Back to home

Privacy Policy

Last updated: April 2026

1. Introduction

SendNex ("Email as a Service") is an API-based email sending platform operated from Lagos, Nigeria. This privacy policy explains how we collect, use, store, and protect your personal data when you use our service.

We are committed to complying with the Nigeria Data Protection Regulation (NDPR) and the EU General Data Protection Regulation (GDPR) where applicable.

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

  • Name and email address
  • Company name (optional)
  • Password (stored as a salted hash, never in plain text)

2.2 Email Data

When you send emails through our API, we process:

  • Email content (subject, body, attachments)
  • Recipient addresses (to, cc, bcc)
  • Sender addresses and display names
  • Custom headers and metadata you provide

2.3 Tracking Data

If you enable tracking, we collect:

  • Open events (timestamp, approximate location)
  • Click events (timestamp, URL clicked)
  • Delivery status (delivered, bounced, complained)

2.4 API Usage Logs

We log API requests for security and debugging purposes:

  • API key used (masked)
  • Request timestamp and endpoint
  • Response status code
  • IP address

2.5 Payment Information

Payment processing is handled by Paystack and Stripe. We do not store your full credit card number. We receive only a payment token, last four digits, and transaction status from the payment processor.

3. Why We Collect Your Data

We use your data to:

  • Provide the service — send, receive, and track emails on your behalf
  • Manage your account — authentication, billing, and support
  • Improve reliability — monitor delivery rates, detect abuse, and debug issues
  • Comply with law — respond to legal requests and prevent fraud

4. Our Role as Data Processor

When you send emails through SendNex, you are the data controller and we are the data processor. We process email content and recipient data solely on your behalf and according to your instructions. We do not use your email content for our own purposes.

5. Data Retention

  • Email logs and tracking data: retained for 90 days, then automatically deleted
  • Account data: retained until you delete your account
  • API usage logs: retained for 90 days
  • Payment records: retained as required by Nigerian tax law (minimum 6 years)

6. Third-Party Services

We share data with these service providers as necessary to operate:

  • AWS SES — email delivery infrastructure (data processed in AWS regions)
  • Paystack / Stripe — payment processing
  • Grafana / Prometheus — internal monitoring and observability (no personal data shared)

We do not sell your data to third parties. We do not share your data with advertisers.

7. Your Rights

7.1 GDPR Rights (EU/EEA Users)

If you are in the EU or EEA, you have the right to:

  • Access — request a copy of the data we hold about you
  • Rectification — correct inaccurate data
  • Erasure — request deletion of your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing of your data
  • Restriction — request we limit processing

7.2 NDPR Rights (Nigerian Users)

Under the Nigeria Data Protection Regulation, you have equivalent rights to access, rectify, and delete your personal data. You may also withdraw consent at any time.

To exercise any of these rights, email us at privacy@sendnex.xyz. We will respond within 30 days.

8. Data Security

We protect your data with:

  • Encryption in transit (TLS 1.2+)
  • Encryption at rest for stored data
  • API key authentication with HMAC-signed session tokens
  • Role-based access control
  • Regular security audits

9. Cookies

We use only essential cookies required for the service to function. See our Cookie Policy for details.

10. Children

SendNex is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or through the dashboard at least 30 days before they take effect.

12. Contact

For privacy-related questions or requests, contact us at: