Privacy Policy
How SendRepute handles personal information.
Privacy Policy
SendRepute processes submitted sender, subject, and body data, along with edits, results, account details, payment information, and transaction records.
Information collected
We collect data provided during account creation and payment processing, including invoice and transaction records. When you use our analysis tools, we process the sender, subject, body, and resulting edits or analysis metadata. We also process browser, device, and network information needed to operate, secure, and troubleshoot the service. Cloudflare Turnstile may process browser and network information to prevent abuse under Cloudflare's policies.
Ordinary email classification uses SendRepute classifiers. When you request AI-assisted rewriting, email creation, or other explicit AI-powered features, relevant content and instructions are sent to Google's Gemini service via Cloudflare's AI infrastructure. Cloudflare processes hosting, database, and storage traffic independently of whether optional generative AI is requested. SendRepute does not use submitted customer messages to train its classification models. Processing a message is not training a model. External provider policies govern their own operational and security processing; please refer to the Cloudflare Data Usage and Google Privacy Policy for details.
Google Ads scripts are used for measuring successful registration and fully paid confirmed purchase conversions. These scripts and the Google Ads base tag only load and execute if you provide explicit opt-in consent. Conversion payloads never intentionally contain submitted HTML, subject, sender, passwords, wallet addresses, or raw invoice identifiers. For registration conversions, if a user's chosen username is a valid email address and they have explicitly opted into advertising cookies, a SHA-256 hash of that email address may be included to facilitate matching with advertising interactions on Google's platform. This is for matching purposes and is considered personal data, not anonymous data or encryption. Opaque transaction identifiers are used to prevent duplicate reporting. We do not use Google Analytics, Meta, TikTok, X, or OpenAI advertising pixels.
Cookies and browser storage
We use strictly necessary cookies for authentication, session continuity, multi-factor authentication, and security. A functional sidebar cookie remembers whether account navigation is open or collapsed. The application may also use local or session storage for functional preferences, locale selection, drafts, and temporary workflow state.
Upon explicit consent, we use browser storage to save your preferences and deduplicate advertising conversion events. Visitors can accept optional advertising cookies, reject them, or customize essential versus advertising settings. You may reopen Cookie settings at any time to withdraw your consent. If consent is granted, Google may receive browser, network, and advertising click identifiers; see https://policies.google.com/privacy for their practices. Clearing cookies or browser storage may sign you out, reset preferences, or remove locally saved drafts. Cloudflare may provide operational security or hosting measurements under its own policies; these are not advertising trackers.
SendRepute does not sell personal information or send submitted emails.
Retention and security
Submitted message content and its classification or rewrite results are retained for 24 hours for analysis, editing, and replay under same-request rules. A cleanup process runs hourly, meaning physical removal typically occurs within one hour after the 24-hour expiry. In-progress operations are protected during this cycle. This transient retention is for technical continuity and does not constitute a promise of free changed-content analysis or free AI edits. Documents deliberately saved in the email builder are stored separately from these transient analysis records.
Production infrastructure utilizes Cloudflare Workers, D1 for application records, and R2 for stored objects and backups. This infrastructure is distributed, and processing may occur internationally; no fixed-country residency is established for data processing. Application backups redact transient classification and rewrite payloads while retaining financial and replay metadata. These backups follow a rotation policy keeping up to 14 daily copies. Historical backup copies are removed through rotation rather than instantly upon active-database deletion. Necessary payment, accounting, and ledger records are retained separately for compliance and business requirements.
Reasonable safeguards are used, but absolute security cannot be guaranteed.
Rights and Account Controls
Users can access a personal-data JSON download within account settings after verifying their password and any enabled multi-factor authentication codes. These exports exclude security-sensitive data such as passwords, secret keys, session tokens, and authenticator secrets.
Users may request permanent account closure and removal of personal access and content through the provided account controls. This requires fresh authentication, a written confirmation, and explicit acknowledgment that any remaining credit balance will be forfeited. Pending operations or recent balance changes may temporarily block closure. Following closure, necessary financial records and a non-login account reference remain, and data within backups will persist until cleared by the standard rotation policy. Administrator accounts cannot self-delete through these automated controls.
Depending on applicable law, users may request access, correction, deletion, restriction, objection, or portability by emailing privacy@sendrepute.com. Browser controls can remove cookies and locally stored preferences. Identity verification is required for all manual requests.