Sended Cookie & Local Storage Policy

Version: 2.1-draft · Effective date: [not yet in effect]

1. Who We Are and What This Policy Covers

This Cookie & Local Storage Policy ("Policy") is issued by Elephants Production s.r.o., with its registered seat at Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic, Company ID (IČO): 23397292, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391 (the "Provider", "we", "us").

It explains which cookies, browser storage entries, and similar technologies are used on:

• sended.io — the public landing pages and the Sended application;
• admin.sended.io — the Provider's internal administration console; and
• api.sended.io — the two public pages an End Client reaches from an email: the unsubscribe page and the campaign-link redirect. Neither sets any cookie or browser storage entry, and neither loads any third-party content; see Section 8.

Capitalized terms not defined in this Policy have the meaning given to them in the Terms of Service — in particular Service, Customer, Authorized User, and End Client.

This Policy covers technologies that store or read information in your browser. It also discloses, for transparency, third-party network requests and embedded third-party technologies used by our pages (Section 7) — most of which do not store anything on your device but do transmit your IP address to a third party.

For a full description of how we process personal data, please read our Privacy Policy. This Policy should be read together with it.

2. What Are Cookies and Similar Technologies

Cookies are small text files that a website places in your browser. They are sent back to the server on subsequent requests and are typically used to keep you signed in, secure a session, or measure how a site is used.

Local storage and session storage are browser features that let a website store data on your device without sending it to the server on every request. Local storage persists until it is cleared; session storage is erased when the browser tab is closed. These are not cookies, but the same legal rules on storing or accessing information on your device apply to them, so we disclose them here in the same way.

3. Legal Framework and Consent

The use of cookies and similar technologies in the Czech Republic is governed by Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications (implementing Article 5(3) of the ePrivacy Directive 2002/58/EC), together with the GDPR (Regulation (EU) 2016/679) where personal data is processed.

Under these rules:

• Strictly necessary cookies and storage — those required to provide the service you have expressly requested (e.g. keeping you signed in, protecting sign-in against forgery) — may be used without consent.
• All other cookies and storage — including analytics — require your prior opt-in consent, meeting the GDPR standard of Article 4(11) and Article 7: freely given, specific, informed, and unambiguous. We do not use pre-ticked boxes, we do not use cookie walls, and declining consent has no effect on your ability to use the Service.

4. Strictly Necessary Cookies

The following cookies are set by our servers and are required for authentication and security. They are used without consent because the Service cannot function without them. All of them are set with the HttpOnly flag (they cannot be read by scripts running in the page) and, in production, the Secure flag (they are transmitted only over HTTPS).

4.1 sended.io (application)

4.2 admin.sended.io (administration console)

Domain scope. The four token cookies are deliberately set on .sended.io — with the leading dot — so that a single sign-in works across the application and its API. A consequence worth stating plainly is that this scope also covers every other subdomain, so the two administrator cookies are transmitted to sended.io and api.sended.io as well, not only to admin.sended.io. They are HttpOnly, so no script on any of those hosts can read them, and they are accepted as credentials only by the administration endpoints. The three anti-forgery state cookies carry no Domain attribute at all and are therefore host-only to the API. Signing out removes the token cookies.

5. Local Storage and Session Storage

The following entries are stored in your browser's local or session storage. They are functional or strictly necessary — none of them is used for tracking or advertising — and they never leave your browser except as part of the ordinary operation described below. We list them for transparency.

5.1 sended.io (application)

5.2 admin.sended.io (administration console)

6. Analytics (Consent Required)

We use Google Analytics 4 ("GA4"), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), on sended.io only, to understand how the landing pages and the application are used. The administration console at admin.sended.io uses no analytics.

How consent works:

• Nothing is loaded and nothing is sent before you accept. The Google tag script is not requested from www.googletagmanager.com at all until you have accepted, no measurement hit of any kind is transmitted, and nothing is queued for later transmission. This matters because a "consent denied" hit is still a hit: it would carry your IP address and the page URL to Google. We do not send one.
• On top of that we implement Google Consent Mode v2 with every consent signal — including analytics_storage — denied by default, so that no analytics cookie is written and no analytics identifier is stored unless and until you accept.
• When you first visit and no decision has been recorded, a consent banner is shown with Accept and Decline offered as adjacent, equally sized, single-click choices, together with a link to our Privacy Policy. There is no pre-ticked box, no cookie wall, and declining has no effect on your use of the Service.
• What is reported to Google. Only the page path (for example /pricing, /campaigns) is sent as the page identifier. Query strings are never transmitted, so identifiers of records you are viewing inside the signed-in application do not enter the analytics stream.
• If you withdraw. Recording a withdrawal switches the loaded tag off entirely — it stops sending page views and the hits it would otherwise emit on its own — and expires the _ga and _ga_* cookies for our domain. A decision recorded in one tab takes effect in another on its next navigation. See Section 9 for how to do it.
• Your decision is stored in the sended-analytics-consent local storage key (Section 5.1). The decision applies per browser: if you use a different browser or device, or clear your site data, you will be asked again. Once recorded, it stays in effect in that browser until you clear it or withdraw it — we do not currently re-ask on a fixed schedule.
• We keep no record of your decision on our servers. This is deliberate: the decision lives only in your own browser, so we do not create an additional record about you in order to prove a choice about analytics. The practical consequences are the two above — the decision does not follow you between browsers or devices, and we cannot restore it or produce it for you on request.

Cookies set by GA4 only after you accept:

Google's processing of analytics data is described in Google's own privacy documentation; our role and the associated data transfers are described in our Privacy Policy and in our list of subprocessors.

7. Third-party requests and embedded third-party technologies

Our pages load no third-party content before you act. Fonts are served from our own domain (Section 7.1). One embedded third-party technology, Meta's SDK, is loaded only when you ask to connect WhatsApp and may set cookies (Section 7.2). Section 7.3 is different in kind: nothing is embedded from Stripe at all — billing takes place after a full-page redirect that leaves our site. In the interest of transparency:

7.1 Fonts

Pages on sended.io and admin.sended.io use self-hosted fonts: the font files are served from our own domain together with the rest of the page. No request is made to Google Fonts (fonts.googleapis.com / fonts.gstatic.com) or any other font service, so your IP address does not reach a third party for font delivery.

7.2 Meta (Facebook) SDK — third-party cookies on the WhatsApp connection screen

The WhatsApp channel is not generally available: it is off by default and is enabled per Customer while it is in pre-release. Where it has been enabled for a Customer, and a signed-in Authorized User of that Customer opens the WhatsApp connection screen inside the application (used to connect the Customer's WhatsApp Business account through Meta's embedded signup), the Meta/Facebook JavaScript SDK is loaded from connect.facebook.net only when the Authorized User clicks Connect. Displaying the screen loads nothing from Meta. Before that click the screen states that connecting loads Meta's sign-up, which may set Meta cookies. Once loaded, Meta's sign-up window opens on the next click. The SDK is initialised without its own session cookie on our domain, but Meta's sign-up runs Meta's own code, which may set cookies in your browser, governed by Meta's cookie policy. This is a technology the Authorized User asks for in order to connect the account, not an analytics or advertising cookie, and it can occur only on that specific screen inside the authenticated application, after that click; it does not occur for Customers without the channel enabled, on the public landing pages, or anywhere else in the Service. Meta's role for this processing is that of an independent controller — see Privacy Policy Section 7.

7.3 Stripe-hosted billing pages

Payments and billing management take place on pages hosted by Stripe, reached by a full-page redirect that leaves sended.io. Nothing is loaded from Stripe on our pages at all — no Stripe script is embedded, no request is made to Stripe from your browser while you are on our site, and therefore no Stripe cookie and no IP disclosure to Stripe arise from visiting us. Once the redirect has taken you to Stripe's own pages, Stripe's cookie policy applies there.

8. Emails Sent Through the Service

This Section is written for End Clients — the people who receive a salon's messages. The salon sending them is the controller of that processing; see Privacy Policy Sections 2 and 4.3.

No open tracking. Emails sent through the Service contain no tracking pixel and no per-recipient image, and they set no cookie. There is no open-tracking mechanism in the Service at all: the only feedback we receive about an email is whether it was delivered, bounced, rejected, or reported as spam.

Images. An email may contain ordinary images — a campaign header image, the salon's logo — served from our content delivery network (Amazon CloudFront). As with any remote image in any email, your mail client's request for that image reveals your IP address, the time, and standard client headers to the edge location delivering it, which may be outside the European Economic Area (Privacy Policy Section 8). The images are shared files, identical for every recipient; they are not personalized and are not used to identify you or to infer that you opened the message. Most mail clients let you block remote images, and blocking them prevents this request.

Campaign links. A call-to-action link in a marketing message is rewritten to a link on our own domain that is unique to you and to that one message. When you follow it, we identify you as the recipient of that message before forwarding you to the destination, and we record the time, the message and campaign, the channel, and your browser's user-agent string. We do not record your IP address. Automated fetches by mail-security scanners and link previewers are detected and marked as filtered so they are not counted as your click.

Why this is lawful without a consent banner. No information is stored on, or read from, your device in this process — the identifier travels in the link itself, not in a cookie or in browser storage — so Article 5(3) of the ePrivacy Directive and Section 89(3) of Czech Act No. 127/2005 Coll., which govern storing and accessing information on terminal equipment, are not engaged. What does apply is the GDPR: the click record is personal data, processed by the salon that sent you the message on the legal basis it relies on for its marketing, as part of the campaign analytics and booking attribution described in Privacy Policy Sections 4.3 and 4.4. You can object to it — see Privacy Policy Section 11 — and you can avoid the measurement entirely by not following the link.

Unsubscribe and redirect pages. Both pages are served from api.sended.io (Section 1). Neither sets a cookie, neither writes to browser storage, and neither loads anything from a third party.

9. How to Manage Cookies and Withdraw Consent

Changing or withdrawing analytics consent. You can change your decision or withdraw your consent at any time, with effect for the future:

1. Click Cookie settings in the footer of the public pages of sended.io, including every page of this legal pack. The consent banner opens again, whatever you decided before.
2. Click Decline. Declining is a full withdrawal, not merely a refusal for the future: the tag is switched off at once so it stops transmitting, and the _ga and _ga_* cookies for our domain are expired automatically. If you prefer to remove them yourself, you can also delete them through your browser's cookie settings, or clear the site data for sended.io, after which the banner is shown again on your next visit.

If you need assistance, contact us at privacy@sended.io and we will help you complete the withdrawal.

Browser controls. All major browsers let you view, block, and delete cookies and site data (typically under Settings → Privacy). Please note that blocking or deleting the strictly necessary cookies listed in Section 4 will sign you out and may prevent the Service from functioning.

Per-browser effect. Consent decisions and preferences are stored locally in the browser where you made them. They do not carry over to other browsers, devices, or private-browsing sessions.

10. Changes to This Policy

We may update this Policy when the technologies used by the Service change. The current version is always published on sended.io, with its version number and effective date shown at the top; a change is made by replacing this page and raising that version number.

Notice, however, is not what protects you when the change concerns consent. If we introduce a new technology that requires consent, or change the purpose of one already in use, we will ask you again — a decision you recorded earlier does not carry over to it. Where a change affects readers of the public pages, who are not signed in and cannot be reached by a notice inside the application, the renewed consent request is itself the notice.

11. Contact

This Policy is governed by the laws of the Czech Republic. See also: Privacy Policy, Terms of Service, Sub-processor List.

Elephants Production s.r.o. Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic Company ID (IČO): 23397292 Registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391

General inquiries: contact@sended.io Privacy and data subject requests: privacy@sended.io