Privacy Policy: How We Protect Your Data

Learn how SendSeven collects, uses, and protects your data. GDPR compliant with transparent practices. Your data rights and our security measures explained.

SendSeven GmbH ("SendSeven", "we", "us", or "our"), located at Werner-Haas-Strasse 8, 86153 Augsburg, Germany, operates the sendseven.com website and the SendSeven messaging API platform (the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service. SendSeven provides its services exclusively to business customers; data subjects are typically employees, agents, and contacts of such customers. We are committed to protecting your privacy and handling your data in an open and transparent manner.

This Privacy Policy describes how we process personal data as a controller, for example data of website visitors and of our customers' users. Where we process personal data on behalf of our customers (for example message and contact data), we act as a processor under our Data Processing Agreement (DPA), which forms an integral part of the Terms of Service.

The data controller responsible for your personal data is:

We collect information that you voluntarily provide when using our Service:

Account Information: Name, email address, company name, billing address, and payment information

Contact Information: Email address and other contact details when you contact support

Communication Data: Messages and content you send through our platform

Profile Information: Display name, avatar, and preferences

When you access our Service, we automatically collect:

Log Data: IP address, browser type, operating system, referring URLs, pages viewed

Device Information: Device type, unique device identifiers, mobile network information

Usage Data: API calls, message volumes, feature usage

When you use our messaging API, we process messages on your behalf as a data processor. This includes message content, recipient information, and delivery metadata.

You remain the data controller for message data. We process this data solely to provide the Service.

When you use our mobile app, we additionally process:

Device identifiers: Device type, operating system version and a push token for push notifications (Firebase Cloud Messaging). The push token is removed when you log out.

Biometric unlock: If you enable biometric unlock (for example fingerprint or face recognition), the check is carried out entirely by your device's operating system. We do not receive or store any biometric data, only the result of the check.

Offline data: Conversations, messages, contacts and media are stored in the app's private storage on your device so that you can use them offline. This storage is protected by your device's operating system. When you log out, this data is deleted from the device, including cached images, voice recordings and notification previews.

Session information: Device information (such as device model, app version and time zone) to manage your sessions. You can be signed in on several devices at the same time and can sign out of all devices at once in your profile settings.

Crash reports and app analytics (optional): Only with your consent, which the app asks for after your first sign-in on a device, we use Firebase Crashlytics and Google Analytics for Firebase to receive crash reports and app usage statistics. You can change your choice at any time in the app under Settings > Privacy. Legal basis: Art. 6(1)(a) GDPR (consent).

Under the General Data Protection Regulation (GDPR), we process your personal data based on:

Art. 6(1)(b) GDPR - Processing necessary to provide our Service and fulfill contractual obligations

Art. 6(1)(f) GDPR - Processing for security, fraud prevention, service improvement and measuring the success of our advertising (see section 6)

Art. 6(1)(c) GDPR - Processing required by law, such as tax and accounting requirements

Art. 6(1)(a) GDPR - For optional processing such as marketing communications

Service Delivery: To provide, maintain, and improve our messaging platform

Account Management: To create and manage your account, process payments, and provide support

Communication: To send service notifications, security alerts, and support messages

Analytics: To understand usage patterns and improve our Service

Security: To detect, prevent, and respond to fraud and security incidents

We work with carefully selected service providers to operate our Service. Where they process personal data on our behalf, they act as processors and are contractually bound under Art. 28 GDPR. Some providers, such as advertising platforms, act as independent controllers; we point this out for the respective service.

Our Service is hosted on Google Cloud Platform in the European Union. Our primary region is Frankfurt, Germany. Backups and AI processing use further Google Cloud regions within the EU.

We operate our staging and test environment on servers of Hetzner Online GmbH (Gunzenhausen, Germany) in Germany. The test environment can access the same data as our live Service.

We use Cloudflare for DNS management, content delivery (CDN), DDoS protection, Web Application Firewall (WAF), SSL/TLS encryption, and Turnstile bot protection. Cloudflare may process your IP address and request metadata to provide these security services.

Secure user authentication and identity management. Processes login credentials and session data.

We use Google Tag Manager as a container to manage the tracking tags on our website (such as Google Ads conversion tracking, Meta Pixel, Microsoft Advertising and the Reddit Pixel). The Google tag is delivered from our own domain via Cloudflare. GTM itself does not collect personal data. It triggers other tags that may collect data, subject to your consent preferences managed via our cookie banner (Cookiebot with Google Consent Mode v2). Legal basis: Art. 6(1)(a) GDPR (consent).

We use Google Ads conversion tracking (gtag.js) to measure the effectiveness of our advertising campaigns on Google. Only activated after you provide consent via our cookie banner. When you complete a conversion action (e.g., signing up), a conversion event is sent to Google Ads. No browsing behavior or page-by-page analytics are collected. Data is processed by Google LLC under Standard Contractual Clauses and the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (consent). Cookie: _gcl_au (90 days).

We use the Meta Pixel to measure the effectiveness of our advertising campaigns on Meta platforms (Facebook, Instagram). The pixel collects data about page views and website interactions after you provide consent via our cookie banner. This data is transmitted to Meta Platforms Ireland Ltd. and may be processed by Meta Platforms Inc. (USA) under the EU-US Data Privacy Framework. We have entered into a Data Processing Agreement with Meta. Legal basis: Art. 6(1)(a) GDPR (consent).

Cookies set: _fbp (Meta Pixel identifier, 3 months).

When you sign up for a trial or become a paying customer, our servers report this event directly to Meta Platforms Ireland Ltd. (Conversions API) so that we can measure the success of our ads on Facebook and Instagram. We transmit the type of event and, in hashed form (SHA-256), your email address, phone number, name, country and an internal ID, together with your IP address, browser user agent and, if available, Meta click identifiers (_fbp, _fbc). Meta can match this data with Meta accounts. Data may be processed by Meta Platforms Inc. (USA) under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring the success of our advertising).

You can object to this processing at any time with effect for the future (Art. 21 GDPR) by contacting [email protected].

We use the OpenAI Ads Pixel to measure whether visits to our website result from our ads in ChatGPT. The pixel only loads after you have given consent via our cookie banner. It transmits a click identifier from the ad link and information about the page visited to OpenAI Ireland Limited. We do not transmit contact data such as email addresses. SendSeven and OpenAI each act as independent controllers. Transfers to third countries such as the USA are based on appropriate safeguards under Art. 44 et seq. GDPR. Legal basis: Art. 6(1)(a) GDPR (consent).

Cookies set: __oppref (click identifier, 30 days), __obref (browser identifier, 1 year).

Microsoft Advertising (UET) and Microsoft Clarity

After you consent via our cookie banner, we use the Microsoft Advertising Universal Event Tracking (UET) tag to measure conversions from our ads on Bing and other Microsoft services, and Microsoft Clarity to understand how visitors use our website through heatmaps and session recordings. Clarity records interactions such as clicks, scrolling and mouse movements. Provider: Microsoft Ireland Operations Limited; data may be processed by Microsoft Corporation (USA) under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (consent).

Cookies set: _uetsid (1 day), _uetvid (13 months), _clck (1 year), _clsk (1 day).

After you consent via our cookie banner, we use the Reddit Pixel to measure the effectiveness of our ads on Reddit. The pixel transmits page views and conversion events together with a browser identifier to Reddit, Inc. (USA). SendSeven and Reddit each act as independent controllers. Transfers to the USA are based on appropriate safeguards under Art. 44 et seq. GDPR. Legal basis: Art. 6(1)(a) GDPR (consent).

We use Cookiebot by Usercentrics A/S (Copenhagen, Denmark) to ask for and store your cookie consent. Cookiebot processes your IP address in shortened form, the date and time of your consent, browser information and your choices. The data is stored in the EU. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent).

Powers our AI features, such as answer suggestions, AI agents, the AI Assistant and knowledge base search, using Gemini models. Processing takes place exclusively in the EU: Gemini models run in Google's EU multi-region, knowledge base search runs in the Netherlands (europe-west4).

Account administrators can switch AI features off at any time in the account settings.

If a customer enables web search for an AI agent, the agent's search query is sent to Linkup SAS (France) to retrieve current web results. Linkup receives only the search query, without contact details. Processing takes place in the EU.

Payment processing. We do not store complete credit card numbers. PCI DSS Level 1 compliant.

To deliver messages, we integrate with the following platforms. RCS messages are delivered via Google's RCS Business Messaging.

We use seven.io (operated by seven communications GmbH & Co. KG, Kiel, Germany) as our SMS gateway provider. seven.io processes recipient phone numbers, message content, and delivery metadata to route SMS messages to mobile carriers. Servers are located in the European Union and processing is governed by a Data Processing Agreement under Art. 28 GDPR.

Delivery of system emails (such as login and account notifications) and of the emails our customers send through SendSeven. Processes email content, recipient addresses and delivery metadata. Customer emails are sent through accounts in Twilio SendGrid's EU region; system emails may be processed in the USA under the EU-US Data Privacy Framework and Standard Contractual Clauses.

Receives incoming emails sent to our customers' email inboxes in SendSeven and forwards them to our Service. Processes email content and sender and recipient addresses. EU region (Ireland).

Firebase Cloud Messaging delivers push notifications for our mobile app and processes device tokens and notification content. Firebase Crashlytics and Google Analytics for Firebase are only used if you consent in the app (see section 3.4); they then process crash reports, device information and app usage data. Provider: Google Ireland Limited; data may be processed in the USA under the EU-US Data Privacy Framework.

If you or your customers allow browser push notifications, these notifications are delivered through the push service of the browser vendor (for example Google, Mozilla, Apple or Microsoft). The content of the notifications is end-to-end encrypted; the push service only processes the encrypted message and technical delivery data.

We use Sentry for application error monitoring and performance tracking. Sentry processes error logs, stack traces and related technical request data, which can include IP addresses, to help us find and fix bugs. The data is stored in Sentry's EU region (Germany). We do not intentionally send message content to Sentry.