Privacy Policy
What Voff Digital LLC collects when you use Sendwax, why we have it, and what you can ask us to do with it.
Two kinds of data, two different roles. For data about you as a customer — your account, your billing, your usage — we are the controller and this policy is the full story. For data about the people you send to, you are the controller and we act as your processor: we handle it on your instructions, and your own privacy notice governs it. Section 3 sets out what that means in practice.
1. Who we are
Sendwax is operated by Voff Digital LLC, a limited liability company registered in the State of Florida, United States, and the controller of the personal data described in this policy.
For anything in this policy, write to hello@voff.digital. We will provide our registered postal address on request.
2. What we collect
| Category | What it includes |
|---|---|
| Account | Name, email address, hashed password, workspace name, and the settings you choose. |
| Billing | Plan, subscription status, and the billing identifiers returned by our payment processor. We never see or store your full card number. |
| Sending domains | Domains you add, and the DNS records we generate and verify for SPF, DKIM and DMARC. |
| Message data | The messages you send: recipients, subject, headers, body, and the template used. |
| Delivery events | Sends, deliveries, bounces, complaints, opens, clicks and unsubscribes, with timestamps and the receiving system's response. |
| Suppressions | Addresses suppressed by bounce, complaint or unsubscribe, and why. |
| Technical | IP address, browser and device information, and request logs from the dashboard and API. |
| Support | What you send us through the contact form or by email, including your address and the content of your message. |
3. Controller and processor
We are the controller for your account, billing, technical and support data. We decide why and how it is processed, and this policy describes that.
We are a processor for the personal data inside the mail you send — recipient addresses, contact attributes, message content. We process it to deliver your mail, record what happened to it, and enforce suppressions. We do not sell it, we do not use it to build our own profiles, and we do not use it to market to your recipients. You are responsible for having a lawful basis to send to them and for telling them how you use their data.
4. Why we process it
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service — sending mail, showing history, authenticating domains | Performance of a contract |
| Billing and collecting payment | Performance of a contract |
| Security, fraud and abuse prevention, rate limiting | Legitimate interests |
| Maintaining deliverability and platform reputation | Legitimate interests |
| Support and service communications | Performance of a contract |
| Meeting legal and regulatory obligations | Legal obligation |
| Product analytics on aggregate, non-identifying usage | Legitimate interests |
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
5. Who we share it with
We share data with the providers below, only as needed to run the Service. Each is bound by contract to protect it.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Email delivery (SES) and infrastructure hosting | United States |
| Stripe | Subscription billing and payment processing | United States |
| Cloudflare | Bot protection on public forms (Turnstile) | Global |
| DigitalOcean / Cloudways | Application and database hosting | United States |
We may also disclose data where we are legally required to, or to protect our rights, our users, or the public. If we are ever acquired or merged, data may transfer as part of that transaction; we will give notice before it becomes subject to a different privacy policy.
6. How long we keep it
- Account data — for as long as your Workspace exists, and up to 90 days after closure.
- Message content — retained for the window shown in your dashboard, then deleted.
- Delivery events — kept as sending history for your Workspace, and in aggregate for deliverability analysis.
- Suppression records — kept indefinitely. This is deliberate: an unsubscribe or complaint must outlive the account that received it, or closing an account would become a way to erase it.
- Billing records — kept as long as tax and accounting law requires, typically seven years.
- Security logs — typically 12 months.
7. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to processing, receive it in a portable format, or withdraw consent where processing relies on it. Residents of California and other US states with comparable laws may also have the right to know what is collected and to opt out of sale or sharing — noting that we do neither.
To exercise any of these, email hello@voff.digital. We will respond within the time the applicable law allows, normally 30 days, and we will not treat you differently for asking.
If you are a recipient of mail sent through Sendwax and want your data corrected or erased, contact the sender directly — they are the controller and we act on their instructions. If you cannot reach them, write to us and we will help route the request.
In the EEA or UK you may also complain to your local supervisory authority.
8. International transfers
We operate from the United States, and our providers are largely US-based. If you are in the EEA or UK, your data will be transferred to the United States. Where those transfers require a safeguard, they rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with the technical measures described in our security policy.
9. Security
Traffic is encrypted with TLS. Passwords are hashed. API keys are stored as hashes and shown only once. Webhook payloads are signed so you can verify they came from us. Access to production data is limited to those who need it. No system is perfectly secure, but the details of what we do are on the security page.
10. Cookies
The dashboard uses a session cookie to keep you signed in and a CSRF token cookie to protect forms. Both are strictly necessary — without them the application cannot work. Cloudflare Turnstile may set its own storage on public forms to tell humans from bots. We do not use advertising or cross-site tracking cookies on this site.
Separately, if you enable open or click tracking on your campaigns, Sendwax records those events on your behalf as your processor. Whether to enable it, and how to disclose it to your recipients, is your decision.
11. Children
The Service is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to hello@voff.digital and we will delete it.
12. Changes to this policy
We will update this page when our practices change, and revise the effective date at the top. If a change materially affects how we handle your personal data, we will tell you by email or in the dashboard before it takes effect.
13. Contact
Voff Digital LLC
State of Florida, United States
hello@voff.digital
Our registered postal address is available on request to the address above.