Privacy Policy
This policy has two audiences, and they want different things.
| If you are… | Read |
|---|---|
| A customer using Sendora to send campaigns | Sections 1–16. Short version: your lists are yours, held in India, never sold, never shared, never merged with anyone else's |
| A recipient who received a message and wants it to stop | Section 17, which is written for you and tells you what to do |
Sendora is supplied by Caresoft Systems Private Limited ("Caresoft", "we"), Mumbai, India.
Four commitments to customers:
1. Your contact lists are held in India and are never sold, rented or shared.
2. We never merge your lists into a shared database, and no other customer can see or reach them.
3. We never market to your contacts, and never use your lists for our own sending.
4. We never use your data to train artificial intelligence models.
1. Who is responsible for what
| Data | Customer | Caresoft |
|---|---|---|
| Contact lists imported by a customer | Data Fiduciary / Controller | Data Processor |
| Message content and campaigns | Controller | Processor |
| Engagement data — opens, clicks, bounces | Controller | Processor |
| Customer user accounts and audit logs | Controller | Processor |
| Customer subscription, billing and support records | Counterparty | Controller |
| Platform-wide abuse and suppression records | — | Controller |
| Our website and enquiry data | — | Controller |
If you received a marketing message, the business that sent it is responsible for having your details — not Caresoft.
We do not choose recipients, do not build lists, and did not decide to contact you. We provided the software. §17 tells you what we can do to help anyway.
2. What we hold — customers
2.1 Account
Business name, address, GSTIN, contact person, users' names and work contacts, credentials (passwords stored only as salted and peppered one-way hashes), plan, volumes, sending domains, and billing records.
2.2 Campaigns
Templates, message content, subject lines, sender configuration, schedules, and send logs.
2.3 Activity
Sign-ins, campaigns created and sent, imports performed, exports, configuration changes, API calls, device, browser and IP address.
3. Your contact data
Whatever you import: names, email addresses, mobile numbers, and any additional fields you use for mail merge — company, city, designation, purchase history, or anything else in your spreadsheet.
Import only what you need for the campaign. A mail-merge file often carries far more than the message uses — internal notes, deal values, personal remarks. Everything in the file is uploaded, stored and becomes part of what a breach would expose.
Sensitive personal data — health information, financial account details, government identifiers — should not be imported at all. A campaign platform is the wrong place for it, and no mail merge needs it.
You are the Data Fiduciary for this data, and you warrant a lawful basis for it under Terms §5.
4. Isolation between customers
Your lists are yours alone. Tenant isolation is enforced at the data layer. No other customer can query, see, export or send to your contacts through any interface.
We do not maintain a shared or aggregate contact database. There is no combined pool, no enrichment from other customers' data, and no "verified contacts" set built from what customers upload. Some platforms do this quietly. We do not, and this section is where we commit to it.
5. What we track about recipients
When you send a campaign, the Platform records:
| Recorded | How |
|---|---|
| Delivered, bounced, deferred | Reported by the receiving mail server |
| Opens, where enabled | A small tracking image, when images load |
| Clicks, where enabled | Links routed through a redirect that records the click |
| Unsubscribes and complaints | The recipient's action |
| Approximate device and mail client | From the request, where a tracking image loads |
| WhatsApp delivered, read and blocked | Reported by the WhatsApp Business Platform |
Open tracking is unreliable and you should treat it as such. Privacy proxies pre-fetch images and register opens nobody made; image blocking hides opens that happened. An open rate is an indication, not a measurement.
Tracking can be disabled per campaign or per account. Where your recipients are in jurisdictions requiring consent for tracking, disabling it is often the correct choice, and the Platform works fully without it.
6. Limits on tracking
The Platform does not:
• track recipients across the web, or on sites other than links in your own campaign
• build a cross-customer profile of any recipient
• fingerprint devices
• share engagement data between customers
• sell engagement data to anyone
• combine a recipient's activity across different customers' campaigns
A recipient who appears on two customers' lists is, to us, two unrelated records. We do not link them, and we could not tell either customer that the other exists.
7. Why we process it
- To store contact databases and compose personalised messages.
- To transmit campaigns through Upstream Providers.
- To record delivery, bounce, engagement and opt-out outcomes.
- To maintain suppression lists.
- To monitor sending quality and enforce the Acceptable Use Policy.
- To investigate abuse reports and complaints.
- To provide support and billing.
- To meet legal obligations, including mandatory log retention and incident reporting.
8. Lawful basis
For customer account and billing data, we process on the basis of our contract and legal obligations. For contact data, we process as your processor on your instructions — you determine the basis on which your recipients' personal data is processed, and you warrant it under Terms §5. Where the GDPR or another foreign regime applies to your recipients, the terms in our DPA apply.
9. What we never do
We do not:
• sell, rent, licence or trade contact data
• market to your contacts, ever
• use your lists to send anything of our own
• share lists or engagement data between customers
• merge customer lists into a shared database (§4)
• enrich or append data from other customers' lists
• publish benchmarks in which a customer could be identified
• use your data to train artificial intelligence models
These are contractual commitments in the DPA. Any change to this section will be notified prominently and in advance.
10. Caresoft access
Caresoft personnel access customer data only where:
- you have raised a support request that requires it;
- an abuse report, complaint or provider notice requires review of a campaign;
- a threshold breach or security incident is being investigated; or
- we are compelled by valid legal process.
Every access is individually authenticated, requires multi-factor authentication, and is logged with the person, time, data accessed and stated reason, available to you on request. Production data is never copied into development, test or demonstration environments.
11. Sharing and sub-processors
| Who | Receives |
|---|---|
| Hosting provider (India) | Encrypted data at rest |
| Email sending provider | Recipient address and message content, for transmission |
| WhatsApp Business Platform (Meta) | Recipient number and message content, under Meta's own terms |
| Payment gateway | Customer payment details. Not contact data |
| Authorities | Only where compelled by valid legal process, or where reporting is required |
Meta receives what you send through WhatsApp and processes it under its own terms, over which we have no control. If that is not acceptable for a particular list, do not send it over WhatsApp.
The current named list is at /subprocessors. Each is bound by written confidentiality and security obligations.
12. Where data is held
Contact data, campaign data and backups are stored and processed within India. Support and engineering access is from India. Message transmission necessarily involves the recipient's own mail or messaging provider, wherever they are.
13. How long we keep it
| Data | Retention |
|---|---|
| Contact databases | While your subscription is active; deleted within [30] days of termination after the export window |
| Campaign content and templates | With your account |
| Send logs and delivery records | [24] months — needed to answer complaints and regulatory queries |
| Engagement data (opens, clicks) | [13] months |
| Suppression list | Indefinitely — see §14 |
| Abuse reports and investigations | [5] years |
| Account and user records | Life of the account plus [90] days |
| Invoices and tax records | Up to 8 years |
| System logs required by law | Minimum 180 days, held in India |
| Backups | Rolling [35] days |
14. The suppression list
Suppression records are kept indefinitely, and deliberately so.
A record that someone unsubscribed is the only thing that stops them being contacted again. Deleting it would defeat the very right they exercised. Keeping it is a protection for the recipient, not a retention of their data against their interests.
- Suppression records hold the address or number and the reason and date — nothing else, and nothing from the campaign that prompted it.
- Suppression survives account termination for the customer that generated it.
- A recipient can only be un-suppressed by a fresh, evidenced opt-in — and never by the customer simply removing the flag.
15. Security
Encryption in transit and at rest; passwords stored as salted and peppered one-way hashes; role-based access with multi-factor authentication for administrative accounts; tenant isolation enforced at the data layer; audit logging of imports, exports, campaign sends and access; rate limiting; no production data in non-production environments; vulnerability scanning and periodic penetration testing.
A compromised bulk-sending account is used for phishing within minutes. Enable multi-factor authentication for every user, revoke access promptly when people leave, rotate API keys, and tell us immediately at [email protected] if you suspect anything.
16. If something goes wrong
- We notify you of any personal data breach affecting your data without undue delay, and in any event within [24] hours of confirmation.
- We are required to report specified cyber incidents to CERT-In within 6 hours, and to retain system logs for a minimum of 180 days within India.
- Evidence is preserved until the investigation closes.
- You notify your own recipients and the Data Protection Board of India as Data Fiduciary. We provide the information and support required.
- We provide a written root cause analysis with corrective actions within [10] working days.
17. If you received a message — start here
This section is for you if a business sent you an email or WhatsApp message through Sendora and you want it to stop, or want to know how they got your details.
17.1 To stop the messages
- Use the unsubscribe link in the email. It works in one click, takes effect immediately, and the Platform will not send to you again from that business.
- For WhatsApp, reply with any opt-out wording, or block the number. Both are honoured.
- If either does not work, tell us at [email protected] and we will suppress you ourselves.
17.2 To stop messages from every Sendora sender
Write to [email protected] with the address or number, and ask for a global suppression. We will add you to a platform-wide list so that no customer of ours can send to you, whatever their list says.
We do not ask you to justify this, and it takes effect within [2] working days.
17.3 To find out how they got your details
We do not know, and we cannot tell you. The business chose the list and uploaded it; we transmitted it.
Ask the sender directly — under the Digital Personal Data Protection Act, 2023 they are the Data Fiduciary and must answer you. Their contact details are in the message.
If they do not answer, or the answer is unsatisfactory, tell us at [email protected]. We require our customers to produce consent evidence on request, and a complaint from a recipient is a reason to ask. If they cannot produce it, we suspend their sending.
17.4 If you think the message was spam or fraudulent
- Report it to [email protected]. Forward the message with full headers if you can — but send it even if you cannot.
- We acknowledge within [24] hours and investigate within [5] working days.
- You are suppressed immediately, before any investigation.
- If the message was phishing or contained malware, say so — those are treated as urgent, and the account is suspended pending review.
17.5 Your rights
Your rights over your personal data are exercised against the business that sent the message, as Data Fiduciary. We hold your details only as their processor, plus a suppression record if you opted out.
Where you ask us directly, we will suppress you, tell the customer, and pass your request on. We will not disclose our customer's identity beyond what is already in the message, unless required by law.
You may complain to the Data Protection Board of India, and separately to TRAI where telecom regulations apply.
18. Customer rights
You have direct access to all your data in the Platform and can export it at any time. For your own account data you may request access, correction, erasure and a portable copy — write to [email protected]; we verify and respond within 30 days.
For requests from your recipients, you are the Data Fiduciary and must handle them. We assist as your processor.
Erasure has limits: suppression records (§14), send logs needed to answer complaints, tax records, and system logs required by law. We will identify specifically what is retained and why.
19. Cookies
Strictly necessary cookies for sign-in, session and security; functional cookies for preferences; analytics only with consent. The signed-in console uses no advertising cookies. Separately, click tracking in campaigns uses a redirect, not a cookie, and can be disabled (§5). Full detail in our Cookie Policy.
20. Contact and Grievance Officer
Recipients — to stop messages or report abuse: [email protected] — acknowledged within 24 hours
Privacy: [email protected]
Support: [email protected]
Grievance Officer (Information Technology Act, 2000; Digital Personal Data Protection Act, 2023)
Name: Rajeev Pillai
Email: [email protected]
Address: 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107
Acknowledgement within 24 hours; resolution within 15 days.
Caresoft Systems Private Limited, 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107, CIN [U72900MH2022PTC387875].
21. Changes
We may update this policy. The version date will change. Material changes are notified at least [30] days in advance. Any change to §4, §6 or §9 will be notified prominently and in advance — those are the commitments that make it safe to put a contact list on a shared platform.