Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, store, share, and protect information when you use sendmatico.com, the logged-in application, and related services.

2. Scope

This policy applies to our public marketing site, customer accounts, admin tooling we operate, and integrations you choose to connect (including Gmail/Google Workspace sender connections, SMTP/IMAP, optional calendar features, and payment checkout). It does not cover third-party sites or services you access independently (for example Google Account settings or Whop's own checkout pages), which have their own policies.

3. Information we collect

We collect information you provide, information generated by your use of the service, and information from integrations you authorize.

4. Information users provide

Depending on how you use SendMatico, this may include:

• Account details (name, email address, password)
• Profile information you choose to add
• Prospect/lead lists and related fields (names, emails, phone numbers, company, titles, tags, custom fields, import mappings, consent-related fields you choose to store)
• Campaign settings, email subjects and bodies, templates, and related content
• Sender connection details (sender email identity; SMTP/IMAP settings; Gmail App Passwords or other mailbox credentials you supply; BYO OAuth client credentials if you use that option; Outlook/custom SMTP configurations where available)
• Meeting-related details you configure or sync
• Support and contact-form messages
• Billing-related account activity (credit purchases and balances)

5. Information collected automatically

• Authentication and session data
• Log and security data (for example IP address and user agent associated with certain security, password-reset, contact, or audit events)
• Product usage events needed to operate the service
• Email link-click metadata when tracked links are used (such as IP address, user agent, and referer)
• Cookie and similar technology data as described below
• Operational metadata for sender health, warmup, and deliverability features we provide

6. Cookies and similar technologies

We use essential cookies for authentication, security, and core functionality. Analytics cookies (including Google Analytics 4, when enabled) load only after you give explicit consent via our cookie banner. We do not use advertising or remarketing cookies. See our Cookie Policy.

Email link tracking (when used in campaigns) is a product feature distinct from website analytics cookies and may record click metadata needed to operate campaign analytics.

7. Sender account and email connection data

When you connect a sender mailbox, we store the information needed to send and (where applicable) read mail for reply detection on your behalf, including:

• Sender email address and display name
• Connection type (for example Gmail API / Connect with Google, Gmail App Password / SMTP, Outlook, or custom SMTP)
• Credentials or OAuth tokens required for that connection
• Connection metadata (for example connection timestamps and OAuth client source: SendMatico-managed platform OAuth vs your own OAuth client)

Mailbox passwords and OAuth tokens are stored using encryption at rest with keys managed by our systems. You are responsible for providing credentials you are authorized to use.

8. Google account and Gmail data

If you use Connect with Google (SendMatico-managed OAuth) or another Google/Gmail API connection option we provide, we may access Google user data as described in the Google API Data Use section below.

Calendar OAuth is a separate optional integration and is not part of the four Gmail sender OAuth scopes used for Connect with Google.

9. How we use information

• Provide, operate, maintain, and improve SendMatico
• Authenticate users and secure accounts
• Send campaign, warmup, and product emails through connected senders you configure
• Detect replies, attribute them to campaigns, and stop follow-ups when configured
• Manage unsubscribes, bounces, and suppressions
• Process credits and fulfill purchases
• Provide support, investigate abuse or security issues, and comply with law
• Communicate service-related notices

10. How we use Google user data

SendMatico uses Google user data only to provide user-requested Gmail/Google Workspace sender connection, sending, reply detection, campaign reply attribution, and follow-up stopping features (and calendar features you separately enable). We do not use Google user data for advertising, profiling for ads, resale, or unrelated analytics. We do not sell Google user data.

Platform Connect with Google — four OAuth scopes, grouped by product purpose:

• Identity / account matching: openid; https://www.googleapis.com/auth/userinfo.email
• Sending: https://www.googleapis.com/auth/gmail.send
• Reply detection / mailbox reading: https://www.googleapis.com/auth/gmail.readonly

Scope purposes:

• openid — authenticate/associate the connected Google account during OAuth
• userinfo.email — read the primary Google Account email address and match it to the sender email being connected
• gmail.send — send emails from the Gmail or Google Workspace account the user explicitly connects and configures as a sender
• gmail.readonly — read mailbox messages and metadata needed for reply detection, campaign reply attribution, and stopping follow-up sequences after a recipient replies

SendMatico does not request gmail.modify or full https://mail.google.com/ access for this Connect with Google flow.

11. Google Limited Use disclosure

SendMatico's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

12. Google API Data Use

When you connect a Gmail or Google Workspace account using Connect with Google, SendMatico may access your Google account identity information (including your primary Google Account email address), send email through the connected account, and read Gmail mailbox messages and metadata needed for reply detection and campaign attribution.

SendMatico uses this access only to connect and verify the selected sender mailbox, send user-configured emails from that mailbox, and detect replies, attribute them to campaigns, and stop follow-up sequences after a recipient replies.

For Gmail sender connections, SendMatico may access the connected Google account email address, Gmail sender identity, message headers and metadata such as Message-ID, In-Reply-To, References, From, To, Subject, thread identifiers, reply messages, and delivery failure, bounce, or DSN messages. We use this data only to connect the sender, send user-configured messages, detect replies, detect delivery failures or bounces, attribute activity to the correct workflow, update campaign status, and stop follow-ups after replies. This Gmail sender OAuth flow does not access Google Contacts, Google Drive, or Google Calendar; does not modify, delete, move, or label Gmail messages; and does not mark messages read or unread.

SendMatico requests four OAuth scopes for this flow: openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/gmail.send, and https://www.googleapis.com/auth/gmail.readonly.

SendMatico does not request https://www.googleapis.com/auth/gmail.modify or https://mail.google.com/ for this Connect with Google flow.

Calendar OAuth is a separate optional integration and is not part of the four Gmail sender OAuth scopes used for Connect with Google.

SendMatico's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

SendMatico does not sell Google user data, use it for advertising, transfer it to data brokers, or use it for lending or credit-worthiness decisions.

SendMatico does not use Google Workspace API data or Google user data obtained through Google APIs to develop, improve, or train generalized or non-personalized AI or machine learning models.

SendMatico does not transfer Google Workspace API data to third-party AI or machine learning services for the purpose of training generalized or non-personalized AI or machine learning models.

SendMatico does not routinely access or review Gmail message content manually. We may access Google/Gmail-related data only when necessary to provide support requested by the user, with the user's permission, or where necessary for security, abuse investigation, legal compliance, or protecting the service.

When you disconnect a Gmail sender in SendMatico, we remove the local connection and revoke the related Google OAuth token where supported. You can also revoke SendMatico access directly from your Google Account permissions. After disconnect or revocation, SendMatico can no longer access new Gmail data through that authorization. Some historical campaign, sending, reply, billing, compliance, suppression, security, or audit records may be retained as needed to operate the service, comply with law, resolve disputes, enforce terms, prevent abuse, maintain security, process billing, or honor suppressions/unsubscribes.

13. Human / support access to Google/Gmail-related data

SendMatico does not routinely access or review Gmail message content manually. We may access Google/Gmail-related data only when necessary to provide support requested by the user, with the user's permission, or where necessary for security, abuse investigation, legal compliance, or protecting the service.

14. How we share information

We do not sell personal information. We may share information with:

• Service providers who process data on our behalf (hosting, database, storage, email infrastructure we operate, analytics after consent, payment processing)
• Google, when you authorize Google/Gmail/Calendar access
• Whop, when you purchase credits
• Competent authorities when required by law
• Parties to a corporate transaction (merger, acquisition, asset sale), subject to applicable law and, for Google user data, Google's Limited Use rules (including user consent requirements where applicable)

We do not transfer Google user data to third parties except as necessary to provide or improve the user-facing features you request, for security/abuse investigation, to comply with law, or as otherwise allowed by Google policy and disclosed to users.

15. Service providers / processors

A current list of subprocessors and service providers is available on request at support@sendmatico.com. Categories may include Google (when you connect Google services), payment checkout (Whop), hosting/VPS, database/storage infrastructure, and analytics (Google Analytics only after consent). For GDPR-style controller/processor relationships with business customers, a DPA is available on request via support@sendmatico.com (see /dpa).

16. Billing and payments

Credit purchases are processed by Whop. We store credit balances and payment/checkout identifiers needed for fulfillment and support. We do not store full payment card numbers on SendMatico systems.

17. Unsubscribe / suppression

We provide unsubscribe and suppression mechanisms to help you honor opt-outs. Suppression and related compliance records may be retained as needed to prevent re-contact and to operate the service responsibly.

18. Data retention

We retain data for as long as needed to provide the service, comply with law, resolve disputes, enforce terms, prevent abuse, maintain security, process billing, and honor suppressions/unsubscribes.

After Gmail disconnect/revocation, we stop new Google API access under that authorization. Some historical campaign, sending, reply, billing, compliance, suppression, security, or audit records may be retained as needed for the purposes above.

19. Security

We implement reasonable administrative, technical, and organizational measures designed to protect information, including encryption of sensitive mailbox secrets and OAuth tokens at rest and transmission over HTTPS. No method of transmission or storage is completely secure. We do not claim unsupported security certifications.

20. User choices and controls

You can update account information, manage sender connections, control cookie analytics consent, export data, and request deletion through in-product privacy settings and by contacting us.

21. Disconnecting Gmail / revoking Google access

When you disconnect a Gmail sender in SendMatico, we remove the local connection and revoke the related Google OAuth token where supported. You can also revoke SendMatico access directly from your Google Account permissions. After disconnect or revocation, SendMatico can no longer access new Gmail data through that authorization. Some historical records may remain as described in retention.

22. Deleting account / DSAR / data rights

Subject to applicable law, you may request access, export, correction, or deletion of personal data by using in-app tools or emailing support@sendmatico.com. We may need to verify your request. Some data may be retained where required or permitted by law (for example security logs, suppressions needed to honor opt-outs, or billing records).

23. International transfers

We may process information in countries other than where you live. Where required, we use appropriate safeguards.

24. Children's privacy

SendMatico is not directed to children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal information from children.

25. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, where appropriate, provide additional notice.

26. Contact

Intelligent Code (Private) Limited, trading as iCodeLTD
113/C, A Block, Master City, Gujranwala, Pakistan
Email: support@sendmatico.com