Privacy
Policy.
For BYOC sends, message bodies are never stored in SendFleet's database, and recipients and subjects are stored only while email logs are on (the default, which you can turn off at any time). This policy explains how we process email, what we retain, why, and your choices.
Who We Are
SendFleet ("we", "us", "our") is a transactional email API service operated at sendfleet.net. We provide developers with infrastructure to send transactional email — either through your own AWS SES account (BYOC) or through our managed infrastructure (Managed plans).
This Privacy Policy explains what data we collect when you use SendFleet, how we use it, and the choices you have. By creating an account or using the API, you agree to this policy.
Data We Collect
We collect data in two contexts: directly from you at registration, and automatically when your application uses the API.
Account data
| Field | Why | Required? |
|---|---|---|
| Email address | Authentication, identity, service communications | Yes |
| Display name | Personalisation inside the dashboard | No |
| Password (hashed) | Authentication — never stored in plaintext | Yes |
| Account creation date | Audit trail and support | Auto |
Email usage data (Managed plans only)
| Field | Why |
|---|---|
| Sender name & email | Forming the outbound From header |
| Subject line | Passed through to email; stored in your log |
| Message body | Passed through to email; stored in your log |
| Request timestamp | Log ordering, usage calculation, rate-limit enforcement |
| Delivery status | Displayed in your dashboard; used for retry logic |
| Message ID | Returned in the API response for delivery tracking |
Technical / infrastructure data
API requests may generate standard HTTP metadata (IP address, User-Agent) used for rate-limiting, abuse prevention, and debugging. This is not linked to email content and is not retained beyond 30 days.
Account security data
If you turn on two-step verification, we store the secret your authenticator app uses, encrypted, and a one-way keyed digest of each recovery code — never the codes themselves. We also keep a security activity log for your account: sign-ins and changes to your password or two-step verification, each with the time, the IP address and a short description of the browser (for example "Firefox on macOS", not the full browser string). You can see this log on your account's security page. It is used to show you that activity, to detect and stop attempts to break into your account, and to investigate abuse. Log entries are deleted after 90 days, except while an account is on a security hold.
Payment-method fingerprinting (fraud prevention)
When a payment is submitted through Paddle, we receive a limited set of card metadata — card type, last four digits, expiry month/year, and the cardholder name — and compute a one-way SHA-256 fingerprint over type|last4|expiry_month|expiry_year|cardholder_name. The fingerprint, together with the cardholder name, last four digits, and expiry, is stored in our fraud-prevention database and is compared across all SendFleet accounts, not only the account that submitted the card.
We use this to detect and block re-registration using a payment method that has previously been associated with abuse, fraud, or a chargeback. We do not store full card numbers, CVVs, or magnetic-stripe data — that information never reaches us.
How We Use Your Data
- Authenticate you and authorise API requests against your account.
- Route and deliver transactional emails initiated via the API.
- Maintain your email log — a history visible only to you in the dashboard.
- Calculate monthly usage against your plan limit.
- Send essential service communications — security alerts, policy updates. We do not send marketing email without opt-in.
- Improve the reliability and performance of the service.
- Detect and prevent abuse, fraud, chargeback fraud, and repeat re-registration using a previously-suspended payment method. This includes cross-account comparison of payment-method fingerprints (see §2, Payment-method fingerprinting).
- Place an account under a security hold, and/or suspend API sending, at our sole discretion, when we reasonably believe the account is involved in abuse, fraud, or activity that may violate our Terms or applicable law, or when required by valid legal process. A security hold preserves the account's email logs, domain configuration, API key metadata, and webhook configuration beyond the standard retention window until the hold is released. A sending suspension disables outbound API sending while the account's dashboard, logs, and billing remain accessible. We are not obligated to disclose the reason for a hold or suspension to any third party, and we may decline to confirm or deny whether a specific account is on hold except where compelled by lawful process or where the account holder is the requesting party.
- We load web fonts from Google Fonts (fonts.googleapis.com) for typographic consistency. Google receives the requesting IP address as part of standard CDN operation. We do not control Google's data processing for this service.
API Key Security
API keys are your primary credentials for the send endpoint. We take their security seriously at the implementation level.
- Keys are SHA-512 hashed before storage and are not retrievable after creation.
- Lookup uses an 8-character prefix. The prefix alone cannot send emails — the full hash verification is always performed on every request.
- Once key revocation is confirmed in the dashboard, subsequent API requests using that key are rejected. Messages already accepted for delivery are not cancelled.
- Keys support expiry dates. Expired keys are automatically refused.
- All actions under your API keys are your responsibility, whether or not you authorised them.
Email Processing
SendFleet acts as a data processor for email content submitted through the API. You are the data controller and are responsible for the content and recipient data you submit.
Managed plans
Email content is delivered via AWS SES on our behalf and written to your email log. Bounce and complaint events are reflected in your dashboard. Email logs are retained for 14 days and then purged automatically, except where a retention or security hold is in place (see §6). Attachments are held temporarily for delivery and then deleted; they are not written to our database.
Free BYOC Shared SES smoke test
The Free BYOC plan may send a test message through our managed infrastructure (Shared SES) to the account's own verified email address only. These smoke-test sends are processed exactly as Managed plan sends are: the content, subject and recipient (your own address) are written to your email log, bounce and complaint events are recorded, and the log is retained for 14 days and then purged automatically, subject to the same retention and security hold exceptions (see §6). No webhook is sent for a smoke test. Spam complaints received for a smoke test are used for abuse prevention as described in our Terms (§5.4).
BYOC sends (Free BYOC / BYOC)
SendFleet processes your API request for delivery through your own AWS SES account using short-lived credentials from your IAM role. Message bodies are never stored in our database. We retain a monthly send count for plan-limit enforcement. Attachments are held temporarily for delivery and then deleted.
Delivery tracking. When you connect your AWS account, SendFleet creates a configuration set and a notification topic in it that report delivery, bounce, complaint and rejection events to SendFleet. You choose what is kept: email logs (the default) store one record per recipient — address, status, timestamps, bounce and complaint detail, and the subject unless you turn subjects off — for 14 days; metrics only stores hourly counts; send only turns tracking off and removes it from your account. Events never contain the message body. SendFleet also reads your SES account's settings and reputation figures to show them on your dashboard. It changes them only in these cases: when you connect, it turns on the account-level suppression list for bounces and complaints and SES Auto Validation; it repairs its own configuration set and topic if they are changed or removed (unless you turn automatic repair off); and it makes the changes you ask for (requesting production access, suppression and validation settings). Every change it makes is listed under Activity in Dashboard → AWS.
Data Retention
| Data type | Retention period |
|---|---|
| Account info | Until account deleted, or 12 months after last login (inactive free accounts) |
| Email logs (Managed plans, Free BYOC Shared smoke tests, and BYOC with email logs on) | Rolled off automatically after 14 days by a scheduled cleanup job. Exception: when an account is on a retention or security hold (see §3 and our Terms), its email logs and metadata are preserved beyond the standard 14-day window, for as long as the hold remains in place and any related investigation or legal obligation requires. End-users cannot delete individual logs — this is by design, so that bounce/complaint signals remain available for abuse detection and to respond to lawful requests. |
| API keys (hashed) | Until revoked; revoked records purged after 30 days |
| Usage counters | Monthly aggregates retained 24 months |
| HTTP request logs | 30 days (rate-limiting / abuse only) |
| Account security log (sign-ins and security changes, with IP address and browser) | 90 days, except while the account is on a security hold; authenticator secrets and recovery-code digests until you remove them or delete the account |
| BYOC send content | Message bodies: never stored. With email logs on, recipient, status and subject metadata: 14 days, with the same hold exception as email logs. Hourly delivery counts: 45 days. |
| Email attachments | Staged in S3 for delivery only; deleted immediately after successful dispatch (no persistent storage) |
| Free BYOC usage of a deleted account | A keyed one-way digest of the account's email address — not the address itself — and that calendar month's Free BYOC send count, kept only if the account had sent that month. Deleted automatically at the start of the next calendar month (UTC). Used solely so that deleting an account and registering again with the same email address (letter case, a +tag and, for Gmail, dots do not make it a different one) does not reset the monthly free allowance; the legal basis is legitimate interest in preventing abuse of the free plan (GDPR Art. 6(1)(f)) or the equivalent under your jurisdiction. |
| Blocked payment-method fingerprints | Retained indefinitely, including after account deletion, unless removed by support following a successful appeal or legal review. This is necessary to prevent re-registration with the same payment method, and the legal basis is legitimate interest in fraud prevention (GDPR Art. 6(1)(f)) or the equivalent under your jurisdiction. |
When you delete your account, all associated email logs, API keys, and usage records are scheduled for permanent deletion within 30 days. Exception: if the account is subject to a retention or legal hold, deletion is deferred until that hold is lifted. Payment-method fingerprints are also retained on account deletion, and so, until the end of the calendar month, is the digest-and-count record of the month's Free BYOC usage — see the table above.
Third-Party Services
We rely on a small number of trusted providers to operate SendFleet. These are the categories of data each provider processes:
| Provider / purpose | Data processed |
|---|---|
| Amazon Web Services — email delivery | Sender, recipient, subject, body (Managed plans only) |
| Amazon Web Services — transient attachment handling | Attachment content (deleted immediately after delivery; never written to our database) |
| Amazon Web Services — BYOC credential delegation | IAM Role ARN (no email content) |
| Paddle — payments | Email address, billing address, IP address, and card metadata: card type, last four digits, expiry month/year, and cardholder name. The cardholder name and card metadata are used to compute our fraud-prevention fingerprint (see §2). |
| Managed cloud hosting & database | All persisted data within our secured infrastructure |
| Managed cache service | Rate-limit counters, usage counts, session cache |
| Google Fonts — typography | User IP address on page load |
We do not use advertising networks or third-party behavioural advertising systems.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you.
- Correction — Ask us to correct inaccurate or incomplete data.
- Deletion — Request erasure of your account and associated data (also available self-serve in the dashboard). Payment-method fingerprints are the one lasting exception: they are retained under legitimate interest even after deletion, because erasing them would defeat the fraud-prevention purpose they were collected for. The current month's Free BYOC usage record (a digest of your address and a send count) is also kept, for the same reason, until the month ends. You can appeal a specific fingerprint entry by emailing [email protected].
- Portability — Receive your email log data in a machine-readable format.
- Objection / Restriction — Object to certain processing or request restriction while a dispute is resolved.
- Withdrawal of consent — Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email [email protected]. We aim to respond within 14 days. We may need to verify your identity first. If you feel we haven't addressed your concern, you have the right to lodge a complaint with your local data protection authority.
Cookies & Tracking
| Cookie | Purpose | Duration |
|---|---|---|
sessionid
|
Authenticated dashboard session, including a sign-in waiting for its two-step verification code and whether two-step verification is on | Session / 2 weeks |
csrftoken
|
CSRF protection on form submissions | 1 year (value rotated) |
We may use analytics (e.g. Google Analytics) to understand aggregate product usage, diagnose issues, and improve the service. Analytics data is never used for personalised advertising. You can disable cookies in your browser settings, though doing so will prevent dashboard access.
Children's Privacy
SendFleet is a developer API service and is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has registered an account, contact us immediately at [email protected] and we will delete the account promptly.
Changes to This Policy
We may update this Privacy Policy as SendFleet evolves. For material changes we will:
- Update the "Last reviewed" date at the top of this page.
- Email all registered accounts at least 14 days before changes take effect.
- Where required by law, request your explicit re-acceptance.
Continued use of SendFleet after the effective date constitutes acceptance of the updated policy.
Contact Us
Questions about this Privacy Policy, data access requests, or concerns: