1.Who we are
Email Sender is operated by shkeffy LLC, a New Mexico limited liability company, whose mailing address is 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, United States. Questions or requests about your information go to shawn@emailsender.app.
For information about your own account, website visits and billing, we decide how it is used (we are the controller). For the contacts, messages and other records a business puts into its workspace, that business decides how they are used and we process them on its behalf (we are its processor or service provider). If you are one of a customer's contacts, please contact that business first; we will help it respond, and you can always reach us directly.
2.Information we collect
Account and application
Your name, email address, password (stored only as a hash), company, website, social profile, how you heard about us and your answers on the application, plus your role and permissions in each workspace. If you sign in with Google, we receive your Google account ID, name, email address and profile picture.
Workspace content
Contacts and where they came from, contact imports (including the file you uploaded), custom fields, notes, suppression and unsubscribe records, campaigns, templates, follow-up steps, A/B tests, automations, uploaded files and images, dashboards, preferences and activity history.
Connected Gmail accounts
When you connect a sending account you give us its Gmail address and a Google app password. We store the app password encrypted and use it to sign in to Gmail over IMAP and SMTP, the standard mail protocols. With that access we send the messages, replies and follow-ups you authorize, read the mailbox to show conversations in your inbox, sync replies, detect bounces, unsubscribes and out-of-office notes, stop follow-ups when someone answers and measure sending history. Synced message bodies are stored encrypted. We can archive a conversation when you ask us to. We do not delete your email.
Google sign-in, Calendar and profile photo
Google sign-in uses the openid, email and profile permissions. If you connect Google Calendar for meetings, we request calendar.readonly and calendar.events so we can read when you are busy and add, change or cancel the events people book with you. If you choose to use your Google profile photo, we store a copy of the photo. These Google tokens are stored encrypted.
People you email, and how they respond
For the people your workspace emails we store their address, name and any details you add, the messages sent and received, and delivery results. If open or click tracking is on, we record when a tracking image loads or a tracked link is followed, along with the IP address, browser or mail app, referring page, approximate location and network details (for example whether the address belongs to a VPN or a data center). Mail privacy features, security scanners and blocked images affect these numbers, and an open does not prove a person read the email.
Prospect research
To find prospects we collect public information about YouTube channels, podcasts, creators and businesses: names, handles, channel and video details, subscriber and view counts, website text, country, and the business email addresses and contact names they publish, with the page where we found them. We also keep your search settings, your descriptions of who you want to reach and your ratings of the results. Free searches on our website collect the email address and description you enter.
Texting
If texting is turned on for your workspace, we store the phone numbers you text, the messages sent and received (bodies encrypted) and opt-out replies such as STOP.
Chat, connected apps and calls
Our chat stores messages, edits, files, reactions, read receipts and notifications. If you connect WhatsApp, Telegram, Discord or Slack, we receive and store the messages and handles that pass through that connection. Owners and admins can import past Discord conversations into a chat through our extension. If you use calls, we store call details and, where a recording is made with the participants' consent, the recording and transcript.
Meetings and booking pages
Your booking settings and links, and for each booking the guest's name, email address, time zone, answers to your questions, notes and meeting link, plus the reminder and follow-up emails sent about it.
Billing
Payments are handled by Stripe. We store your plan, billing period and Stripe customer and subscription IDs. Card details, billing address and tax IDs are kept by Stripe; we show them to you from Stripe and never store full card numbers.
Support, Luna and the rewrite service
Messages and files you send to support, your conversations with Luna, and what you submit to the email rewrite service (your name, email, company, website, goals, your current email and any files).
Website, devices and security
Pages you visit, referrers, campaign tags, events, browser and device type and approximate location from our website analytics (we do not store the IP address for this), the IP addresses your team signs in from, push notification subscriptions, API key usage, and audit records of important actions.
Browser extension
The extension adds an "Add to prospects" button on YouTube and sends us the link and note you choose to save. It does not collect your browsing history or read your email. Owners and admins can also use it to import a Discord conversation they can see into the chat.
3.How we use information
- To run the service: sign you in, send and receive the email and texts you authorize, sync inboxes, run automations, book meetings and show reports.
- To protect sending accounts: pace sending, start new accounts slowly, watch replies, opens and bounces for signs of spam, honor unsubscribes, and pause sending that looks unsafe.
- To find and rate prospects for you and to learn from your ratings so later searches fit better.
- To provide AI features such as prospect scoring, search suggestions, reply sorting, writing review, sending advice and Luna's answers.
- To bill you, send receipts and service emails, and give support.
- To keep the service secure: detect abuse, spam, fraud and bots, investigate problems and enforce our terms.
- To understand how the website and app are used and to improve them.
- To meet legal obligations and respond to lawful requests.
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: performing our contract with you; our legitimate interests in running, securing and improving the service and in helping businesses reach other businesses with relevant offers; your consent where we ask for it (you can withdraw it at any time); and legal obligations.
4.Warm-up and spam checks
New accounts warm up by sending your own campaign emails to your own contacts, a few a day at first. To tell whether your emails reach the inbox, we look at the replies, opens, clicks and bounces from those real sends. We do not send test emails between accounts and we do not sign in to other mailboxes to check where an email landed.
5.AI processing
We use OpenAI to provide AI features. Depending on the feature we send: public prospect information and your description of who you want to reach; email addresses, business names and website text to work out the person behind an address; the text of a reply to sort it; the draft you ask us to review; numbers about an account's sending health; and, for Luna, your question, recent messages and a summary of your workspace (such as account addresses, campaign names and recent results). We do not send your app passwords or access tokens.
We send only what a feature needs. We do not use Google user data or your mailbox content to train AI models, and we do not let providers use it to train theirs. Your ratings of prospects can be used to improve how our own prospect discovery ranks results. AI output can be wrong; review it before you rely on it.
6.Who we share information with
We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows.
- Your team: people in your workspace see what their role allows.
- The people you contact: the email, texts and booking invites you send reach their recipients.
- Places you send it: webhooks, API clients and connected apps you set up receive the records and events you choose.
- Service providers that run parts of the service for us, under contracts that limit their use of the data. They are listed below.
- Legal and safety: when required by law or a valid legal request, or to protect people, our users or the service.
- A business transfer: if shkeffy LLC is merged, acquired or sells assets, information can move to the new owner under this notice.
| Provider | What it does for us | What it receives |
|---|---|---|
| Google (Gmail, Calendar, sign-in) | Sends and receives your email, calendar events and sign-in | Your messages, events and account details |
| OpenAI | AI features and Luna | The data described under AI processing |
| Stripe | Payments, invoices and billing details | Your billing contact, plan and payment details |
| Sendblue | Text messages | Phone numbers and message text |
| Truelist or MillionVerifier | Checks that email addresses can receive mail | Email addresses being checked |
| ProxyCheck (when enabled) | Tells real visitors apart from VPNs, data centers and bots | IP addresses of email opens |
| Gravatar and Google favicons | Profile pictures and company logos | A hashed email address or a company domain |
| Meta (WhatsApp), Telegram, Discord, Slack | Chat connections you turn on | Messages and handles sent through that connection |
| Apple Podcasts search, OpenStreetMap | Prospect research | Search terms and place names, not your personal information |
| InterServer | Hosts our servers and databases in the United States | All data we store |
7.Google user data
Email Sender's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data, including mail we access with your app password, only to provide the features you use and that are described here. We do not sell it, use it for advertising, or use it to train general AI models. People at Email Sender do not read your mailbox content unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.
8.Cookies and browser storage
We use only first-party cookies. We do not use advertising cookies or third-party trackers, and our website analytics respects Do Not Track and Global Privacy Control signals.
| Cookie | Why | How long |
|---|---|---|
| email_session | Keeps you signed in | 7 days |
| email_oauth, email_oauth_purpose, email_oauth_frame | Completes a Google sign-in or connection safely | 10 minutes |
| email_return | Returns you to your account after a demo | Until you sign out |
| email_trial | Remembers your free prospect search | 30 days |
| es_web_visitor, es_web_session | Website analytics (visits and sessions) | 1 year and 30 minutes |
| shkeffy-theme | Remembers light or dark mode | 1 year |
We also keep small items in your browser's storage, such as unsent reply drafts, layout and date choices, support chat details and whether you have seen the tour. You can clear them in your browser settings.
9.How long we keep information
We keep workspace content while the workspace is active and for as long as needed to provide the service, then delete it as described here. Some records have shorter limits:
| Record | Kept for |
|---|---|
| Sign-in sessions | 7 days (90 days for the extension) |
| IP addresses your team signs in from | 90 days after last use |
| Webhook delivery logs | 30 days |
| Lead events, automation logs and reply sorting | 180 days |
| Notification history | 30 days |
| Audit records | 1 year |
| Free search and demo workspaces | About 24 hours (demos 2 to 4 hours) |
| Media held for chat connections | 30 days |
| Database backups | 30 days |
We may keep information longer when the law requires it, to resolve disputes, to prevent abuse (for example, unsubscribe and suppression records, so someone who opted out is not emailed again) or to enforce our agreements.
10.Disconnecting, exporting and deleting
Disconnect a mailbox in Accounts to stop using it and erase its stored app password; its campaigns pause. You can also revoke the app password in your Google account, and disconnect Google Calendar in meetings settings. Disconnecting does not delete email already sent or recall it from anyone's inbox.
Workspace owners can export workspace records and request deletion in Settings. Deletion pauses sending right away and starts a seven-day window in which you can cancel. After that we remove the workspace's contacts, campaigns, messages, mailboxes and other records, erase mailbox credentials, and anonymize the owner account if it has no other workspaces. Some records can remain for a limited time, such as backups (up to 30 days), billing and tax records, audit records and suppression lists. If you want any remaining records removed, such as tracking history, booking records or uploaded files, email shawn@emailsender.app and we will delete them.
11.Security
We use HTTPS for every connection, encrypt app passwords, Google tokens, message bodies, text messages and webhook secrets at rest with AES-256, hash account passwords and session tokens, restrict access by role, and audit administrative access. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
12.Your rights and choices
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal information, object to or restrict how we use it, and withdraw consent. Email shawn@emailsender.app from the address on your account. We may need to confirm your identity, and we answer within the time the law allows (usually 30 to 45 days). We will not treat you differently for using these rights.
If we found you as a prospect, or a customer emailed you
Use the unsubscribe link in the email, reply asking to stop, or email shawn@emailsender.app with the address to remove. We will remove you from our prospect results and help the business that contacted you stop. Reply STOP to any text to stop texts.
California
In the last 12 months we collected the categories described above: identifiers, customer records, commercial information, internet activity, approximate location, professional information and the content of communications, for the purposes described above. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information to infer characteristics about you. You may use an authorized agent; we may ask for proof of their authority.
Europe and the United Kingdom
You can complain to your local data protection authority. Our servers are in the United States; when we transfer personal information there we rely on appropriate safeguards such as the European Commission's standard contractual clauses. Business customers can ask us for a data processing agreement at shawn@emailsender.app.
13.Children
Email Sender is a business service for people 18 and older. We do not knowingly collect information from children. If you believe a child has given us information, email shawn@emailsender.app and we will delete it.
14.Changes and contact
We will post changes here and update the date at the top. If a change is significant, we will tell account owners by email or in the app before it takes effect, and we will ask for consent before using Google data in a new way that needs it. Questions and requests: shawn@emailsender.app, or write to shkeffy LLC, 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, United States.