1. Data Controller and Processor Roles
When you send emails through SendOFF, you act as the Data Fiduciary/Controller of your recipient data, and SendOFF acts as the Data Processor. We only process email payloads according to your API instructions and dispatch requirements.
2. Information We Collect
- Account Credentials: Name, work email, hashed passwords, TOTP multi-factor records, and team identifiers.
- Transactional Payloads: Recipient email addresses, message headers, subjects, and email HTML/text bodies for queuing and MTA injection.
- Telemetry & Delivery Metrics: SMTP delivery status codes, DSN bounce reasons, open/click events (if tracking enabled), and connection latencies.
- Billing Information: GSTIN, billing address, legal entity details, and Razorpay subscription tokens. We never store credit card numbers directly.
3. Retention & Ephemeral Storage
Email message bodies are stored temporarily in high-throughput PostgreSQL tables to allow webhook callbacks and outbox reconciliation. Email payload data is automatically cleaned and archived after the statutory retention window.
4. Cryptographic Security Standards
All DKIM private keys and webhook signing secrets are encrypted at rest using AES-256-GCM with automated key versioning. All data in transit uses TLS 1.3 encryption.
5. Data Subject Rights & Indian DPDP Act
We comply with the Digital Personal Data Protection (DPDP) Act of India and global data privacy standards. You retain the right to export, rectify, and permanently erase any stored account data.
6. Contact Our Privacy Team
For data protection questions, GDPR/DPDP inquiries, or deletion requests, contact our privacy officers directly at:
Subject: Privacy & Data Protection Request