Cookie Policy

Platform: Sendora • Version: [1.1] • Effective: 01/04/2026

Part A covers cookies on our website and console — the ordinary cookie policy. Part B covers campaign tracking, which is a different thing entirely and is where the obligations that matter to you actually sit.

Sendora is supplied by Caresoft Systems Private Limited. Read this with the Privacy Policy.

The short version. Our site uses a few cookies, analytics only with consent, and no advertising cookies anywhere. Campaign open and click tracking does not use cookies at all — it uses a tracking image and link redirects. It can be turned off, and in some jurisdictions it should be.

Part A · 1. Cookies we set

Cookie	Purpose	Type	Duration
`sendora_session`	Keeps you signed in	Strictly necessary	Session
`sendora_csrf`	Protects forms against cross-site request forgery	Strictly necessary	Session
`sendora_consent`	Remembers your cookie choices	Strictly necessary	[12] months
`sendora_lang`	Interface language	Functional	[12] months
`sendora_theme`	Light or dark preference	Functional	[12] months
Analytics cookies	Aggregate use of the marketing site — only with consent	Analytics	[13] months

Strictly necessary cookies are set without consent because sign-in cannot work without them. Everything else waits for your choice.

Part A · 2. Analytics

Analytics run only with consent, and refusing changes nothing about your access.
They cover the marketing site and documentation — which pages are read, where people give up.
The signed-in console is not tracked for analytics beyond what is needed to operate and secure it. We do not analyse how you build campaigns.
IP addresses are truncated before storage where the provider supports it.

Part A · 3. No advertising cookies

We place no advertising, retargeting or social media tracking cookies on any Sendora property. No pixel on the marketing site, none in the console.

We do not build audiences from visitors and do not share visitor data with any ad network.

Part A · 4. Controlling cookies

Change your choices at any time through the cookie settings link in our footer.
Rejecting is exactly as easy as accepting — one click, same prominence.
Your browser can block or clear cookies; blocking strictly necessary ones prevents sign-in.

Part A · 5. Global Privacy Control

We honour the Global Privacy Control signal. If your browser sends GPC, we treat it as a refusal of optional cookies and do not ask again on that browser.

Part B · 6. Campaign tracking is not cookies

People conflate the two, and the distinction matters legally. Cookies are stored on a device. Campaign tracking is not — it works through a loaded image and a redirected link, and nothing is written to the recipient's device.

That does not make it exempt from consent requirements. In several jurisdictions, tracking whether a person opened an email needs a lawful basis in its own right, independent of cookie law.

Part B · 7. Open tracking

Where enabled, a small transparent image is embedded in the email. If the recipient's client loads images, the request tells us the message was opened.
Recorded: the campaign, the recipient record, a timestamp, and approximate device and mail client from the request.
No cookie is set on the recipient's device.

Open tracking is unreliable in both directions. Privacy proxies pre-fetch images and register opens nobody made; image blocking hides opens that happened. Treat it as directional, never as a measurement — and never as evidence of anything to a third party.

Part B · 8. Click tracking

Where enabled, links are rewritten to pass through a Sendora redirect that records the click and forwards immediately.
Recorded: the campaign, the recipient record, which link, and a timestamp.
No cookie is set, and we do not follow the recipient onto your site.
Security scanners follow links automatically, producing clicks no human made. Corporate mail filters do this routinely.

Part B · 9. What we do not do

Campaign tracking does not:

• set cookies on recipients' devices
• follow recipients around the web
• track recipients on your site or anyone else's
• fingerprint devices
• build a cross-customer profile of any recipient
• link a recipient's behaviour across different customers' campaigns
• share engagement data between customers
• sell engagement data to anyone

A recipient on two customers' lists is two unrelated records to us. We do not connect them and could not tell either customer the other exists.

Part B · 10. Turning tracking off

Open and click tracking can be disabled per campaign, or as a default for your whole account. The platform works fully without it — you still get delivery, bounce, complaint and unsubscribe data, which is the information that actually protects your sending.

Set it as an account default, or per campaign at send time.
With click tracking off, links are sent as you wrote them, unrewritten.
Some customers disable it permanently — for recipients in strict jurisdictions, for professional or regulated audiences, or because they would rather not. That is a perfectly reasonable choice and we do not discourage it.

Part B · 11. Your obligations as sender

You are the Data Fiduciary for tracking your recipients. Sendora provides the mechanism; the decision to use it, and the lawful basis for it, are yours.

Disclose tracking in your own privacy policy, and link it from your campaigns.
Where your recipients are in the EU or UK, tracking opens and clicks generally requires consent, and consent to receive email is not automatically consent to be tracked. Take advice, or turn tracking off for those recipients.
Under the Digital Personal Data Protection Act, 2023, engagement data about an identifiable person is personal data and needs a basis like anything else.
Do not use engagement data in ways a recipient would find surprising — inferring interest in a sensitive topic from a click, or triggering a sales call because someone opened twice.
Never track in a message about a sensitive subject where the tracking itself would reveal something — health, finance, legal difficulty.

Part B · 12. Your landing pages

Once a recipient clicks through, they are on your site and everything that happens there is yours — your cookies, your pixels, your analytics, your consent banner.

Sendora's redirect ends at the moment of forwarding. We do not know what your page does and are not responsible for its compliance.

If you add UTM parameters, your own analytics receives them and your own policy governs. Advertising pixels on a page reached from a campaign about a sensitive subject are a real risk, and one worth reviewing.

13. Contact

Privacy: [email protected]
Support: [email protected]
Grievance Officer: Rajeev Pillai, [email protected] — acknowledgement within 24 hours, resolution within 15 days
Caresoft Systems Private Limited, 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107, CIN [U72900MH2022PTC387875]

We may update this page. Material changes are notified at least [30] days in advance. Any change to §9 will be notified prominently and in advance.