Privacy Policy: How We Protect Your Data | SendSeven

Learn how SendSeven collects, uses, and protects your data. GDPR compliant with transparent practices. Your data rights and our security measures explained.

SendSeven GmbH ("SendSeven", "we", "us", or "our"), located at Werner-Haas-Strasse 8, 86153 Augsburg, Germany, operates the sendseven.com website and the SendSeven messaging API platform (the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service. SendSeven provides its services exclusively to business customers; data subjects are typically employees, agents, and contacts of such customers. We are committed to protecting your privacy and handling your data in an open and transparent manner.

By using our Service, you agree to the collection and use of information in accordance with this policy and the Terms of Service. This Data Processing Agreement (DPA) forms an integral part of the Terms of Service and applies automatically when a customer uses the Service.

The data controller responsible for your personal data is:

We collect information that you voluntarily provide when using our Service:

Account Information: Name, email address, company name, billing address, and payment information

Contact Information: Email address and other contact details when you contact support

Communication Data: Messages and content you send through our platform

Profile Information: Display name, avatar, and preferences

When you access our Service, we automatically collect:

Log Data: IP address, browser type, operating system, referring URLs, pages viewed

Device Information: Device type, unique device identifiers, mobile network information

Usage Data: API calls, message volumes, feature usage

When you use our messaging API, we process messages on your behalf as a data processor. This includes message content, recipient information, and delivery metadata.

You remain the data controller for message data. We process this data solely to provide the Service.

When you use our mobile app (Android/iOS), we additionally collect:

Device Identifiers: Device type, OS version, unique device token for push notifications (Firebase Cloud Messaging)

Biometric Data: If you enable biometric authentication (Face ID/Fingerprint), we use your device's secure enclave. We do not receive or store your actual biometric data - only a success/failure confirmation from your device.

Offline Data: Conversations and messages are cached locally on your device for offline access using encrypted SQLite storage. This data is deleted when you log out.

Session Information: Device fingerprint (user agent, screen size, timezone) for session management. Users can have one mobile session and one desktop session simultaneously.

Under the General Data Protection Regulation (GDPR), we process your personal data based on:

Art. 6(1)(b) GDPR - Processing necessary to provide our Service and fulfill contractual obligations

Art. 6(1)(f) GDPR - Processing for security, fraud prevention, and service improvement

Art. 6(1)(c) GDPR - Processing required by law, such as tax and accounting requirements

Art. 6(1)(a) GDPR - For optional processing such as marketing communications

Service Delivery: To provide, maintain, and improve our messaging platform

Account Management: To create and manage your account, process payments, and provide support

Communication: To send service notifications, security alerts, and support messages

Analytics: To understand usage patterns and improve our Service

Security: To detect, prevent, and respond to fraud and security incidents

We work with carefully selected third-party service providers to operate our Service. These providers act as data processors and are contractually bound to protect your data.

Our Service is hosted on Google Cloud Platform infrastructure located in the European Union (Frankfurt, Germany).

We use Cloudflare for DNS management, content delivery (CDN), DDoS protection, Web Application Firewall (WAF), SSL/TLS encryption, and Turnstile bot protection. Cloudflare may process your IP address and request metadata to provide these security services.

Secure user authentication and identity management. Processes login credentials and session data.

We use Google Tag Manager as a container to manage and deploy tracking tags (such as Google Ads conversion tracking and Meta Pixel) on our website. GTM itself does not collect personal data. It triggers other tags that may collect data, subject to your consent preferences managed via our cookie banner (Cookiebot with Google Consent Mode v2). Legal basis: Art. 6(1)(a) GDPR (consent).

We use Google Ads conversion tracking (gtag.js) to measure the effectiveness of our advertising campaigns on Google. Only activated after you provide consent via our cookie banner. When you complete a conversion action (e.g., signing up), a conversion event is sent to Google Ads. No browsing behavior or page-by-page analytics are collected. Data is processed by Google LLC under Standard Contractual Clauses and the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (consent). Cookie: _gcl_au (90 days).

We use the Meta Pixel to measure the effectiveness of our advertising campaigns on Meta platforms (Facebook, Instagram). The pixel collects data about page views and website interactions after you provide consent via our cookie banner. This data is transmitted to Meta Platforms Ireland Ltd. and may be processed by Meta Platforms Inc. (USA) under the EU-US Data Privacy Framework. We have entered into a Data Processing Agreement with Meta. Legal basis: Art. 6(1)(a) GDPR (consent).

Cookies set: _fbp (Meta Pixel identifier, 3 months).

Powers optional AI features like answer suggestions and knowledge base search using Gemini models. Processing occurs in the EU (Netherlands region, europe-west4), with EU fallback regions.

You can disable AI features in settings at any time.

Payment processing. We do not store complete credit card numbers. PCI DSS Level 1 compliant.

To deliver messages, we integrate with various platforms:

We use seven.io (operated by seven communications GmbH & Co. KG, Kiel, Germany) as our SMS gateway provider. seven.io processes recipient phone numbers, message content, and delivery metadata to route SMS messages to mobile carriers. Servers are located in the European Union and processing is governed by a Data Processing Agreement under Art. 28 GDPR.

Transactional and marketing email delivery. Processes email content, recipient addresses, and delivery metadata.

Amazon Web Services SES (Email Delivery)

Alternative email delivery infrastructure. Processes email content and delivery metadata. EU region (Frankfurt).

Firebase Cloud Messaging (Push Notifications)

Push notifications for our mobile app. Processes device tokens and notification content.

We use Sentry for application error monitoring and performance tracking. Sentry processes error logs, stack traces, and associated request metadata to help us identify and fix bugs. No message content or personal data is intentionally sent to Sentry.

We integrate Stripo as an email template editor within our campaign feature. Stripo processes email template content during editing sessions.

We offer optional Calendly integration for scheduling meetings. If you use this feature, Calendly processes your name, email, and scheduling preferences.

SendSeven offers optional artificial intelligence features to enhance your customer service experience. These features are:

Opt-in only: AI features are disabled by default and must be explicitly enabled

Full control: You can enable or disable AI features at any time from your account settings

AI-generated response recommendations for customer service agents based on conversation context

Intelligent search across your documentation using semantic understanding

Find related past tickets for faster issue resolution

Automatic summaries of closed conversations for quick review

Our AI features are powered by Google Vertex AI (enterprise tier), using Google's Gemini models. We currently use:

As Google releases newer Gemini models, we may upgrade to provide better AI capabilities. All models process data exclusively in our EU region (europe-west4, Netherlands).