Privacy Policy

1. Who this applies to

This policy is for customers using the SmartSendBox dashboard. If you received a commercial email sent through our software and want to know why, the sender is the controller of that contact data — we act as their processor. Every message we send carries a one-click unsubscribe link and the sender’s identity.

2. What your account holds

• Account details — your email address, your name and a bcrypt hash of your password. The password itself is never stored; if you forget it we cannot tell you what it was, only reset it.
• Campaign data — your email copy, sending history, contact list and their status.
• Mailbox credentials — the SMTP server, username and password of the mailbox you connect. The password is encrypted with AES-256-GCM and never displayed again anywhere in the dashboard.
• Domain records — the domains you add for verification. DNS records are read live; no copy is kept.

3. Legal basis

We process your account and campaign data to perform the contract between us (GDPR Art. 6(1)(b)) and, for security logging and abuse prevention, on the basis of legitimate interest (Art. 6(1)(f)). We do not use your data for advertising and we do not sell it.

4. Who we share it with

Only with the service providers needed to run the product: hosting and database infrastructure, the search provider that finds companies, and the email provider you connect yourself. Each processes data on our instructions and none of them receives your data for their own purposes.

We do not disclose data to anyone else unless we are legally required to, and where we are permitted to tell you about such a request, we will.

5. How long we keep it

• Account and campaign data: as long as your account is open.
• After account closure: deleted within 30 days, except records we must keep for accounting or legal reasons.
• Unsubscribe records: kept permanently and deliberately. Deleting them would mean someone who opted out could be contacted again — the one outcome the record exists to prevent.

6. Your rights

Under the GDPR you may request access to your data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to us and we will respond within one month.

Your contact list and sending history are also exportable as a spreadsheet at any time from the dashboard, without asking us. Data portability should not require a support ticket.

7. Security

• All traffic runs over HTTPS.
• Passwords are hashed with bcrypt; mailbox credentials are encrypted with AES-256-GCM.
• Every database query is scoped to the signed-in account, and that isolation is covered by automated tests that run on every change.

8. Cookies

In the dashboard we use only what is required for it to work: a session cookie that keeps you signed in and a preference cookie for the light/dark theme. On the public website we use Google Analytics to see how many people arrive and from where — it sets its own cookies. We have turned off advertising signals and personalisation, so the data is not used to build an advertising profile of you. You can block it with any tracker blocker; nothing on the site stops working.

9. Changes

If this policy changes in a way that affects you, we will tell you by email before the change takes effect rather than quietly updating the date at the top.