Privacy Policy

1. Who we are

CapySend is an email workspace for B2B teams and their AI agents. You can reach us at [email protected].

This policy covers capysend.com (our website) and app.capysend.com (our workspace app).

We are operated by TO CONFIRM: legal entity name and address.

2. Two roles

We handle different kinds of data in different roles.

• Account, billing, support and log data. For this data, we are the controller. This covers your sign-up and account details, billing information, support emails and server logs.
• Customer data in a workspace. This includes emails, contacts and similar content in a workspace. For this data, you (the customer) are the controller and we are the processor. We process it only on your instructions. Our processing terms are in our Data Processing Addendum.

If you are a member of a workspace and want to ask about content in that workspace, please contact the workspace administrator first. They decide what data goes into the workspace and how it is used.

3. What we collect

We collect the following:

• Account information: your email address, your name, a password hash, and the name of your workspace.
• Billing information from Creem: subscription status, order number, email address and amount. We do not receive or store your full card number. Payment details are collected by Creem.
• Support emails: messages you send to [email protected] and our replies.
• Server logs: IP address, time and request details. Email addresses are partly masked in some logs.
• Workspace data: emails, attachments, contacts, delivery, bounce and complaint events, and approval and audit records.

4. How we use it and our legal bases

We use the data above for these purposes:

• To provide the service — including creating and running your account, sending and receiving email through your workspace, and showing you delivery and audit records. Legal basis: performance of a contract.
• For security and abuse prevention — to protect the service, detect misuse and enforce our policies. We also use data to improve the service. Legal basis: legitimate interests.
• For tax and accounting — to meet our tax, invoicing and bookkeeping duties. Legal basis: legal obligation.

We also send system emails that are part of running your account. These include:

• sign-up verification
• password reset
• billing reminders
• a reminder 7 days before an annual renewal
• suspension notices

5. What we don't do

• We do not sell personal information.
• We do not use your data for advertising.
• We do not use email content to train any model.
• Our website uses no analytics tools.

6. AI features

AI writing uses a model provider and API key that you set up in your settings. When you use AI features, the relevant email content is sent to that provider.

That provider is your choice and works under your agreement with them. It is not our subprocessor. If you have questions about how a provider handles your data, check their terms and privacy policy.

7. Who we share data with

We use the following sub-processors:

• Hostinger — server hosting — Boston, United States.
• Cloudflare — DNS, network proxy, and encrypted backup storage (R2) — global network; R2 region TO CONFIRM: R2 region.
• Amazon Web Services (Amazon SES) — platform system email (sign-up verification, password reset, billing reminders) and the hosted sending add-on — Sydney, Australia (ap-southeast-2).
• Creem — payments, subscriptions, tax, and invoices. Creem is the Merchant of Record. Its location is TO CONFIRM: Creem location. Creem’s privacy policy also applies.

Your own sending channels and AI providers are chosen by you. They are not our sub-processors. We may disclose data if law requires it.

8. International transfers

We store production data in the United States. Our platform system email is sent through Amazon SES in Australia. For EU and UK data, the transfer safeguard is TO CONFIRM: SCCs and modules. For China, TO CONFIRM: China cross-border data transfer mechanism and notices.

9. How long we keep data

We keep workspace emails for 90 days on the Free plan and 2 years on the Pro plan. TO CONFIRM: automatic 2-year cleanup on Pro, and how retention applies after a downgrade

When a workspace owner closes a workspace, it becomes read-only immediately. You can restore it within 90 days. After 90 days, we permanently delete its data. Copies in backups expire as backups rotate: local backups are kept for 14 days TO CONFIRM: R2 backup retention period.

Creem and we keep billing records as tax law requires. TO CONFIRM: billing record retention periods.

10. Security

We use HTTPS for data in transit. We encrypt stored credentials, such as sending-channel passwords, signing keys, and AI keys. We make daily encrypted backups; the key needed to decrypt them is kept offline, not on our servers. We redact email addresses in some logs. We do not claim any security certification.

11. Your rights

Depending on your location, you may have rights under GDPR and China’s Personal Information Protection Law. These can include access, export, correction, deletion, restriction, objection, portability, withdrawal of consent, and the right to complain to a regulator.

For emails and contacts in a workspace, the customer is the controller, so please contact the workspace administrator first. For account and billing data, contact us directly.

Workspace admins can export all workspace data in Settings → Workspace. Only the workspace owner can close a workspace. You can also email [email protected]. We will verify your identity before we act. TO CONFIRM: response time.

12. Cookies and children

The workspace uses only one necessary cookie, oae_admin_token. It is for your login session. It is HttpOnly, SameSite=Strict, and HTTPS. It is deleted when you log out. We do not use analytics, advertising, or third-party tracking cookies. See our Cookie Policy.

The service is for businesses. It is not intended for children under 16.

13. Changes and contact

We may update this policy. We will post changes on this page. For material changes, we will notify you in advance. TO CONFIRM: notice period. Contact us at [email protected].