Privacy Policy

This policy explains how DenSend ("DenSend", "we", "us"), based in Kigali, Rwanda, handles personal data collected through our marketing site, dashboard, API, and SMTP relay (together, the "Service"). It covers visitors to our site, people who create a DenSend account, and — in a more limited way described below — the recipients of email sent by our customers through the Service.

For account, billing, and site-usage data, DenSend is the data controller: we decide why and how that data is processed, as described in this policy.

For the content of emails you send through the Service — recipient addresses, subject lines, message bodies, and attachments — DenSend acts as a data processor on behalf of the customer sending that mail. That customer is the controller for their recipients' data and is responsible for having a lawful basis to contact them. If you're a recipient of an email sent through DenSend and have a privacy question about that email, please contact the organization that sent it; we don't decide what they send or to whom.

Account data. Name, email address, and either a password or the identity Google/GitHub gives us when you sign in that way; workspace name and the teammates you invite.

Payment data. If you're on mobile money, we collect the phone number you provide and pass it to our payment processor to request the charge — we never see or store your mobile money PIN, and we don't store full card numbers for any payment method.

Content you send. The emails you send through the API, dashboard, or SMTP relay — including recipient addresses, subject, body, and attachments — plus delivery events (delivered, bounced, complained, opened, clicked) tied to those sends. See Controller & processor above for how we handle this.

Technical data. IP address, browser and device information, and request logs, used for authentication, rate limiting, abuse prevention, and debugging.

We keep this deliberately small. Signing in sets one strictly-necessary, httpOnly cookie that holds your refresh session — it isn't readable by page scripts and exists purely to keep you signed in. Your short-lived access token is kept in your browser's local storage for the same reason. Neither is used to track you across other sites.

At the time of writing, we don't run third-party analytics, advertising, or tracking cookies on DenSend. The banner you may see on your first visit reflects that: there's nothing optional to opt out of yet, so accepting it just confirms you've seen this notice. If that changes — for example, if we add product analytics — we'll update this section and ask for your consent before anything non-essential runs.

• Provide, operate, and maintain the Service, including sending and tracking your email.
• Authenticate you and keep your account and API keys secure.
• Process payments and manage your plan or quota.
• Monitor for abuse, fraud, and deliverability problems that could affect other customers.
• Respond to support requests and send service notices (billing, security, policy changes).
• Comply with legal obligations and enforce our Terms of Service.

We don't sell personal data, and we don't use the content of your emails for advertising.

We share data only where it's needed to run the Service:

• Our email-sending infrastructure, to deliver the messages you send and report delivery events back to you.
• Our mobile money payment processor, to collect payment when you choose that method.
• Google or GitHub, only when you choose to sign in with them, to confirm your identity.
• Infrastructure and hosting providers who run the servers and database behind the Service, under confidentiality obligations.
• Law enforcement or regulators, when we're legally required to disclose data.

Some of the providers above, including our email-sending infrastructure, process data in the United States or other countries outside Rwanda. Where that happens, we rely on the provider's own safeguards and contractual commitments to protect the data in transit and at rest.

We keep account data for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and dispute-resolution obligations. Email content and delivery logs are retained according to your plan and are used to power suppression lists (so we don't re-send to a bounced or complained address). You can request deletion of your account data at any time, subject to those obligations — see Your rights.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email us at [email protected] — we'll respond within a reasonable time and may need to verify your identity first.

We use encryption in transit, access controls, and credential hashing to protect the data we hold. No system is completely secure, and we can't guarantee the absolute security of data transmitted to or stored by the Service — but we work to keep it protected and to respond quickly if that ever changes.

The Service isn't directed at, and we don't knowingly collect personal data from, anyone under 18. If you believe a child has given us personal data, contact us and we'll remove it.

We may update this policy as the Service changes. We'll update the date at the top of this page and, for material changes — like introducing new tracking cookies — make a reasonable effort to notify account owners before the change takes effect.

Questions about this policy or your data? Reach us at [email protected].