Privacy Policy

At Nutrigen Sp. z o.o. ("SendForge," "we," "us," or "our"), your privacy is fundamental to how we build and operate our platform. This Privacy Policy describes how we collect, use, share, and protect information when you use the SendForge platform, website, APIs, and related services (collectively, the "Service"). This policy applies to all users of the Service, including account holders, team members, and visitors to our website.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly when you create an account, configure your projects, or interact with the Service:

• Account Information: Name, email address, password, company name, and billing information when you register for an account or upgrade to a paid plan
• Project Data: Contact lists, email templates, campaign content, automation workflows, segmentation rules, custom fields, and tags that you create or upload
• Sending Infrastructure Credentials: API keys, SMTP credentials, and configuration details for your connected email providers (Amazon SES, Mailgun, SendGrid, or custom SMTP servers)
• Communication Data: Messages you send to our support team, feedback you submit, and any other communications with us
• Payment Information: Credit card numbers, billing addresses, and other payment details processed through our third-party payment processor (Stripe). We do not store full credit card numbers on our servers.

1.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain technical and usage information:

• Usage Data: Pages visited, features used, actions taken, campaign performance metrics, API calls made, and time spent on the platform
• Device Information: Browser type and version, operating system, device type, screen resolution, and language preferences
• Network Information: IP address, approximate geographic location (city/country level), referring URL, and internet service provider
• Log Data: Server logs including access times, error logs, API request/response metadata (excluding payload contents), and system event logs

1.3 Information from Third Parties

We may receive information from third-party services that you connect to your SendForge account, such as webhook event data from your sending infrastructure providers (delivery confirmations, bounce notifications, complaint reports). We also receive information from analytics providers and advertising partners.

2. How We Use Your Data

We use the information we collect for the following purposes:

• Provide the Service: To operate, maintain, and deliver the features and functionality of the SendForge platform, including sending email campaigns, executing automations, and generating analytics reports
• Account Management: To create and manage your account, authenticate your identity, process payments, and provide customer support
• Improve the Service: To understand how users interact with the platform, identify trends, diagnose technical issues, and develop new features and enhancements
• Security: To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity, and to protect the security and integrity of the Service
• Communication: To send you transactional messages (account confirmations, billing receipts, security alerts), product updates, and, with your consent, marketing communications about SendForge
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests
• Aggregate Analytics: To generate anonymized, aggregated statistics about platform usage, deliverability benchmarks, and industry trends. This data cannot be used to identify any individual user.

3. Data Sharing & Disclosure

We do not sell your personal information. We share your information only in the following limited circumstances:

• Service Providers: We share information with trusted third-party service providers who perform services on our behalf, including cloud hosting (AWS), payment processing (Stripe), analytics (Plausible), customer support tools, and email delivery for our own transactional communications. These providers are contractually obligated to protect your information and may only use it to provide services to us.
• Your Sending Infrastructure: When you send campaigns or automated emails through SendForge, your email content and recipient data are transmitted to your connected sending providers (Amazon SES, Mailgun, SendGrid, or your SMTP server). This transmission is initiated by you and governed by your agreement with those providers.
• Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website of any change in ownership or use of your personal information.
• With Your Consent: We may share your information with third parties when you give us explicit consent to do so.

4. Cookies & Tracking

We use cookies and similar tracking technologies to operate and improve the Service:

• Essential Cookies: Required for the Service to function properly, including session management, authentication, and security. These cookies cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website and platform. We use Plausible Analytics, a privacy-focused analytics provider that does not use cookies for tracking and does not collect personal data.
• Preference Cookies: Remember your settings and preferences (such as language, timezone, and display options) to provide a more personalized experience.

We do not use third-party advertising cookies or sell data to advertisers. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

Email Tracking: When you send campaigns through SendForge, the platform may include open-tracking pixels and click-tracking links in your emails, subject to your configuration settings. You control whether these tracking features are enabled for your campaigns. This tracking data (opens, clicks) is stored as part of your campaign analytics.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods are as follows:

• Account Data: Retained for the duration of your account, plus 30 days after account termination to allow for data export
• Campaign Analytics: Retained for the duration of your account. Historical analytics data may be archived and compressed after 24 months but remains accessible
• Server Logs: Automatically deleted after 90 days
• Payment Records: Retained for 7 years as required by tax and accounting regulations
• Support Communications: Retained for 3 years after the last interaction for quality assurance and training purposes

After account termination, we will delete or anonymize your data in accordance with the timelines described above, unless we are required to retain it for legal or regulatory purposes.

6. Data Security

We implement industry-standard technical and organizational measures to protect your data:

• All data is encrypted in transit using TLS 1.3
• Sensitive data (sending infrastructure credentials, API keys) is encrypted at rest using AES-256 encryption
• Access to production systems is restricted to authorized personnel and protected by multi-factor authentication
• We conduct regular security assessments and penetration testing
• Infrastructure is hosted on AWS with SOC 2 Type II compliance
• We maintain an incident response plan and will notify affected users within 72 hours of discovering a data breach

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights regarding your personal data:

For EEA/UK Residents (GDPR)

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request that we correct any inaccurate or incomplete personal data
• Right to Erasure: You may request that we delete your personal data, subject to certain legal exceptions
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format
• Right to Object: You may object to the processing of your personal data for direct marketing purposes or when processing is based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing

For California Residents (CCPA)

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request that we delete personal information we have collected from you
• Right to Opt-Out: You have the right to opt out of the sale of your personal information. Note: SendForge does not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request.

8. International Data Transfers

SendForge is operated by Nutrigen Sp. z o.o., based in Poland (European Union). Your data is primarily processed within the EEA. Where data transfers outside the EEA are necessary (e.g., to cloud infrastructure providers), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or other appropriate safeguards as required by applicable data protection laws.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information as quickly as possible. If you believe that a child under 16 has provided us with personal information, please contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website and, for significant changes, by sending you an email notification at least 30 days before the changes take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Data Protection Officer: [email protected]
• Operator: Nutrigen Sp. z o.o., ul. Tadeusza Kosciuszki 25/5, 50-011 Wroclaw, Poland
• KRS: 0000851334 · NIP: 8971881125 · REGON: 386589960

If you are located in the EEA and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority. In Poland, the supervisory authority is UODO (Urząd Ochrony Danych Osobowych).