This policy explains the processing of personal data when you visit Sendiro, create an account, use its features or receive email sent by one of its customers. The operator’s identity and contact channels appear on the contact and legal identity page.
- Legal name
- Fabricio Javier Espinoza Mora
- Costa Rican identity number
- 116420427
- Country of operation
- Costa Rica
- Business address
- Barrio María Auxiliadora, San Pablo, Heredia, Costa Rica
- Legal and privacy email
- support@sendiro.app
- Available contact
- support@sendiro.app
Two different relationships with your data
Your relationship with Sendiro. Sendiro determines the purposes of processing needed to administer accounts, provide the service, answer inquiries, manage billing and protect the platform.
Data a customer adds to its workspace. The customer decides whom to contact, why and with what content. Sendiro processes its lists, messages and results under its instructions, subject to the data processing agreement. Technical permissions in the service do not replace consent or the customer’s other obligations.
If you received an email from a Sendiro customer, contact the sender first to learn about its purposes or exercise rights concerning its list. You may also contact us for assistance or to report abuse.
What data we process and where it comes from
| Category | Information and source | Main purpose |
|---|---|---|
| Account and access | Email address, name and identification information supplied at registration or through the selected sign-in provider; account and session identifiers. | Authentication, account administration and prevention of unauthorized access. |
| Workspace and service | Members and permissions, workspace name, senders, domains, settings and usage. | Deliver contracted features, control access and calculate capacity and consumption. |
| Customer contacts | Email addresses, names, custom fields, segments and data imported or submitted through integrations. | Organize contacts and carry out the customer’s communication instructions. |
| Consent and restrictions | Source and evidence supplied by the customer, confirmations, unsubscribes, bounces, complaints and suppression status. | Respect preferences and prevent further unauthorized or harmful sending. |
| Messages and activity | Senders, recipients, subjects, content, uploaded files or resources, identifiers and sending, delivery, open and click events. | Prepare and send messages, report results and investigate incidents. |
| Billing and support | Plans, operations and payment-provider references where relevant; correspondence and files submitted when requesting help. | Administer the commercial relationship, answer questions and handle claims. |
| Technical information | Request and error records, operation identifiers and session information. Infrastructure providers may receive connection information, including IP addresses. | Security, diagnosis and service operation. |
An email address and information needed to authenticate you are necessary to create and use an account. Other profile information is optional where indicated. Withholding information needed for an operation may prevent its completion; do not add personal information that is unnecessary for your use of the service.
Purposes and limits
We use information to provide and maintain Sendiro; administer access, usage and billing; handle requests; protect accounts and recipients; investigate fraud, spam or breaches; and meet legal obligations and address claims. Operational communications may include access, security or material service notices.
Sendiro does not use customer lists for its own advertising or commercialize those lists. Uploading contacts does not subscribe them to Sendiro marketing. Consent to receive one customer’s campaigns does not authorize another customer’s campaigns.
Where legislation requires consent, it must be informed and specific to the relevant purpose. Publishing this policy or browsing the site does not replace that consent. Consent can be withdrawn through the stated channels, without retroactive effect and subject to processing that must legally continue.
Cookies, measurement and email tracking
We use session and security cookies and browser storage to complete sign-in and retain certain preferences and operations. Optional measurement through Firebase Analytics is disabled: Sendiro does not initialize that analytics service or send sign-in, registration or page-visit events through it. Signing in does not require enabling it. See the cookies and similar technologies notice for the technologies used.
Messages sent through the Amazon SES configuration may include a pixel and tracked links that generate open and click events. Sendiro associates available events with the message and the customer’s workspace. Image blocking, filters, bots and recipients’ privacy features may affect results; an open alone does not establish that a person read the email.
Customers must inform recipients of this tracking and obtain any required authorization. Unsubscribing from marketing restricts that customer’s promotional sending; it does not necessarily erase all information or block a lawful, separate transactional email.
Who may receive information
Authorized workspace members have access according to their permissions. Infrastructure, authentication, storage and email providers participate as needed to provide the service. See providers and subprocessors for their functions and known locations.
Integrations and webhook destinations configured by a customer receive the information the customer authorizes. The customer must verify recipients and their terms. A payment provider may process information under its own terms; the currently available integration uses PayPal Sandbox for testing and does not establish that commercial charging is active.
Resources and images included in emails are served through token-bearing links accessible without signing in to anyone who has the link. The media library is not confidential storage: do not upload information that requires private access. Once a resource has been shared, copies may persist with recipients, intermediaries or caches even after the original is deleted.
We may disclose information to meet a valid legal obligation, respond to a competent authority or defend rights, limiting disclosure to what is relevant. Infrastructure may involve processing outside Costa Rica or the customer’s country. Conditions required for any additional authorizations or safeguards must be established before the relevant processing is activated; this policy is not a blanket authorization for any transfer.
Retention and deletion
We retain information while a necessary, lawful purpose exists. We apply the following criteria when handling deletion or return instructions, closing an account and reviewing an incident or a retention obligation:
| Category | Retention and deletion criteria |
|---|---|
| Account, members and settings | While needed for access and administration of linked workspaces. During closure, we remove information that is no longer necessary and distinguish information needed for security, claims or legal obligations. Closing an individual account does not authorize deletion of another person’s workspace data. |
| Contact profiles and audiences | While the customer maintains a lawful instruction to use them. Deleting a contact minimizes its profile; a broader erasure request is also assessed against linked messages, evidence and records. |
| Messages, revisions and results | While needed to carry out or document communications, resolve uncertain results, follow customer instructions or investigate claims. Closure includes reviewing historical content and its references; a history alone does not justify retention without a continuing purpose. |
| Consent, unsubscribes and suppressions | The minimum information needed to establish the decision and prevent further sending contrary to it, meet an obligation or address a claim. It is not used for our own campaigns, and deleting a profile does not remove a valid restriction. |
| Resources and images | While the customer uses them and designs, revisions or messages reference them. Resource deletion requires resolving those references. We cannot erase copies already held by recipients or independent third parties. |
| Technical and security records | While needed to diagnose operations, prevent abuse, investigate incidents or defend a specific claim. Session or operational-record expiry does not itself erase workspace data. |
| Billing, support and rights requests | While handling the operation or request and, afterwards, only for applicable legal obligations or the defense of claims. We retain information needed to document the response to a rights request. |
Deleting a contact removes optional profile information and excludes it from ordinary use, but retains its email identity and consent or suppression evidence to respect restrictions and prevent improper reintroduction. Archiving a contact is reversible and does not delete it.
Ending a subscription does not automatically delete the entire account or workspace. To request return, erasure or closure, email support@sendiro.app with the subject “Privacy” and identify the request’s scope. We verify your identity and, for workspace information, your authority to give instructions. We then communicate the outcome, applicable operations and any justified retention or limitation within the applicable legal deadlines. Verification is not used to delay those deadlines improperly.
Requests requiring operator intervention are handled manually. There is no uniform automatic purge period for all information. Where a legal obligation, necessary investigation or claim justifies retaining some information, retention is limited to that purpose and the necessary period, without restarting communications. If copies remain under our control or a provider’s control, the response will explain their treatment and applicable limitations; erasure is not instant. Once the purpose justifying retention ends, the information must be effectively deleted or anonymized.
Security
The service includes authentication, workspace permissions, server-side checks and integration restrictions. Session cookies use browser protections and secure transport in the production environment. Protect credentials and keys, limit member permissions and contact us if you suspect unauthorized access. These measures do not amount to an absolute security guarantee or a compliance certification.
Exercising your rights
Email support@sendiro.app with the subject “Privacy.” Describe your request and the related account, workspace or sender. We will request only reasonable information to verify your identity and authority; do not send passwords or API keys. Requests will be handled free of charge where required and within applicable legal deadlines.
In Costa Rica, you may request access, correction and deletion, as well as exercise other rights recognized under Law 8968. Article 7 provides five business days to resolve a request as appropriate. You may seek protection of your rights from PRODHAB.
Where Mexican legislation applies, you may exercise access, correction, cancellation and objection rights —ARCO rights— and request withdrawal or limitation of processing under the Mexican personal data protection law. Additional US privacy rights depend on the legislation that applies and each party’s role; not every state regime is presumed to cover every Sendiro operation.
For a request concerning information on a customer-managed list, we will coordinate with that customer where appropriate, without using that coordination to obstruct a right Sendiro must handle directly. Deletion may be subject to justified legal restrictions, which will be explained where relevant.
Changes
Later versions will identify their date and communicate material changes through appropriate channels. Changing the notice does not itself expand existing authorizations to process information.