with notice to you.
  • No person at Sendocado reads Google user data, unless you ask us to for support, it is needed for security or abuse, or the law requires it.
  • We do not use Google user data to develop, improve or train AI or machine learning models.

You can disconnect Gmail in Settings at any time, or remove Sendocado’s access from your Google account permissions. We then delete the stored authorization.

7. Who we share it with

We share data only with the services we need to run Sendocado. Each one works on our behalf under a written agreement.

  • Convex: database, file storage and sign-in.
  • Amazon Web Services: hosting the app, background jobs and queues, and receiving replies when we use Amazon SES for inbound mail.
  • Resend: sending our own sign-in and account emails, and receiving replies when we use Resend for inbound mail.
  • Stripe: payments.
  • Anthropic: AI campaign drafts you ask for.
  • Sentry: error monitoring.
  • Mixpanel: product analytics.
  • Google: sign-in, and Gmail sending if you connect it.

Your email provider. When you connect Resend, Amazon SES, Postmark, SendGrid, Mailgun, an SMTP server or Gmail, we send your emails and recipients’ addresses to that provider on your instructions. That provider works for you under your own agreement with it, not for us.

We may also share data with professional advisers under confidentiality, with authorities when the law requires it, and with a successor if Sendocado is sold or merged. The successor must protect it at least as well as this policy does.

8. Moving data between countries

We operate from Hong Kong and our service providers are mostly in the United States and the European Union. When data protected by the GDPR or the UK GDPR leaves the EEA or the UK for a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, with encryption in transit and at rest.

9. How long we keep it

  • Account and project data: while your account is open. When you delete a project or your account, deletion starts at once and runs in batches until every record is gone.
  • Opens, clicks and delivery events: 13 months.
  • Replies and their attachments: 12 months.
  • Transactional and test email content: 30 days.
  • Webhook delivery logs: 30 days.
  • Unsubscribes, bounces, spam reports and blocks: kept so we never email that address again. After an erasure request we keep only a one-way hash of the address, not the address itself.
  • Billing records: as long as tax law requires, usually seven years.

10. Security

We use TLS in transit and encryption at rest, encrypt sender credentials with AES-256-GCM, store API keys and access tokens only as hashes, sign every tracking and unsubscribe link, and limit staff access. No system is perfectly secure, and we will tell you without delay if a breach affects your data.

11. Your rights

Depending on where you live, you can ask us to:

  • give you a copy of your personal data;
  • correct it;
  • delete it;
  • limit or object to how we use it;
  • withdraw consent you gave.

You can delete your account in Settings. Inside a project you can export one contact’s data as JSON or erase an address completely. For anything else, email support@sendocado.com. We answer within 30 days. You can also complain to your local data protection authority.

12. California

California residents have the rights above under the CCPA as amended by the CPRA. We do not sell or share personal information for cross-context behavioural advertising.

13. Hong Kong

Where the Personal Data (Privacy) Ordinance (Cap. 486) applies, we follow its data protection principles. You can ask to see and correct the personal data we hold about you.

14. Cookies

We use cookies and local storage to keep you signed in, keep the Service secure and remember your settings, and for product analytics. The marketing site uses no advertising pixels.

15. Children

Sendocado is for businesses and is not meant for anyone under 16. We do not knowingly collect children’s data.

16. Changes

If we change this policy in a way that matters, we will email account owners at least 14 days before it takes effect. The date at the top shows the latest version.

17. Contact

World United Studios Limited, support@sendocado.com. Our postal address is available on request.