Privacy Policy

1. Who we are

Sendlista is run by Brazaustra Pty Ltd (ABN 45 647 949 488), trading as Sendlista, of Back Street, Southport QLD 4216, Australia. We handle personal information under the Australian Privacy Act 1988 and, where it applies to you, the GDPR. Contact: contact@brazaustra.com.

2. If you are a Sendlista customer

We collect:

• Your account details: name, company and email address, and your mobile number if you gave us one. Your password is stored scrambled, so nobody can read it.
• When you agreed to our terms, and which version.
• Your answers about your sending: what you send, where your addresses come from, roughly how many, and your website.
• Your domains and settings, including your API keys, which are stored scrambled, and your webhooks and templates.
• Billing records: your plan and the customer and subscription references from Stripe. Stripe handles your card, and we never see the full number.
• A log of actions on your account, and anything you send us when you contact us.
• Scrambled records for stopping abuse: when someone asks for a sign-up PIN or uses our contact form, we keep a scrambled version of their internet address and, for a PIN, their email address. We use these only to limit misuse.

We use this to run your account, send your email, bill you, keep our sending reputation healthy, stop abuse and talk to you about your account. We don't sell it, and we don't use it to advertise other companies' products.

AI assistants you connect. You can choose to connect an AI assistant, such as Claude or ChatGPT, to your account. Nothing is shared with one unless you connect it and approve it yourself. You choose whether it can only send emails, or can also read your sending figures, your emails and their delivery results, your domains, templates and blocked addresses. It can never see your password, billing, team or API keys. What it reads goes to the company that runs that assistant, and their own privacy policy covers what they do with it. We record which assistant was connected, by whom, when it was last used, and a scrambled copy of its access pass. You can disconnect it at any time under AI assistants in your account, and it stops working straight away.

3. If you received an email sent through Sendlista

Our customers decide who they email and what they say. For those emails the customer is responsible for your information, and we handle it for them. If you have a question about why you got an email, please ask the business that sent it. To stop marketing email, use the unsubscribe link in it. If you can't resolve something with the sender, contact us.

For each email we keep:

• A delivery record: your email address, the sender, the subject, the time, and what happened, such as delivered or bounced, including the reply from your mail server.
• A copy of the email for 14 days: the wording, subject and headers, so our customer can read and resend it. This includes emails such as password resets sent by a customer's own app. After 14 days the copy is blanked. Attached files are not kept, only their names. Emails Sendlista itself sends, such as our own password resets, aren't copied.
• A blocked-address record, if you bounce, complain or unsubscribe, so we can keep you from being emailed again.

4. Open and click tracking

Tracking is off unless our customer switches it on, for a domain or for one email. When it's on, each email carries a small invisible image and its links pass through our server. We then record that the email was opened or a link was clicked, how many times, when, and which link.

From the internet address of that request we work out the country, using a database held on our own server, and store only a 2-letter country code. We don't store the internet address itself. We skip this for the image services that Gmail and Yahoo use. The result is a rough guide, because some services open emails automatically.

5. Who else handles information

We use these providers to run Sendlista, so information can be stored or handled outside Australia:

• OVH, in Poland: hosts our main servers, including the database and the system that sends email.
• Vercel: hosts our website and portal pages. It runs in many countries.
• Amazon Web Services, in Sydney: holds our encrypted daily backups.
• Google: Google Firebase helps protect staff sign-in, and Google Fonts supplies our website's lettering and so sees your internet address when you load a page. Both run on servers outside Australia.
• Google Ads, only if you say yes when asked: a cookie that tells us a visitor came from one of our ads and went on to sign up or pay.
• Stripe: takes payments.
• Mail servers of the people you email, which receive what you send, wherever they are.
• The maker of an AI assistant you connect, such as Anthropic (Claude) or OpenAI (ChatGPT), only if you connect one, and only what you allowed it to read.

We may also share information if the law requires it, or to protect people from harm or fraud.

6. How long we keep it

Email copies are blanked after 14 days, as explained above. Everything else, including accounts, delivery records and blocked addresses, is kept and marked when it stops being used rather than erased. We do this so that unsubscribes keep working and so that we can look into abuse and show what happened. You can ask us to delete information, as explained below. We may need to keep some, such as a blocked address, where the law allows and it protects the person.

Encrypted backups are copies of everything at the time they were made, so they can still hold information, including email copies, after it has been blanked or changed on our live system. We only open a backup to check it works or to recover from a disaster.

7. Cookies

We use a cookie to keep you signed in, and small settings such as light or dark mode. We don't use analytics cookies. If we advertise on Google, we ask you first before using a Google Ads cookie to see whether our ads work, and if you say no it isn't used. We also keep your answer in a small cookie so we don't ask again.

8. Security

We use encrypted connections and limit who can reach our systems. No system is perfectly safe. If a data breach is likely to cause you serious harm, we'll tell you as the law requires.

9. Your rights

You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. If the GDPR applies to you, you can also object to or restrict how we use it, and ask for it in a form you can take elsewhere. Email contact@brazaustra.com, and we'll answer within a reasonable time.

If you think we've handled your information badly, please tell us first so we can fix it. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU or UK, your local data protection regulator.

10. Changes

We may update this policy. The date at the top shows the latest version, and we'll tell customers by email about changes that matter.