Privacy Statement

We only use your personal information to provide you with the Sendsitive Application or to communicate with you about the services.

Shared account across our products: Sendsitive and Retentive are both operated by Sendsitive LLC and share a common login and single sign-on system that we operate ourselves through our own authentication layer at tivelink.com. This means the account information you provide (such as your name, email address, and authentication credentials) is shared between Sendsitive and Retentive through this authentication layer so that a single account can be used to access both services. This shared sign-on is operated by us, and your information is handled in accordance with this Privacy Statement.

With respect to any documents or information you may choose to upload to the Sendsitive Application, we take the privacy and confidentiality of such documents seriously. We employ industry standard techniques to protect against unauthorized access of data about you that we store, including personal information.

We do not share personal information you have provided to us without your consent, unless:

• Doing so is appropriate to carry out your own request;
• We believe it is needed to enforce our Terms of Service, or that it is legally required;
• We believe it's needed to detect, prevent, or address fraud, security, or technical issues;
• Otherwise to protect our property, legal rights, or that of others.

As part of our normal business operations, your usage of our Services, our administration of you as a customer and to comply with local laws and regulations we collect your Personal Information. We will not process Personal Information for other purposes than described in this Privacy Statement.

A core part of our Services is an archive of marketing emails that brands and senders distribute publicly to their subscribers. We collect, store, index, and display these emails — including their subject lines, send times, sender names, creative, and other publicly distributed content — so that our users can browse and analyze them. We do not collect these emails to identify or contact the individual recipients of those campaigns, and we make commercially reasonable efforts to remove or mask personal recipient details that may appear within archived content.

How we source archived emails: We collect these emails by subscribing to brands’ and senders’ public-facing mailing lists using our own subscription and tracking email addresses. We do not access any recipient’s mailbox, internal corporate systems, or any other unauthorized or non-public data source.

We do not track individual subscribers: Sendsitive does not collect, measure, or attempt to determine the open rates, click-through rates, conversions, or revenue associated with any sender’s individual subscribers. Our archive reflects only the marketing content that senders distribute publicly.

Where this archive contains Personal Information, we process it on the basis of our legitimate interest in providing a public marketing-intelligence service and, where applicable, because the information has been made public by the sender. We balance this interest against the rights and freedoms of the individuals concerned.

Brand and content removal requests: If you are a brand, sender, or rights holder and you would like an email or other content removed from our archive, you can submit a removal request to compliance@sendsitive.com. Please identify the specific content (such as the sender name and a link to the archived email) and the basis for your request. We will review and respond to valid removal requests without undue delay.

While using our Services, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. For example, we collect information when you create an account, request customer support or otherwise communicate with us. The types of information we may collect include basic user information (such as your name, email address, social media avatar, telephone number and photograph), company information and any other information you choose to provide.

We will not collect financial information from you (such as your payment card number, expiration date or security code). All payments to us are handled via a third party, Stripe, Inc. (https://stripe.com). We refer to their Privacy Policy.

When you access or use our Services we automatically collect information about you, including:

Log Information: We collect information about your use of the Services, including the type and version of browser, machine and device you use, access times, usage times, launches, pages viewed, debug, your IP address, the page you visited before navigating to our Services and other statistics.

Information Collected by Cookies and Other Tracking Technologies: We use various technologies to collect information, and this may include sending cookies to your computer or mobile device. Cookies are small data files that help us to improve our Services and your experience, see which areas and features of our Services are popular and count visits. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Services. Examples of cookies we use:

• Session Cookies: we use session cookies to operate our Services.
• Preference Cookies: we use preference cookies to remember your preferences and various settings.
• Security Cookies: we use security cookies for security purposes.
• Advertising Cookies: advertising cookies are used to serve you with advertisements that may be relevant to you and your interests.

Only if you have consented to this, we may also collect information using web beacons (also known as “tracking pixels”), which help deliver cookies, count visits, understand usage and campaign effectiveness and determine whether a notification has been opened and acted upon. In addition, we may use third party services such as Google Analytics, Helpscout and Mixpanel that collect, monitor and analyze these statistics.

Social Sharing Features: Our Services may offer social sharing features, which let you share Sendsitive emails from our Services with other media, and vice versa. The use of such features enables the sharing of information depending on the settings you establish with the company that provides the social sharing feature. Please review the privacy statements of the companies that provide these features.

Third Parties: We may also obtain Personal Information about you from third parties, such as LinkedIn, Facebook, Dribbble, X (formerly Twitter) and other publicly accessible sources.

Support and Service: When you contact us for support or other customer service requests, we can maintain records related to such requests, including any information provided by you.

Our Access to Your Content: Where permitted by law, we will only access, view, or listen to your Content in limited ways — for example, to (A) respond to Feedback or support requests; (B) detect, prevent, or otherwise address fraud, security, legal, or technical issues; and (C) enforce the Terms. Our automated systems may analyze your Content using techniques such as machine learning in order to improve our Services and the user experience.

Marketing or Promotional Communications: Only if you have subscribed to our newsletter, we may use your Personal Information to contact you with marketing or promotional materials. If you no longer wish to receive these, you can opt out at any time using the unsubscribe button in the email or by emailing support@sendsitive.com. Such a request will be processed immediately, and in any event within two (2) business days.

For individuals in the European Economic Area, our processing (i.e. use) of your Personal Information is justified on the following legal bases:

• The processing is necessary to perform an agreement with you or take steps to enter into an agreement at your request;
• The processing is necessary for us to comply with relevant legal obligations;
• The processing is in our legitimate interest, and this justified interest prevails over your privacy; and/or you have consented to the processing.

We collect your Personal Information to:

• Perform our agreement with you and with others;
• Process, evaluate, and complete certain transactions involving the Services;
• Operate, evaluate, maintain, improve, customize, and develop the Services (including by monitoring and analyzing trends, access to, and use of the Services for enhancing customer experience, security, advertising and marketing);
• Provide you with documentation, communications, or any other services you request;
• Correspond with you to resolve queries or complaints;
• Protect and ensure safety of our Intellectual Property Rights;
• Manage, protect against and investigate fraud, risk exposure, claims, and other liabilities, including violation of our contract terms or (international) laws or regulations;
• Adhere to all our worldwide legal obligations.

We may appoint third party service providers (who operate under our instructions) to assist us in providing, operating, maintaining, and improving the Services, and in conducting and managing our business. We may share your Personal Information with these service providers to perform services on our behalf, subject to appropriate contractual restrictions and security measures, or where we believe it is reasonably necessary to prevent harm or loss, or to further an investigation of suspected or actual illegal activities. These service providers have access to your Personal Information only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose.

The main service providers and subprocessors we rely on to operate the Services include:

• Vercel Inc. — hosting of our website and application, and content delivery through its global edge network.
• Turso — database hosting and storage for account and application data; this data may be stored or replicated across multiple regions.
• Cloudflare, Inc. — edge compute (Cloudflare Workers), content delivery, DNS, and security / DDoS protection through its global network.
• Stripe, Inc. — payment processing; we do not store your full payment card details ourselves.
• Google (Google Analytics and Google Ads), Help Scout, and Mixpanel — website analytics, customer support, and product-usage analytics.

Because several of these providers operate global edge networks, your Personal Information may be processed in multiple countries (see “International data transfers” below). We may update this list of providers from time to time as our infrastructure changes. We reserve the right to share any information that is not deemed Personal Information or is not otherwise subject to contractual restrictions, including aggregated and de-identified information.

International data transfers: Sendsitive LLC is based in the United States, and our service providers may store and process data in the United States and other countries. In addition, the Services are operated by an individual located in Venezuela, which means your Personal Information may be accessed and processed from Venezuela — a country outside the United States and the European Economic Area (EEA) that has not received an adequacy decision from the European Commission. Data protection laws in these countries may differ from those in your own jurisdiction. Where Personal Information of individuals in the EEA or the United Kingdom is transferred to a country without an adequacy decision, we will rely on appropriate safeguards where required by law (such as the European Commission’s Standard Contractual Clauses) and take reasonable steps to ensure your Personal Information is treated securely and in accordance with this Privacy Statement. By using the Services and providing us with information, you consent to this transfer.

We may share Personal Information with third parties in connection with a potential or actual sale of our company or any of our assets, in which case Personal Information held by us may be one of the transferred assets. We will provide notice before your Personal Information is transferred and becomes subject to a different privacy policy. In accordance with our legal obligations, we may also process or disclose Personal Information, subject to a lawful request, to public authorities for law enforcement or national security purposes, or where otherwise required by local law or regulations.

We may use third party Service Providers to monitor and analyze the use of our Services, and to advertise to you on third party websites after you have visited our Services. We and our third party vendors use cookies to inform, optimize, and serve ads based on your past visits. You can opt out of these services as described below.

Google Analytics & Google Ads: You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and customize Display Network ads via the Google Ads Settings page. For more information, see Google’s Privacy & Terms.

X (formerly Twitter): You can opt out of X’s interest-based ads following their instructions and review their Privacy Policy.

Meta (Facebook): You can learn about and opt out of Facebook interest-based ads and review Meta’s Data Policy.

The security of your Personal Information is important to us. We aim to safeguard and protect your Personal Information from unauthorized access, improper use or disclosure, unauthorized modification, or unlawful destruction or accidental loss, and we utilize and maintain certain reasonable processes, systems, and technologies to do so. Our personnel are only allowed to access or process Personal Information if this is reasonably required for work related tasks, to adhere to your request or to fulfill a legal obligation on behalf of us.

Please remember that no method of transmission over the internet, or method of electronic storage, is 100% secure or error-free. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security and cannot be held responsible for unauthorized or unintended access that is beyond our control.

Transferring Personal Information: As described under “Personal information we disclose” above, your Personal Information may be transferred to, and processed in, countries other than the one in which you reside, including the United States and Venezuela. We take reasonable steps to ensure that your Personal Information is treated securely and in accordance with this Privacy Statement, and, where required by law, that appropriate safeguards are in place for such transfers.

Personal Information Breach: In the case of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information, we shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the breach to the local supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk to those rights and freedoms, we will communicate it without undue delay on our security page, unless appropriate protective measures (such as encryption) were already applied or subsequent measures ensure the high risk is no longer likely to materialize.

In general the collected Personal Information is not stored by us for longer than three years, unless you do a prior deletion request. However, in some circumstances, we may retain certain Personal Information for other periods of time — for instance where we are required to do so in accordance with legal, tax, and accounting requirements, or if required by a legal process, legal authority, or other governmental entity having authority to make the request, for so long as required. In specific circumstances, we may also retain certain Personal Information for longer periods corresponding to a statute of limitation, so that we have an accurate record of your dealings with us in the event of any complaints or challenges.

You can request deletion of your account and personal data at any time. To submit a deletion request:

1. Email us at support@sendsitive.comwith the subject line “Data Deletion Request”.
2. Include your full name, the email address associated with your account, and any other information that will help us identify your data.

We will respond to your request within 45 days. If we need more time (up to 90 days), we will inform you in writing. Once we verify your identity, we will delete your personal data from our systems, except where we have a legal obligation to retain it or where deletion would interfere with:

• Completing an active transaction;
• Detecting security incidents or protecting against fraud;
• Debugging to identify and repair errors;
• Complying with legal obligations;
• Other internal uses that are compatible with the context in which you provided the information.

We will notify you once the deletion is complete or if we cannot fulfill your request due to any of the above exceptions. Because Sendsitive and Retentive share a login system through tivelink.com, deleting your account may affect your access to both services.

We do not support Do Not Track (“DNT”). Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track by visiting the Preferences or Settings page of your web browser.

The Services are not for use by children under the age of 16 years and we do not knowingly collect, store, share, or use Personal Information of children under 16 years. If you are under the age of 16 years, please do not provide any Personal Information, even if prompted by the Services to do so. If you are under 16 and you have provided Personal Information, please ask your parent(s) or guardian(s) to notify us and we will delete all such Personal Information.

Based on the GDPR you may have rights available to you in respect of your Personal Information, such as:

• To obtain a copy of your Personal Information together with information about how and on what basis it is processed;
• To rectify inaccurate Personal Information (including the right to have incomplete Personal Information completed);
• To delete your Personal Information (where it is no longer necessary in relation to the purposes for which it was collected or processed). We strive to anonymize your Personal Information within 30 days after your deletion request;
• To restrict processing of your Personal Information under certain circumstances;
• To port your Personal Information in machine-readable format to a third party (or to you) when we justify our processing on the basis of your consent or the performance of an agreement with you;
• To withdraw your consent to our processing of your Personal Information (where that processing is based on your consent);
• To obtain, or see a copy of, the appropriate safeguards under which your Personal Information is transferred to a third country or international organization outside of the European Economic Area; and
• To lodge a complaint with your local supervisory authority for data protection.

In addition to the above rights, you have the right to object, on grounds relating to your particular situation, at any time to any processing of your Personal Information which we have justified on the basis of a legitimate interest, including profiling. You also have the right to object at any time to any processing of your Personal Information for marketing or promotional purposes, including profiling for those purposes.

In relation to all of these rights, or if you have any questions about this Privacy Statement, please send an email to compliance@sendsitive.com. Please note that we may request proof of identity, and we reserve the right to charge a fee where permitted by law, especially if your request is manifestly unfounded or excessive. We will endeavor to respond to your request within all applicable timeframes.

This section provides additional details about the Personal Information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act (“CCPA”). This includes the rights to request access to or deletion of your personal information, as well as the right to direct a business to stop selling your personal information.

Right to notice. You have the right to be properly notified of the categories of Personal Information we collect, why we collect it, and with whom we share it, in each case covering the preceding 12 months.

Right to access your information. You have the right to request, covering the 12 months preceding your request:

• The specific pieces of personal information we have collected about you;
• The categories of personal information that we have collected about you;
• The categories of sources from which we collected the personal information;
• The purpose for collecting or selling the personal information;
• The categories of personal information we have disclosed about you, the purpose for disclosing it, and the categories of third parties with whom we disclosed it;
• The categories of personal information we have sold about you, if any, and the categories of third parties to whom we sold it.

Right to opt out of sale. We do not sell the Personal Information we collect to third parties for money or other consideration, as that term is generally understood. However, California law may characterize certain sharing of personal information as a “sale”. You have the right to direct us not to sell your personal information; to exercise it, contact our Compliance team using the details below.

Right to deletion. You have the right to request that we delete any personal information about you that we have collected from you, subject to exceptions.

Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

How to exercise your rights. To exercise the rights described above, please submit a verifiable consumer request by contacting us at compliance@sendsitive.com. Only you, or a person authorized to act on your behalf, may make a verifiable consumer request. We attempt to respond within 45 days of receipt (extendable up to 90 days with notice). Any disclosures we provide will cover only the 12-month period preceding the request.

California’s “Shine the Light” law. California residents with an established business relationship with us may request information once a year about our sharing of their personal information with third parties for those third parties’ direct marketing purposes. To opt out, click “unsubscribe” on any email from us or contact us using the details below.

If you have any questions about this Privacy Statement, or wish to exercise any of your rights, please contact us:

• By email (general / data requests): support@sendsitive.com
• By email (privacy / compliance): compliance@sendsitive.com
• By visiting our website: https://www.sendsitive.com