This policy explains how [COMPANY LEGAL NAME] ("we") handles personal data in connection with Kaysid. Contact for privacy matters: [[PRIVACY CONTACT EMAIL]].
1. Two roles
- Account data — we are the controller. Data about our users: name, email address, password hash, Google account identifier if you sign in with Google, workspace membership and role, and security and usage logs.
- Customer Data — we are the processor. Lead and contact data, email content, mailbox credentials and engagement data that our customers upload or generate. Each customer is the controller of that data and decides why it is processed. Recipients who want to exercise their rights should contact the sender; we will assist our customers.
2. What we use account data for, and why
- Providing the Service and your account (contract).
- Security: verifying your email, preventing abuse, rate limiting sign-in attempts, and logging (legitimate interests).
- Service emails such as verification, password reset and team invitations (contract / legitimate interests).
- Complying with legal obligations.
We do not sell personal data and do not use Customer Data to train models or for our own marketing.
3. Recipients and opt-outs
When a recipient unsubscribes from a customer's email, we store their address on that customer's suppression list so they are not emailed again by that customer. Open tracking records when a tracking image is loaded; customers can switch it off per campaign.
4. Sub-processors
- Hosting and database infrastructure (our cloud / VPS provider).
- Resend — delivery of transactional emails (verification, password reset, invitations).
- Google — only if you choose Google sign-in.
Customer email is sent through the mailboxes customers connect, not through our own mail infrastructure.
5. International transfers
Where data is transferred outside the UK/EEA we rely on adequacy decisions or Standard Contractual Clauses.
6. Retention
Account data is kept while your account exists and deleted when you delete it, apart from limited records we must keep by law. Customer Data is deleted when the workspace or account is deleted. Suppression entries are kept for as long as the workspace exists so that opt-outs stay honoured.
7. Security
Passwords are hashed with bcrypt; mailbox passwords are encrypted at rest (AES-256-GCM); tokens in emailed links are stored only as hashes; access is limited by workspace role; connections use TLS.
8. Your rights
Depending on where you live you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to data portability. You can update your profile and delete your account in the product, or email [[PRIVACY CONTACT EMAIL]]. You may also complain to your local data-protection authority.
9. Cookies
We use only essential cookies: a session cookie to keep you signed in, a cookie remembering your active workspace, and security cookies used during sign-in. We do not use advertising cookies.
10. Changes
We will post updates here and notify you of material changes. See also our Terms of Service.