Privacy Policy

Effective July 30, 2026

Sendibl is an email-sending service for developers. This policy explains what data we handle, why, and for how long. We've tried to keep it readable — if anything is unclear, email support@sendibl.com.

Data we collect about you (the account holder)

When you create an account we store your email address, name, and a salted hash of your password (we never store the password itself). If you upgrade to a paid plan, billing is handled by Stripe — we store your Stripe customer reference, not your card details. We keep operational logs (API requests, sign-ins) to run and secure the service.

Data you send through Sendibl (your customers' data)

To deliver your email we necessarily process message content, recipient addresses, and delivery metadata. For this data you are the controller and Sendibl is a processor: we use it only to provide the service, never for advertising, profiling, or training. Contacts and audiences you upload belong to you and are used solely to send the email you ask us to send.

Retention

Email logs (including content) are visible in your account for 7 days on the Free plan, 30 days on Pro, and 90 days on Scale, and are permanently deleted from our systems shortly after they leave that window. Suppression lists, contacts, templates, and account settings persist until you delete them or close your account. You can export your email log as CSV at any time before entries age out.

Open and click tracking

When enabled (per sending domain, on by default), we add a tracking pixel and rewrite links in the emails you send so we can report opens and clicks back to you. This processes recipients' IP-derived request metadata transiently; we store event counts and timestamps, not browsing profiles. You can turn tracking off per domain in the dashboard.

Subprocessors

We deliver mail through Amazon Web Services (Amazon SES, US West region), host the service on Railway (application and database) and Vercel (website), and process payments with Stripe. Each processes data only as needed for their role.

Cookies

The website sets no advertising or analytics cookies. Signing in stores a session token in your browser's local storage; that's it.

Your rights

You can access and export your data from the dashboard, correct account details in Settings, and delete contacts, domains, or your whole account. For anything you can't do self-serve — including deletion requests under GDPR, CCPA, or similar laws — email support@sendibl.com and we'll respond within 30 days. If you're a recipient of email sent through Sendibl and want it to stop, use the unsubscribe link in the message or contact us and we'll suppress your address.

Changes

If this policy changes materially we'll note it here with a new effective date and email account holders for significant changes.