Back to Home

Privacy Policy

Version: 2.1-draft · Effective date: [not yet in effect]

1. Who We Are

Sended is a multi-channel client-communication platform for salon and beauty businesses ("Sended" or the "Service"), available at sended.io. The Service is operated by:

Elephants Production s.r.o., with its registered seat at Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic, Company ID (IČO): 23397292, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391 (the "Provider", "we", "us", "our").

Contacts:

• General enquiries: contact@sended.io
• Privacy and data subject requests: privacy@sended.io

In this Privacy Policy:

• "Customer" means the salon business that holds a Sended account. Sended is designed for salon businesses: an account may only be opened by a person acting in the course of their business or profession, and registration requires an express confirmation of that capacity (Section 420 of the Czech Civil Code) before the account is created. We rely on that representation; where mandatory law nevertheless treats a Customer as a consumer, the consumer's rights are unaffected.
• "Authorized User" means an individual who uses a Customer's account (for example, the salon owner or salon staff).
• "End Client" means the Customer's client or prospective client (a salon client) whose personal data is processed through the Service on the Customer's behalf.

This Privacy Policy explains what personal data we process, why, on what legal basis, with whom we share it, how long we keep it, and what rights you have. It supplements, and should be read together with, our Terms of Service, Data Processing Agreement, Subprocessor List, and Cookie Policy.

2. Our Two Roles: Controller and Processor

We process personal data in two distinct capacities, and your rights are exercised through different routes depending on which category you fall into:

As controller, we decide why and how personal data is processed. This covers Customer and Authorized User accounts, billing, security and audit logging, support, our own marketing to Customers, and the operation of our website.

As processor, we process End Client personal data — salon client contact records, appointment history, and message conversations — strictly on behalf of and on the documented instructions of the Customer. The Customer (your salon) is the controller of that data and determines the purposes and legal bases of the processing. Our processor obligations towards Customers are set out in our Data Processing Agreement.

Provider administrative access. A limited number of authorized Provider personnel operate an internal administration console at admin.sended.io. Through it they can open a Customer's workspace to investigate a support request or an incident, read the support overview of an account, inspect and re-deliver stored webhook payloads received from integrated platforms (which contain End Client data), re-queue a CRM synchronization, and reconcile message delivery records. This access is limited to what the task requires, is subject to confidentiality obligations, and is recorded in our platform-administration audit log. Where it reaches End Client data we act as processor on the Customer's behalf; the record of the access itself is kept in our own controller capacity.

Safeguards we apply of our own motion. Some protections built into the Service are applied by us because we owe them in our own right as the operator of the sending infrastructure, and the Customer cannot switch them off: enforcement of recorded marketing opt-outs across channels, per-recipient frequency limits, the service-wide email suppression list (Section 4.3), and the AI-interaction disclosure inserted into AI-assisted conversations (Section 12). Deciding on and applying these compliance measures does not make us and the Customer joint controllers within the meaning of Article 26 GDPR: the Customer alone determines whom to contact, with what content, and on what legal basis, and we do not use End Client data for our own purposes beyond the limited controller-capacity processing expressly described in this Policy.

Transparency toward End Clients. Customers are contractually required to inform their own clients about the processing described in Section 4 and to make this Privacy Policy available to them — at the point where client data is collected and in first contact through the Service. That duty, and the Articles 13 and 14 obligations it discharges, are allocated to the Customer in the Data Processing Agreement.

If you are an End Client (a salon client) and want to exercise your privacy rights or ask about how your data is used, please contact your salon first — it is the controller and is best placed to act on your request. If you cannot reach your salon, do not know which salon holds your data, or prefer to contact us directly, write to privacy@sended.io: we will identify the relevant Customer, forward your request to it within 5 business days of receiving it, and assist in its handling.

3. Personal Data We Process as Controller (Customers, Authorized Users)

3.1 Account and Sign-In Data

• Name (first and last), email address, phone number
• Password, stored only as a salted cryptographic hash — never in plain text
• Profile photo/avatar, locale, timezone
• Email and phone verification status; the timestamp and IP address of your last sign-in (a single current value on your user record, overwritten at each sign-in — see Section 9.2)
• Channel-connection identity and credentials: where an Authorized User connects a messaging channel to the account, we store the identity and the credential needed to keep that connection working — for Telegram, the phone number, Telegram user ID, first and last name, username and session credential of the Authorized User's own Telegram account (the Service sends from that account, not from a bot); for WhatsApp and Instagram, the connected business account identifiers and the platform access tokens. These credentials are encrypted at rest (Section 10) and are used only to operate the connection the Customer asked for
• Google sign-in: if you sign in with Google, we receive your Google account identifier, name, email address, and profile picture from Google. We use this data solely to create and authenticate your account. Sended's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Session data: authentication cookies and session/refresh tokens (stored server-side only as cryptographic hashes), and short-lived sign-in state cookies

3.2 Business and Billing Data

• Business name, branch details, staff roster, and service catalogue configured in the account
• The Customer's legal identity for message compliance: company registration number (IČO) and registered seat, which appear in the legally required footer of marketing emails sent through the Service
• Billing email address, subscription plan, subscription status, and trial/billing period dates
• Tax identity of the paying business: the billing country and, where provided, the VAT identification number entered at checkout on Stripe's hosted page and returned to us. We use them to determine the place of supply and eligibility for the B2B reverse charge, and we keep them as tax evidence. For a Czech sole trader the VAT identification number (DIČ) may incorporate a national identification number, so we treat this field as sensitive and use it for no purpose other than tax compliance
• Payment data: we store only Stripe reference identifiers (customer and subscription IDs) and subscription state. Payment card details are entered directly on Stripe-hosted pages and never touch our systems.

3.3 Usage, Security, and Audit Data

• Activity logs of actions performed in the platform, including the IP address and browser user-agent of the acting user
• Security audit records of significant account changes, including IP address and user-agent
• Records of your acceptance of our legal documents: which document (Terms of Service, Privacy Policy, Acceptable Use Policy) and which version you accepted, the moment of acceptance, the express confirmation that you act in a business capacity, and the IP address and browser user-agent from which the acceptance was made. These records are written once per document version and are never overwritten — they are the evidence that the contract was concluded and on what terms
• Records of administrative access to your workspace by Provider personnel (Section 2), including who accessed what and when
• Technical error and diagnostic data captured by our error-monitoring tooling (see Section 7 — Sentry), which may include request metadata; direct identifiers such as email addresses and phone numbers are automatically redacted from error reports before they leave our systems
• In-product analytics: where you have consented via the cookie banner, Google Analytics 4 measures page views inside the signed-in application. What is reported is the page path only — never the query string, so identifiers of the records you are viewing stay out of the analytics stream. Without your consent, nothing is loaded and nothing is sent. See Section 5 and the Cookie Policy
• In-product state needed to operate the interface (onboarding progress, interface preferences)

3.4 Support and Communications

• Support requests you send us and our related correspondence
• Internal operational notes needed to administer and support your account

3.5 Whether You Are Required to Provide This Data

Only four items are actually required to enter into and perform the contract for the Service: your email address, password, first name and last name. Without them we cannot create or operate the account. The Customer's company registration number (IČO) and registered seat (Section 3.2) are required by Czech Act No. 480/2004 Coll. for the legally required sender identification in marketing emails; without them the email marketing channel is unavailable, but the rest of the Service works. The billing country and, where applicable, the VAT identification number are collected at checkout because tax law requires us to determine and evidence the place of supply.

Everything else described in this Section 3 — including your phone number, profile photo, locale and timezone — is voluntary. Not providing it has no consequence other than limiting the corresponding feature.

4. Personal Data We Process as Processor (End Clients, on Behalf of Customers)

We process the following End Client data only on behalf of the Customer. The Customer is the controller; the descriptions below are provided for transparency.

4.1 CRM Data Synchronized from Altegio

When the Customer connects its Altegio (YCLIENTS) CRM account, we synchronize, at the Customer's direction:

• End Client name, phone number, and email address
• Date of birth and gender, where recorded in the Customer's CRM
• Free-text notes entered by salon staff in the CRM (client comments and appointment comments), and custom fields. These fields are under the Customer's editorial control; we mirror them as written, without inspecting or filtering their content
• Visit count, last visit date, spending history, loyalty points, and tags
• Appointment records (date, time, service, staff member, status including no-shows, price)
• Salon staff records (name, position, contact details) and the service catalogue

Data flows in both directions: client records and bookings created or updated through the Service are written back to the Customer's Altegio account.

Date of birth and last visit date initiate messages. These two fields are not merely stored. Where the Customer has configured the corresponding automation, a daily job evaluates every synchronized client record and initiates an outbound message on the basis of them — a birthday message around the date of birth, or a re-engagement message once the last visit date is older than the interval the Customer set. No member of salon staff acts at the moment of sending. See Section 4.4.

Special categories of personal data (Article 9 GDPR). In a salon context a free-text note is exactly where a health-adjacent detail can end up — an allergy, a skin condition, a pregnancy, a medication — and the Service cannot prevent it: the fields are unbounded free text, mirrored verbatim from the Customer's CRM.

Neither we nor the Customer intends the Service to hold special-category data, and we ask Customers to record only the functional need relevant to delivering the service ("uses fragrance-free products", "extended patch test before colouring") rather than a diagnosis, a treatment, or any other health statement. The Customer, as controller, is responsible for what its staff enter and for identifying an Article 9(2) condition — normally the End Client's explicit consent under Article 9(2)(a) — before any such information is recorded.

Where special-category data nevertheless reaches the Service, we process it only within the scope necessary to provide the Service on the Customer's instruction, subject to the same security measures as all other End Client data (Section 10) and with no separate analysis of it. Free-text notes are never used for segmentation, scoring or any other analysis described in Section 4.4, and are never sent to our AI providers as part of the AI assistant's tool results. If we become aware that special-category data is held without a valid basis, we will restrict processing of the affected records and, on the Customer's instruction or where the Customer does not act, delete them.

4.2 Messages and Conversations

• Content of messages sent through the connected channels — email (via Amazon SES), WhatsApp (via Meta's WhatsApp Business Platform, Cloud API), Telegram (sent from the Customer's own connected Telegram account — not a bot), and, where and when enabled, Instagram Direct (this channel is in development)
• Content of messages received from End Clients on the two-way channels only — WhatsApp, Telegram and, where enabled, Instagram Direct. Email is outbound only: replies to a marketing or automation email go to the Customer's own reply address and are not received, displayed, or stored by the Service
• Contact details of conversation counterparts (phone number, display name, username, avatar)
• Media attachments, including images and voice messages
• Voice transcriptions: where AI features are enabled for the Customer's workspace, voice messages are transcribed using OpenAI's Whisper service and the transcription is stored alongside the message
• Delivery and read status: we record per-message delivery events; for WhatsApp and Telegram this includes read receipts provided by those platforms
• Where AI features are enabled: AI-generated reply suggestions, the related conversation context, and records of proposed AI actions awaiting the Customer's approval (see Section 12)

4.3 Campaign Delivery and Engagement Data

• Rendered content of each campaign or automation message sent to an End Client, and its per-channel delivery status
• Click tracking: call-to-action links in marketing messages are rewritten to a signed link on our first-party redirect domain that is unique to one recipient and one message. Following it identifies you to us as the recipient of that message before you are forwarded to the destination. We record the time of the click, the message and campaign it belongs to, the channel, and the browser's user-agent string. We do not record the IP address of the click. Automated fetches by mail-security scanners and link previewers are detected and stored marked as filtered, together with the reason, so they are excluded from statistics rather than counted as your click.
• No email open tracking: we do not use tracking pixels or any other form of email open tracking. Delivery feedback for email is limited to bounce, complaint, delivery, and rejection events reported by Amazon SES.
• Images in messages: a campaign or automation message may embed images (a campaign header image, the salon's logo) that your mail or messaging client loads from our content delivery network, Amazon CloudFront. That request reveals your IP address, the time, and standard browser or mail-client headers to the edge location serving it, which may be outside the European Economic Area (see Sections 7 and 8). The images are not personalized per recipient and are not used to identify you or to measure opens; they are ordinary shared image files, and your client's setting for loading remote images controls whether the request is made at all.
• Opt-out records: when an End Client objects to a Customer's marketing — through the one-click unsubscribe mechanism or the footer link in a marketing email, by stopping messages inside WhatsApp, or because salon staff recorded a refusal received off-platform — we record the objection with its source and timestamp and enforce it across all marketing channels for that Customer. Marketing sends are also subject to per-recipient frequency limits and the Customer's configured quiet hours.
• Withdrawing an objection: the unsubscribe page offers the recipient, and only the recipient, a way to undo the objection. It requires a deliberate action on that page (a link scanner following the address cannot trigger it), and it removes the opt-out record rather than annotating it — after it runs, the salon may message you again and the previous objection is no longer stored.
• Suppression list (our controller role): independently of individual Customers, we maintain a service-wide list of email addresses that have hard-bounced or lodged spam complaints, and we block further sending to them. We process this list as controller, in our legitimate interest of protecting email deliverability and complying with mailbox-provider and infrastructure anti-abuse requirements.

Information for people on the suppression list (Article 14 GDPR). Because we operate the suppression list as controller and did not obtain the address from you, the following applies to you if your email address is on it:

• Controller: Elephants Production s.r.o. (Section 1); contact privacy@sended.io.
• Source: your email address came to us from the salon that attempted to email you through the Service. It is not obtained from any publicly accessible source and we do not buy or enrich it.
• Data processed: the email address, the type of event (hard bounce or spam complaint), the time it occurred, and the resulting blocked status. No message content and no other profile data.
• Purpose and legal basis: blocking further sending to addresses that bounce or complain, in our legitimate interest (Article 6(1)(f)) in protecting the deliverability of our shared sending infrastructure and in meeting the anti-abuse requirements of Amazon SES and receiving mailbox providers. The alternative — continuing to send to an address that has rejected or reported mail — harms both you and every other salon on the platform.
• Recipients and transfers: the list is used inside our own systems and by Amazon SES as our processor (Section 7). It is not shared with Customers other than as a "cannot be sent to" indication.
• Retention: for as long as the block is needed to protect deliverability; a spam-complaint entry is kept indefinitely unless we lift it, because it records your objection to receiving mail.
• Your rights: all of the rights in Section 11 apply, including the right to object and the right to lodge a complaint with a supervisory authority. Requests about the suppression list should be sent to privacy@sended.io directly rather than to a salon — we are the controller of it (see Section 11.2). Note that erasing your entry would not cause a salon to email you again; it would only remove the protection, so we will normally satisfy an objection by explaining the entry rather than deleting it.
• Why you may not have heard from us before: we hold no reliable route to reach you other than the address that bounced or on which you complained, and contacting you at it would defeat the purpose of the block. We therefore rely on Article 14(5)(b) GDPR (disproportionate effort and a purpose that individual notification would frustrate) and publish this notice here instead.

4.4 Analysis and Segmentation

On the Customer's instruction, the Service analyses End Client records and engagement to help the salon decide whom to contact and what worked. This is profiling within the meaning of Article 4(4) GDPR — automated processing used to evaluate personal aspects of an individual, here their value and likely responsiveness as a client of that salon. It is not automated decision-making producing legal or similarly significant effects within the meaning of Article 22 (see Section 12). The Customer is the controller of it.

• Scoring (RFM). Each End Client is scored automatically on how recently they visited, how often they visit, and how much they have spent. The scores are recomputed as the underlying data changes, are shown to salon staff, and are used to generate suggested audiences ("lapsing regulars", "high spenders").
• Segments. The Customer defines rules over client attributes — visit history, spend, tags, dates, channel — and every End Client record is evaluated against them. Membership of each segment is stored per individual and re-evaluated automatically on a recurring cycle (currently every four hours), so a person can enter or leave a marketing audience without anyone at the salon acting.
• Automated triggers. Date of birth and last visit date are evaluated daily to initiate birthday and re-engagement messages (Section 4.1).
• Conversion attribution. We link a marketing message to a booking that follows it. Two inference rules are used, and the stronger one wins: click-then-book — the End Client followed the campaign link and then booked; and sent-then-book — the campaign was sent to that End Client and a booking followed within the campaign's attribution window (14 days by default). The attribution is inferred from timing; the booking itself carries no marker from us. For each attributed booking we store the campaign and the individual message, the End Client, the appointment, when the message was sent, when the booking was made and for when, how many days elapsed, the rule that matched, and the appointment status — including cancellation and no-show. If the Customer's booking system later reports that the client actually attended, that fact is written back to the record afterwards. At most one attributed booking is recorded per End Client per campaign.

Free-text notes (Section 4.1) are excluded from all of the above. As an End Client you can object to this processing at any time; see Section 11 and, for marketing, the opt-out routes in Section 4.3.

5. Website Visitors

When you visit sended.io:

• Essential cookies are used for authentication and sign-in security. See the Cookie Policy.
• Google Analytics 4 is used to measure usage of the website and of the signed-in application (page views and navigation) — only with your consent. Until you accept in the consent banner, the Google measurement script is not loaded at all, nothing is queued, and no measurement of any kind is transmitted to Google; we additionally implement Google Consent Mode v2 with every signal denied by default. If you later withdraw consent, measurement stops, the analytics cookies set for our domain are expired, and nothing further is sent. The page identifier reported to Google is the path only — never the query string, so identifiers of records you are viewing inside the application are not transmitted. The banner is shown on the public website and in the application alike.
• Fonts are self-hosted. No font service, Google Fonts included, receives a request from our pages, so no third-party request precedes your consent decision.
• Cookie settings in the footer of the public pages reopens the consent banner at any time, so you can change or withdraw your decision.
• We do not use advertising cookies, cross-site tracking, or session-recording tools on our public website pages. One exception may apply inside the signed-in application: where the WhatsApp channel is enabled for a Customer, Meta's SDK, loaded on the WhatsApp connection screen only once the user clicks Connect, may set Meta cookies — see Cookie Policy Section 7.2.

6. Purposes and Legal Bases (Article 6 GDPR)

6.1 As Controller

Where we rely on legitimate interest, we have balanced our interests against the rights of the individuals concerned; you may object at any time (see Section 11).

6.2 As Processor

For End Client data (Section 4), the Customer determines the purposes and legal bases. Typically these are the performance of the salon's contract with its client (appointment communications), the salon's legitimate interest in marketing its own similar services to its own existing customers — which in the Czech Republic is subject to the conditions of Section 7(3) of Act No. 480/2004 Coll. (contact obtained from the customer in connection with a sale, promotion of the salon's own similar services only, and a simple free opt-out offered in every message) — or the End Client's consent. The Service is built to support these obligations: every marketing email sent through the Service is labelled as a commercial communication, identifies the sending salon (including its registration number and registered seat), and carries a working one-click unsubscribe link; recorded opt-outs are enforced across all marketing channels. An opt-out applies to the salon whose message it was: if you are a client of several salons that use the Service, unsubscribing from one salon's marketing does not affect the others — each salon is a separate controller, and the unsubscribe page names the salon your opt-out applies to. (Separately, an email address that hard-bounces or raises a spam complaint is suppressed service-wide — see Section 6.1 — because that signal concerns our sending infrastructure rather than any one salon.)

The same applies to the optional AI-assisted features (Section 12): the processing of conversation content and voice recordings by those features is processing of End Client data carried out on the Customer's documented instruction — given by enabling the feature for its workspace — and the Customer, as controller, determines the legal basis for it, as set out in the Data Processing Agreement.

7. Recipients of Personal Data

We do not sell personal data. We share personal data with the following recipients, strictly to the extent needed for the purposes described above. Recipients that process personal data on our behalf are bound by data processing agreements; the authoritative, maintained list of our subprocessors, including their roles and locations, is the Subprocessor List.

We may also disclose personal data where required by law, regulation, or a binding order of a court or authority, or where strictly necessary to protect the rights, property, or safety of the Provider, our Customers, End Clients, or the public.

8. International Data Transfers

Our core infrastructure — compute, database, and object storage — runs in the European Union (AWS, region eu-central-1, Frankfurt), with our own inbound mail routed through eu-west-1 (Ireland). Some of the recipients listed in Section 7 — in particular OpenAI, Meta, Stripe, and Google (for sign-in, analytics and fonts) — may process personal data in the United States or other countries outside the European Economic Area. Sentry and MongoDB Atlas store their data in the EU (Sentry's EU data-residency region; Atlas in AWS Frankfurt), with any residual access from outside the EEA covered by the mechanisms in Section 7.

Content delivery. One further exposure sits inside AWS itself. The Service's web applications and the images embedded in messages are served through Amazon CloudFront, whose edge locations span the world and are not restricted to the EEA. When an Authorized User loads the application, or an End Client's mail or messaging client loads an image embedded in a message (Section 4.3), the edge location serving that request receives the requester's IP address and standard client headers. The stored objects themselves remain in eu-central-1; what leaves the EEA is the request metadata at the edge. This transfer is covered by the AWS data processing addendum and the Standard Contractual Clauses referred to below.

For such transfers we rely on the following safeguards:

• EU–U.S. Data Privacy Framework (DPF): where the recipient is certified under the DPF, we rely on the European Commission's adequacy decision for the framework.
• Standard Contractual Clauses (SCCs): where a recipient is not DPF-certified, or as a fallback safeguard in addition to the DPF, we rely on the Standard Contractual Clauses adopted by the European Commission in June 2021 (Decision (EU) 2021/914), supplemented where appropriate by transfer impact assessments and additional technical and organizational measures.

Telegram requires separate mention. Telegram FZ-LLC is established in the United Arab Emirates, a country for which no EU adequacy decision exists, and Telegram does not offer platform customers a standard EU transfer mechanism comparable to the DPF or vendor SCCs. The Telegram channel operates only when the Customer deliberately connects its own Telegram account and chooses to message End Clients who are themselves Telegram users — that is, individuals who already have a direct relationship with Telegram under Telegram's own terms and privacy policy. Any transfer of message content and the recipient's phone number to Telegram — which may also add the End Client to the Customer's Telegram contact list (see Section 7) — occurs solely at the Customer's direction, from the Customer's own connected Telegram account. The Customer, as controller of End Client data, is responsible for identifying its own Chapter V (GDPR) transfer basis for this channel and for transparency toward its End Clients about it, as set out in the Data Processing Agreement. Customers should take this into account when deciding whether to enable the Telegram channel; we describe the position candidly here so that this decision is an informed one.

9. Data Retention

9.1 Automatic Deletion Schedules Currently in Force

9.2 Data Retained for the Life of the Account

All other categories — account data, business data, CRM data synchronized from Altegio, campaign definitions, derived scores and segment membership, opt-out records, and billing references — are retained for as long as the Customer's account is active, because they form the working record of the Customer's client communications. Message and conversation content, engagement data and audit records follow the shorter periods in Section 9.1.

Two items deserve a note. The IP address of the last sign-in (Section 3.1) is a single current value on your user record: it is overwritten at each sign-in rather than accumulated, so no history of it exists outside the 90-day activity log. Acceptance records (Section 3.3) are kept for the life of the account and then, because their whole purpose is to evidence the contract, for the limitation period applicable to claims under it — in the Czech Republic normally up to 10 years from the end of the contract.

9.3 After Termination

The default clock. After a Customer's account terminates we keep its account data and the End Client data processed on its behalf for 90 days, so that the Customer can still retrieve and export it. When that window expires we erase the workspace within the following 30 days: every record of the workspace is deleted, and the user accounts that belong to no other workspace are scrubbed as described below for "Delete account".

If deletion is requested sooner. On written request to privacy@sended.io we will delete or irreversibly anonymize the same data within 30 days of the request. We will not delete before the 90-day retrieval window has run unless the Customer expressly waives the remainder of it, so that a request made on the day of termination cannot destroy data the Customer is still entitled to export. The corresponding processor-side deletion and return obligations owed to Customers, and their timing, are set out in the Data Processing Agreement.

Self-service "Delete account". The Service includes a Delete account action in your security settings. It ends every session and removes the personal data on your user record: the sign-in email is replaced by an internal value derived only from the account identifier, which cannot receive mail and from which the original address cannot be recovered, and your name, phone number, avatar, social sign-in identifiers and last sign-in IP address are cleared. The security audit entry written for the deletion records the account identifier, the time and the reason you gave, not your email address. Records that belong to the Customer's workspace (for example campaigns you created) stay with the workspace without your name. Acceptance records are kept as described in Section 9.2. Because the old address is not kept, it can be used to register again.

Images are a carve-out. Images uploaded for use in messages and pages are stored as content-addressed objects under a public path and distributed through a content delivery network, where they are cached at edge locations for up to one year. Objects that back messages already sent are not deleted when an account is deleted: the delivered message continues to reference them, and removing them would break the record of what was actually sent and destroy evidence needed to answer a complaint about it. Hiding an image in the Service removes it from future use but does not delete the stored object or invalidate its public URL. This is why our Acceptable Use Policy prohibits uploading photographs of clients or any other image containing End Client personal data — that prohibition is what keeps this retention proportionate. Image objects are not deleted when an account is erased either: they are content-addressed, so the same object may back another workspace's image, and their image records in the workspace are deleted with the rest of the account data.

Backups. Residual copies may persist in backups for a limited period; such copies remain protected under this Policy and are deleted or overwritten as backups are rotated.

Exceptions: we retain data beyond the above where required by law and where strictly necessary for the establishment, exercise, or defence of legal claims. In particular, accounting records must be kept under Czech accounting law (typically 5 years) and VAT records, including the billing country and VAT identification number, for 10 years under the Czech VAT Act. Acceptance records are kept as described in Section 9.2. Opt-out and suppression records are retained for as long as they are needed to keep honouring the underlying objection.

10. Data Security

We apply technical and organizational measures appropriate to the risk, including:

• TLS encryption for all data in transit
• Passwords stored only as salted cryptographic hashes; session and recovery tokens stored server-side only as SHA-256 hashes
• Integration and channel-connection credentials — Altegio CRM, WhatsApp, the Telegram session credential, and Instagram access tokens — encrypted at rest with AES-256-GCM, on top of the encryption of the database itself. Access tokens for integrated platforms are carried in request headers, never in URLs
• Session tokens carried only in authentication cookies flagged HttpOnly and Secure: they are never returned to the page or kept in browser storage, so scripts running in the page cannot read them. Access tokens are valid for 15 minutes and renewed automatically; refresh tokens are revocable and valid for 90 days in the application and 7 days in the administration console
• Per-tenant data isolation enforced on every request, and role-based access control within Customer accounts
• Signature or token verification of incoming webhooks from integrated platforms
• Security audit logging of significant account actions
• Rate limiting and abuse controls, including send-time gates that block non-compliant marketing messages

No system is perfectly secure; we continuously improve these measures. In the event of a personal data breach we will comply with our notification obligations under Articles 33 and 34 GDPR and, for data we process on behalf of Customers, notify the affected Customer without undue delay as set out in the Data Processing Agreement.

11. Your Rights

11.1 What Rights You Have

Under the GDPR you have the right to: access your personal data and obtain a copy; rectification of inaccurate or incomplete data; erasure ("right to be forgotten"); restriction of processing; data portability (a structured, commonly used, machine-readable copy of data you provided, where processing is based on contract or consent); object to processing based on legitimate interest, including an unconditional right to object to direct marketing; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

11.2 How to Exercise Them

• Customers, Authorized Users, and website visitors: contact us at privacy@sended.io. We may need to verify your identity before acting. We will respond within one month of receiving your request; for complex or numerous requests this may be extended by up to two further months, in which case we will inform you within the first month. Exercising your rights is free of charge except in the cases permitted by Art. 12(5) GDPR. The Service offers a self-service Delete account action, which removes the personal data on your user record as Section 9.3 explains. A data export, and erasure of anything beyond your own user record, are fulfilled manually by our team upon your written request; the rights themselves are unaffected by the absence of a button.
• End Clients: please contact your salon first — it is the controller of your data (see Section 2). To stop receiving a salon's marketing, you can also use the unsubscribe link included in every marketing email, which takes effect immediately across all of that salon's marketing channels in the Service. On WhatsApp and Telegram there is no unsubscribe link: reply STOP to the salon's message, which records your opt-out from that salon's marketing, or stop the messages inside WhatsApp using your messaging app's own controls, or simply reply to the salon asking it to stop, or write to privacy@sended.io. However an objection reaches us or the salon and by whatever route it is recorded, it silences that salon's marketing on every channel in the Service. If you contact us at privacy@sended.io instead of your salon, we will forward your request to the relevant salon within 5 business days and assist in its handling.
• Requests about the service-wide email suppression list (Section 4.3) are the exception to the "contact your salon first" rule: we are the controller of that list, so write to privacy@sended.io directly and we will handle the request ourselves rather than forwarding it.

11.3 Complaints

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority for the Czech Republic, where we are established, is:

Úřad pro ochranu osobních údajů (ÚOOÚ) — Office for Personal Data Protection Pplk. Sochora 27, 170 00 Praha 7, Czech Republic uoou.gov.cz

We would, however, appreciate the chance to address your concern first at privacy@sended.io.

12. Automated Decision-Making and AI Features

Profiling does occur. The Service profiles End Clients within the meaning of Article 4(4) GDPR — scoring, segmentation, automated triggers, and conversion attribution, all described in Section 4.4. That processing is carried out on the Customer's instruction and the Customer is its controller. It does not decide anything about an individual in the sense of Article 22: it decides who receives a marketing message, and receiving or not receiving a salon's marketing produces neither legal effects nor a similarly significant effect. No End Client is scored for creditworthiness, refused a service, or priced differently by the Service.

One automated measure toward Customers requires qualification. To protect the shared email-sending infrastructure, we automatically measure each workspace's bounce and complaint rates and, when they cross the thresholds published in our Acceptable Use Policy, automatically pause that workspace's marketing email — and automatically lift the pause when the rates recover. Transactional messages (for example appointment reminders) and the other channels are not affected. For a Customer who is a natural person, that pause is a decision taken by automated means alone with a significant practical effect on their business, so we treat it under Article 22 and rely on Article 22(2)(a): it is necessary for entering into and performing the contract, because we cannot offer an email channel at all if one sender's rates can get the whole platform's sending suspended by our infrastructure provider. You have the right to obtain human intervention, to express your point of view, and to contest the pause: write to privacy@sended.io or contact@sended.io and a member of our team will review it and can lift it manually.

Subject to those two points, we do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

AI features. The Service includes AI-assisted features; all of them are disabled platform-wide at the date of this policy, and none of them processes any data until we enable them. One is a content-authoring aid available irrespective of the per-workspace AI-assistant setting: drafting WhatsApp message templates, which processes the template text the Customer is composing (via OpenAI — see Section 7), not End Client records.

The remaining AI features are active only where enabled for the Customer's workspace:

• AI reply assistance: conversation content from the Customer's inbox is processed by our AI provider (OpenAI) to compose replies to End Client messages and to help manage bookings. In the default, semi-automatic mode, the AI assistant sends conversational replies to End Clients automatically, without per-message staff review; only actions that write to the booking system (creating or cancelling appointments, creating client records) are held for staff approval. In fully-automatic mode, those actions are executed without prior approval as well. The Service inserts an AI-interaction disclosure at the beginning of AI-assisted conversations so End Clients know they are talking to an AI system.
• Voice transcription: voice messages are transcribed via OpenAI Whisper so salon staff can read them.
• Conversation context: recent conversation history is stored (see Section 7 — MongoDB Atlas) to give the AI features context.

Content sent to AI providers is used solely to provide the requested output. Where AI features generate or send messages to End Clients, the Customer remains the controller of, and responsible for, those communications; applicable AI-transparency duties (including informing End Clients that they are interacting with an AI system, where required by the EU AI Act) are addressed in the Terms of Service and Data Processing Agreement.

13. Cookies

We use essential cookies required for sign-in and security, and — only with your consent — Google Analytics 4 cookies for usage measurement on the website and in the signed-in application. Until you accept, the Google tag is not loaded and nothing is transmitted; Google Consent Mode v2 is implemented in addition, with every signal denied by default. Your decision is stored in your own browser and stays in effect there until you clear it or withdraw it. For the full list of cookies and similar technologies (including browser storage used by the application), their purposes and lifetimes, and for how to give, refuse, or withdraw consent, see the Cookie Policy.

14. Children

Sended is a business-to-business service directed at salon businesses and their staff. It is not directed at individuals under 16 years of age, and we do not knowingly collect personal data of children for our own purposes.

End Client records synchronized from a Customer's CRM may include dates of birth, and a salon's client base may include minors (for example, minors attending appointments with parental involvement). For such data, the Customer is the controller and is responsible for the lawfulness of processing its clients' data, including any data of minors, and for obtaining any required parental consents. If you believe personal data of a child is being processed through the Service unlawfully, contact the relevant salon or privacy@sended.io.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the Service, our providers, or the law. For material changes we will notify Customers by email or by a prominent notice in the Service before the change takes effect. The version and effective date at the top of this document indicate the current revision. Earlier versions are available on request.

16. Governing Law and Contact

This Privacy Policy and any disputes arising from it are governed by the laws of the Czech Republic, and the courts of Prague, Czech Republic have jurisdiction, without prejudice to mandatory data protection rights and venue rules under the GDPR that cannot be derogated from.

For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices:

Elephants Production s.r.o. Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic Company ID (IČO): 23397292 Registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391

General inquiries: contact@sended.io Privacy and data subject requests: privacy@sended.io