Data processing addendum

Roles

For the message data you send through us, you are the controller and we are the processor. You decide who gets emailed and what it says; we act on your instructions and on nothing else.

For your own account data — your sign-in address, your billing details — we are the controller.

Our instructions

We process message data to do the four things the product does: accept the message, attempt delivery, record what happened, and deliver your webhooks. We do not process it for anything else. The two exceptions are stated rather than hidden: an automated abuse check reads content to refuse sending that would harm recipients, and a support engineer may read one specific message when you ask us to debug it.

Subprocessors

Listed at /subprocessors with what each one sees. We give 14 days' notice before adding one — an email to every current owner of your account, the same day we publish the change — and you may object in that window.

Security

The measures are described at /security. Connections to the product use TLS; API keys are stored hashed with a server-side pepper, never in plaintext.

Your rights as controller

• Access and export: GET /account/export returns a zip covering every store on the account — messages with their full body, delivery events, mail you received, contacts, templates, webhooks, this account's own suppressions, domains, support requests, the audit log and the team — with a manifest that counts every file.
• Deletion: DELETE /account stops your keys at once. Message data keeps ageing out on your plan's window regardless (7 days on Free, 30 on Starter, 90 on Pro, 180 on Scale; the same numbers are at /retention.json). The rest of a closed account is not yet erased on a schedule; write to hello@agentisend.com after closing and we remove it by hand and confirm it.
• Audit: the account audit log records account changes — keys, limits, the kill switch, domains, webhooks, suppressions, contacts, segments, topics, templates, broadcasts, automations, approvals, team roles, billing and account closure — with who made it and the value before and after; the current list is at /security. We will answer a written audit questionnaire once a year, and, where a supervisory authority requires it, allow an inspection on 30 days' notice.

Breach notification

If we discover a breach affecting your data, we tell you without undue delay and within 72 hours of becoming aware, with what we know at the time rather than waiting for a complete picture. We follow a written incident process to get that notice out fast: detect, triage, log the facts Article 33(5) requires, find every account it touches, and mail every current owner directly — the same mechanism that carries a subprocessor or terms notice.

Transfers

All personal data we process for you is stored and processed in the United States, whichever region a sending domain records — see /subprocessors for where each subprocessor sits. For customers in the EEA, the UK or Switzerland, the Standard Contractual Clauses (Commission Decision 2021/914, Module Two, controller to processor) are incorporated into this addendum and apply to that transfer; Annexes I and II below fill in its appendix.

Annex I: the processing

• Parties. You, the account holder, as controller; AgentiSend as processor. Contact for both sides of this addendum: hello@agentisend.com.
• Categories of data subjects. The people you send mail to, and the contacts you store in your audience. Your own sign-in address and your team's are account data, for which we are the controller (see Roles).
• Categories of personal data. Email addresses and names in the envelope and headers; the subject, body and attachments of each message; the delivery events each message produces (accepted, delivered, bounced, complained, and opened or clicked if you turned tracking on); the attributes and topic answers you store on a contact, and how each one agreed to hear from you when you told us that.
• Special categories. None is needed to use the product. A message body carries whatever you put in it, and we process it only as described here.
• Nature and purpose. The things under "Our instructions" — accepting, delivering, recording and webhooking a message; storing the audience you send to and the broadcasts and automations you send them; and processing the DMARC and mailbox-provider feedback reports about your domains — plus the automated abuse check and support debugging described there.
• Frequency. Continuous: every message you send.
• Retention. Messages and their events are kept for your plan's history and then deleted: Free keeps 7 days, Starter 30, Pro 90, Scale 180. Account data — the account, your team, domains, contacts and templates — is kept while the account is open; /policy/retention says what happens to it, and when, once you close the account.
• Where. The United States (Hillsboro, Oregon), for every region a sending domain records.

Annex II: technical and organisational measures

The measures are the ones /security lists as implemented, and it lists what is not implemented yet as well:

• Connections to the API, the console and webhook endpoints use TLS. Delivery to a recipient's mail server uses TLS when that server offers it and falls back to plain delivery otherwise, unless the sending domain's TLS setting is set to require it. The hop from the API to the servers that send your mail runs over a private network throughout, never the public internet.
• API keys are stored hashed with a server-side pepper; each key carries scopes and a send budget.
• Every read is scoped to the account in the query itself.
• The console session is an HTTP-only, same-site cookie; TOTP multi-factor sign-in is available, and an owner can require it for the whole account.
• Changes to keys, limits, the kill switch, domains, webhooks, suppressions, contacts, segments, topics, templates, broadcasts, automations, approvals, team roles, billing and account closure are written to an audit log with who made it and the value before and after; the current list is at /security.
• Received message content is shown as inert data in a sandboxed frame.
• A breach affecting your data is reported to you within 72 hours of our becoming aware of it.

Annex III: subprocessors

The list at /subprocessors is this annex: each subprocessor, what it sees, and where. We give 14 days' notice before adding one — an email to every current owner of your account — and you may object in that window.

How to execute it

Today, by writing to hello@agentisend.com with "Legal" in the subject. Self-serve execution on acceptance of the terms is planned and is not built yet, and this page will say so until it is.