Privacy Policy

1. Introduction

zSender operates an email service provider ("ESP") platform. This policy explains what personal data we handle in connection with our website, dashboard, API and SMTP relay, why, and what rights you have.

For data about you as our customer, we are the controller. For the recipient data you send through us, you are the controller and we are your processor: see section 2 and the Data Processing Agreement.

2. Two roles, two sets of rules

This means we do not decide why your recipients are contacted, and we do not use your recipient data for our own purposes. If one of your recipients asks us to access or erase their data, we will route the request to you as the controller. See section 8.

3. What we collect about you

3.1 Account information

Your email address, name if provided, and authentication credentials. Passwords are stored hashed and API keys are stored hashed: we cannot read either.

3.2 Security and anti-abuse data

We record the IP address used at registration, at each sign-in, and when a message is sent (the address your own API call or SMTP connection came from, never a recipient's), email verification status and timestamps, and rate-limit counters. We do this to detect and stop platform abuse: a legitimate interest, and one we exercise because open registration has previously been used at scale to send phishing through our shared infrastructure. We also use Cloudflare Turnstile at registration to distinguish humans from automated signups.

When you add a domain, we read that domain's public DNS records and query the public registration-data service (RDAP) of the domain's registry with the domain name, to read when it was registered, its registry status and its registrar. We use the result only to review new domains for abuse, a legitimate interest, and keep it for as long as the domain is on your account. We do not store the registry's full answer.

3.3 Usage data

Dashboard activity, API request metadata, browser and user-agent information, and, only with your consent, product analytics (section 9).

3.4 Payment information

Payments are processed by Polar, which acts as merchant of record. We never see or store full card numbers. We retain your subscription status, plan, and the identifiers needed to reconcile your account.

3.5 Outbound message scanning

Separately from the message content we process on your behalf as your processor (section 2), messages you send through our live API or SMTP relay are automatically scanned for structural indicators of phishing and credential-harvesting content (such as mismatched sender and link domains, brand references with no matching link, brand names written in disguised spellings, and deceptive link text) as soon as the message has been handed to our mail server, using its content exactly as you submitted it. The scan never holds or delays a message; what it can change is how later messages and your account are treated. One of these indicators is not about the message at all: we also look at how many different sender addresses your own account used in the preceding 24 hours, because rapidly rotating the From address is a filter-evasion pattern. That comparison uses only your own sending records, which we already keep. Messages sent with a test-mode key are never scanned, because they are never delivered to a real recipient.

A message that does not trigger any of these indicators has none of its content retained by this process. What we keep for every scanned message is a short structural record of the scan itself (which indicators fired, and the domains they matched; for the sender-address indicator above, only a count), which contains no message text, no recipient address and no link beyond the domain, and which is itself cleared 30 days after that campaign was last sent. A message that does trigger an indicator is retained together with its content, on the same schedule, so that a member of our staff can review it; a campaign you keep sending therefore keeps its content for as long as it is still being sent, plus 30 days. That review may result in your account being suspended automatically, under the Acceptable Use Policy. This scan, and any content it retains, stay on the same EU infrastructure described in section 5 and are never sent to any third party.

3.6 Free checker tools

When you use a checker under /tools, our server in Germany looks up the domain you enter in public DNS. The lookup goes through public resolvers (Cloudflare's 1.1.1.1 and Google's 8.8.8.8), which see the domain but not your IP address. The checker keeps the domain and its result for one minute to answer repeat checks, and your IP address for one minute to limit how often the checkers can be used. It does not write either to its logs.

4. Why we use it, and on what basis

5. Where your data is processed

The email data path (our API, the mail server that sends your messages, and the database storing your messages and delivery events) runs entirely on servers located in Germany (European Union), operated by Hetzner Online GmbH. Your recipients' personal data does not leave the EU in the course of ordinary sending, and we do not replicate it outside the EU.

That claim is scoped deliberately, and we will not overstate it: some supporting functions do use providers established outside the EU. Specifically, billing (Polar), consent-gated website analytics (Google), network security and CAPTCHA (Cloudflare), internal operational alerts (Slack) and the IP lookup at signup (Team Cymru) are US-headquartered. Our business mailboxes (the addresses you write to for support, privacy requests and abuse reports) are hosted by Zoho in the EU, and Zoho's support staff in India may access them in limited cases. These handle your account and website data and your correspondence with us, not the content of the mail you send. Where such a transfer involves personal data, it relies on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework as operated by that provider.

6. Sub-processors and sharing

We share data only as needed to run the service:

The mail server itself (Postal) is self-hosted on our own EU infrastructure: it is our software on our servers, not a third-party service that receives your data.

We may also disclose data where required by law, to enforce our Terms and AUP (including reporting abuse to authorities, blocklist operators, or affected parties), or to protect the rights and safety of our users and the public. We do not sell personal data and we do not share it for third-party advertising.

We will give notice before adding or replacing a sub-processor that handles customer personal data, as described in the DPA.

7. Retention

When you delete your account we delete or anonymise your data within a reasonable period, except where we must retain it for legal, tax, or abuse-prevention purposes. Backups are overwritten on a rolling cycle.

8. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. Exercise them by writing to privacy@zsender.io. We respond within one month.

If you are the recipient of mail sent through zSender, we are only the processor: the sender decides why you were contacted and holds your data as controller. We will pass your request to the relevant customer and, where we lawfully can, tell you who they are. You can stop mail from a specific sender using the unsubscribe link in their message, which we honour automatically and permanently.

You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Cookies and analytics

We use strictly necessary cookies and local storage for authentication and session management: these cannot be turned off without breaking sign-in. We also use Google Analytics 4 with Consent Mode v2: analytics cookies are set only after you accept, and until then measurement is denied by default. We never send your account identity to Google. Change your choice at any time:

Cookie preferences

Cloudflare Turnstile runs on the registration page to block automated signups. It is designed to work without tracking cookies and without profiling users across sites.

10. Security

We encrypt data in transit with TLS, store passwords and API keys hashed, encrypt webhook signing secrets and provider credentials at rest, restrict administrative access, run on a firewalled and hardened environment with key-only SSH, sign inbound webhooks cryptographically, and require email verification before an account can send.

No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant supervisory authority as required by law.

11. Children

The service is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this policy. Material changes will be announced and the "Last updated" date revised.

13. Contact

Privacy questions and requests: privacy@zsender.io.