1. Who is responsible
DTCSend is provided by Xploriz Digital FZ-LLC, a company licensed in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates, licence no. 46000593, registered address BIZ00217, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates (“we”, “us”). Contact: hello@dtcsend.com. Words such as Customer, Authorised User, Customer Content and Sub-processor mean the same as in our Beta Terms.
EU representative: not yet appointed. UK representative: not yet appointed. Until then, people in the EU and the UK can contact us directly at hello@dtcsend.com.
We have two roles. For account, usage, feedback and website data, we are the controller, and this policy applies directly. For Personal Data inside Customer Content, such as a person in a photo or a name on a review, the Customer is the controller and we are its processor, under our Data Processing Agreement. If your details are in a brand’s content, please contact that brand first.
2. What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, name, profile photo (with Google login), hashed password or Google identifier, two-step login settings, brands and roles | You, your team, or Google |
| Login and security | Last sign-in time, session details including IP address, login events; on the login, sign-up and password reset forms, a bot check (Cloudflare Turnstile) that sees your IP address and browser signals | Your device |
| Invitations | Invited email address, who invited them, role, dates | The person who invited you |
| Usage | Monthly counts of emails, images and other actions per account and brand; which AI feature ran, with its timing and cost; job status. No content of emails in these counts | Your use of the Service |
| Feedback | Your message, type, email address and name, page, brand name, optional screenshot (which may show anything on your screen), our private notes on it | You |
| Error reports | Technical details of errors, with your user ID. We switch off IP addresses, cookies, headers, request bodies and query strings, and we scrub these reports before sending | Your browser and our servers |
| Website visitors | Technical logs from our hosting (such as requested page, time, user agent), and any invite request you send | Your device, you |
| Admin records | A log of our admin actions, such as suspending a user. Deleted people’s addresses are masked | Us |
| Customer Content (as processor) | Whatever you put in: briefs, Brand Kit, photos that may show people, names and quotes in reviews, customer handles, signatory names, footer addresses, products, reference emails and uploaded guidelines | The Customer |
We do not collect your email subscribers’ or shop customers’ details from Klaviyo or Shopify. We read only Shopify’s public product feed. We do not add tracking pixels to your emails, use advertising trackers, or sell Personal Data. Please do not upload health data or other special categories of data.
3. Why we use it, and our legal basis
| Purpose | Data | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Provide the Service: accounts, invitations, roles, brands, emails | Account, invitations, usage | Contract (art. 6(1)(b)), or our legitimate interest in providing the Service to your employer or client (art. 6(1)(f)) |
| Keep it secure, prevent abuse, investigate problems | Login and security, error reports, usage, admin records | Legitimate interests: security and reliability |
| Apply fair Usage Limits, control AI costs | Usage | Contract, and legitimate interests |
| Answer and act on feedback | Feedback | Legitimate interests: support and improving the Service |
| Essential messages: invitations, password resets, login emails, limit alerts, service notices | Account | Contract, and legitimate interests |
| Record your acceptance of these documents | Account, version and time | Legal obligation (accountability) and legitimate interests |
| Comply with the law, or defend legal claims | As needed | Legal obligation, and legitimate interests |
Providing account details is needed to use the Service. We do not make decisions with legal or similarly significant effects about you by automated means. AI is used to produce content, not to make decisions about people.
4. AI providers
To write and design your emails, we send relevant Customer Content to AI providers from our servers. Your browser does not contact them directly, and our accounts are the ones used. The table shows what goes where.
| Provider | What we send | Training on it? | How long they keep it |
|---|---|---|---|
| Anthropic (Claude): planning, copy, chat edits, reading your brief, website and guidelines, photo analysis | Briefs, Brand Kit, products, reviews and proof you added, chat messages, website screenshots and text, uploaded guidelines, photos | No. Its commercial terms prohibit training on customer content | Deleted within 30 days. Content flagged for policy violations: up to 2 years, safety scores up to 7 years |
| OpenAI (image generation and editing) | Image descriptions; product photos; photos of people only when you confirm you have the model’s permission | No by default for API data | Up to 30 days for abuse monitoring; no application storage for image endpoints |
| Photoroom (background removal) | Product photos you choose to cut out | No | Processed and discarded straight away; operational logs 15 days; API access logs 1 year |
When a section places text over a photo, AI looks at where faces and products are in that photo, so that text does not cover them. This does not identify anyone, and we do not create biometric templates. We never make AI variations of photos marked as customer photos.
5. Who else receives data
We use the service providers in the table in section 7, and they act on our instructions. We share only what each needs. When paid plans start, Paddle will receive what it needs to sell them, as Merchant of Record and an independent controller. Otherwise we disclose Personal Data only if the law requires it, to protect rights or safety, or to a successor if the business changes hands. Members of your Brand Workspace see that brand’s content according to their role, and the owner can see who is a member.
Access by us: one person currently administers the Service for us. Our administrator can see accounts, brand names and members, usage, admin logs and feedback, and can reach other stored data when needed for support, security or legal reasons. Admin access requires two-step login. Our administrator works from the United Arab Emirates.
6. Cookies and similar technologies
We use only what the Service needs to work and to remember your choices. We use no advertising or analytics cookies, so we do not show a cookie banner.
| Name / type | Purpose | How long |
|---|---|---|
| Login cookies (Supabase, sb-…) | Keep you logged in securely. Strictly necessary | Up to 400 days, renewed while you use the Service; removed when you log out. The login inside it expires much sooner and is checked on every request |
| Sidebar cookie | Remembers whether you collapsed the sidebar | 1 year |
| Browser storage: cs-theme | Remembers your light or dark choice | Until you change it |
| Browser storage: usage notice | Remembers that you closed a notice | Until you clear it |
Fonts and images in emails. Images in emails you create are loaded from our hosting (Supabase and its content network) when a recipient opens the email. If your Brand Kit uses a Google Font, the email and its previews may load that font from Google. As with any web image or font, those providers receive the recipient’s or viewer’s IP address. We do not use this to track opens or identify recipients. The Customer decides what is sent, and should cover this in its own privacy notice.
7. Where data is stored, and international transfers
Our main database and stored files are in Frankfurt, Germany. Our web application and background worker also run there. Not everything stays in the EU, because several providers process data in the United States, and we are based in the United Arab Emirates. These countries are outside the EEA and the UK. The UAE has no EU adequacy decision. Where the law requires it, we protect transfers using the European Commission’s Standard Contractual Clauses and the UK Addendum, or an adequacy decision such as the EU-US Data Privacy Framework. You can ask us for a copy at hello@dtcsend.com.
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, login, file storage, image hosting | Frankfurt (region chosen by us) | SCCs and UK Addendum in its DPA |
| Vercel Inc. (USA) | Web application hosting | Functions in Frankfurt; primary facilities in the USA; global network | SCCs and UK Addendum in its DPA |
| Fly.io, Inc. (USA) | Background worker | Frankfurt; logs and platform data may be elsewhere | EU-US DPF with UK Extension; SCCs as fallback |
| Anthropic (USA) | AI writing and analysis | USA | SCCs and UK Addendum in its DPA |
| OpenAI OpCo, LLC (USA) | AI images | USA | SCCs and UK Addendum in its DPA |
| Photoroom SAS (France) | Background removal | USA (its infrastructure) | Transfer instrument per its DPA (not named) |
| Plus Five Five, Inc. (Resend, USA) | Sending service emails | Sent from Ireland; content, logs and account data stored in the USA | EU-US DPF with UK Extension, and SCCs |
| Functional Software, Inc. (Sentry, USA) | Error reports | Event data in Germany; account data in the USA | EU-US DPF with UK Extension; SCCs as fallback |
| Cloudflare, Inc. (USA) | Bot check on the login, sign-up and password reset forms (Turnstile). Cloudflare also uses these signals, as its own controller, to improve its bot detection | Global network | SCCs in its DPA |
| Google (Workspace) | Our hello@ mailbox (feedback emails, your messages to us) | USA and other countries where Google has data centres | SCCs in Google’s Cloud Data Processing Addendum |
8. How long we keep data
| Data | How long |
|---|---|
| Account and profile | Until your account is deleted |
| Brand Workspace content, including hosted images | Until the brand or account is deleted. Hosted images are never deleted automatically just because time has passed |
| Feedback screenshots | 90 days, then deleted automatically |
| Feedback messages and our notes | 2 years, then deleted automatically; earlier if your account is deleted or you ask us. Copies in our mailbox are deleted by hand |
| Usage counts and AI cost records | Usage counts and daily spend totals: 7 years (business and tax records), then deleted automatically; after a brand is deleted they stay for the account without the brand link. Detailed AI cost records go with the brand |
| Invitations | They stop working after 14 days (DTCSend invitations) or 7 days (brand invitations). An invitation that was never used is deleted 90 days after it stopped working. A used invitation stays until the invited person’s account is deleted |
| Admin log | 2 years, then deleted automatically. A deleted person’s email address is masked straight away |
| Database backups (Supabase) | Daily, kept for 7 days. Deleted data can remain in a backup until it expires. Stored files are not part of these backups |
| Supabase platform logs | 7 days |
| Vercel logs | Up to 30 days |
| Fly.io application logs | 7 days |
| Sentry error reports | 30 days |
| Resend email logs and content | 30 days |
| Our record that you accepted these documents | As long as your account exists, and 7 years after it is deleted, as evidence. Then deleted automatically |
What deleting does
- Deleting a brand removes its Brand Kit, products, assets, campaigns, reviews and proof, jobs, AI cost records and stored files. Images in emails already sent or exported stop showing. A job still running at that moment finishes, then its files are removed.
- What stays after deleting a brand: feedback messages and screenshots, which may show or mention the brand, but with the brand’s name blanked; usage counts; admin log entries, where a past brand name is blanked if it can be matched; the name of a deleted user’s brands in the admin log of that deletion; and backups and CDN caches until they expire.
- Deleting an account (on request) removes the account, profile, memberships, two-step login apps, sessions, invitations, feedback and login records. Our record that you accepted these documents is kept for 7 years, as evidence. Content in brands that continue stays, without the person’s name attached. The admin log keeps a masked entry.
9. Your rights (EU and UK)
You can ask to access, correct or delete your Personal Data, restrict or object to its processing, and receive a portable copy. Email hello@dtcsend.com, and we will answer within one month. You may also complain to your data protection authority (in the UK, the Information Commissioner). If your data is in a brand’s content, we will pass your request to that brand, as its processor.
Correcting your details. For your security, your name and email address can’t yet be changed inside the Service. To correct either, email hello@dtcsend.com from the address on your account, with the correct details. If you no longer have access to the old address, tell us who you are and we will check it another way. We confirm the request is yours, change the address for you, usually within 5 working days, and let both addresses know. This route applies under every section below.
10. United Arab Emirates: your rights under the PDPL
The UAE’s Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) may give you the right to get information about your data and a copy of it, to have it corrected or erased, to restrict or object to its processing, to move it to another provider, and to object to certain automated decisions. Email hello@dtcsend.com, and we will answer within one month. You may also complain to the UAE’s data protection authority.
11. India: your rights under the DPDP Act
If you are in India, the Digital Personal Data Protection Act, 2023 gives you the right to get information about your data, to correct and erase it, to have your grievances addressed, and to nominate someone to act for you in case of death or incapacity. You may withdraw consent where we rely on it, by emailing us, and it will be as easy to withdraw as it was to give. We use your data to provide the Service you asked for, as set out in section 3. If you would like this notice in another language listed in the Eighth Schedule of the Constitution of India, ask us.
Grievance Officer / contact for data questions: Sushil Jaywantrao Kundale, hello@dtcsend.com, at the address in section 1. We will respond within 30 days. If you are not satisfied, you may approach the Data Protection Board of India once you have used this route.
12. Security
We protect data with access rules on every table, separated brand workspaces, encryption in transit and at rest, encrypted storage of per-brand secrets, optional two-step login, and required two-step login for administrators. The Data Processing Agreement lists our measures. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the relevant authorities as the law requires.
13. Children
The Service is for business use by adults. We do not knowingly collect children’s data. If you think we have, please tell us.
14. Changes
This policy has a version number and date. We will tell you about material changes, and where needed ask you to accept the new version at your next login.