Privacy Policy

Introduction

Sendpilot AI AB ("Sendpilot", "we" or "us") respects your privacy. This policy explains what personal data we collect, where it comes from, how we use, store, share and protect it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and other privacy laws.

This policy applies to personal data we process when you:

• visit our website, sendpilot.ai (the "Website");
• use the Sendpilot platform at app.sendpilot.ai, our REST API, our webhooks or our MCP server (together, the "Services");
• connect an integration to the Services, such as a LinkedIn account, HubSpot or Slack;
• email us, chat with us, book a meeting with us or otherwise communicate with us;
• interact with our advertising or content on third-party websites and services that link to this policy.

It also explains how we handle data about people in our lead database, and about the prospects whose data our customers manage in the Services.

This policy does not cover third-party websites and services, including LinkedIn, HubSpot, Slack and the AI assistants you connect to the Services, even when you reach them from our Website or the Services. Their own privacy policies apply.

This policy explains our practices. It is not something you have to agree to. Where we rely on your consent, for example for non-essential cookies, we ask for it separately. If you are a customer, our processing of the personal data in your workspace is also governed by our Terms of Service, including the Data Processing Addendum (the "DPA") in Exhibit A.

Summary

This is a short overview. The sections below give the full details.

• Who we are: Sendpilot AI AB in Stockholm, Sweden, is the controller of your personal data, except for the data our customers manage in the Services, which we process on their behalf (see Our Role: Controller or Processor).
• What we collect: the account, billing and support data you give us; data about how you use our Website and the Services; data from the integrations you connect; and the business contact records in our lead database.
• Why: to provide and secure the Services, run our lead database, bill our customers, meet our legal obligations and market our own services, and, with your consent, to measure our Website and our ads (see Legal Bases for Processing).
• Who receives it: our service providers, the destinations you choose, our customers (for records in our lead database), and authorities where the law requires it (see Sub-processors and Sharing). We never sell the data in your workspace or your integrations, and we never use it for advertising.
• Where it is stored: the Sendpilot platform runs on Microsoft Azure in Sweden. Some providers process data outside the EEA, mainly in the United States, under the safeguards in International Data Transfers.
• How long we keep it: workspace data while your account is active, deleted within 30 days after it closes, with the exceptions in How Long We Keep Data.
• Your rights: access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent at any time. You can object at any time to direct marketing (see Your Right to Object).
• Contact and complaints: email hello@sendpilot.ai, or complain to IMY, the Swedish Authority for Privacy Protection.

Who We Are

Sendpilot AI AB is the controller of your personal data, except where we process data on behalf of a customer, as described in Our Role: Controller or Processor.

• Company: Sendpilot AI AB, a Swedish limited company (aktiebolag)
• Org. no.: 559528-8447
• Registered address: Danderydsgatan 28A, 114 26 Stockholm, Sweden
• Privacy contact: hello@sendpilot.ai

We have not appointed a Data Protection Officer. Please send any question or request about your personal data to hello@sendpilot.ai.

Our competent supervisory authority is Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection.

Our Role: Controller or Processor

Under the GDPR, a controller decides why and how personal data is processed, and a processor processes personal data on a controller's behalf. We act in both roles.

We are the controller for:

• account and billing data about our customers and their users;
• data about visitors to our Website, and about people who contact us, book a meeting with us or receive our marketing;
• the records in our lead database (see People in Our Lead Database);
• our security logs, and the aggregated, anonymized usage data we use to improve the Services.

We are a processor for the personal data our customers put into or connect to the Services. This includes the leads and prospects in their workspace, the conversations and messages in their connected LinkedIn accounts, the records they sync from HubSpot, and the content of their campaigns. We process this data only on the customer's instructions and under the DPA in our Terms of Service. The customer is the controller. It decides why this data is processed and on what legal basis.

If you are a prospect and a Sendpilot customer has contacted you or holds your details, please contact that customer to exercise your rights. If you contact us instead, we will pass your request on to the customer where we can identify it.

Information We Collect About You and How We Collect It

Personal data is information that identifies you or can be linked to you. It includes your name, email address, phone number, job title, company, billing details and LinkedIn profile, and information about your device, your internet connection and how you use our Website and the Services.

We collect personal data:

• from you, when you create an account, use the Services, fill in a form or contact us;
• automatically, as you use our Website and the Services, through logs, cookies and similar technologies;
• through integrations you connect, such as a LinkedIn account, HubSpot or Slack;
• from our customers, when they upload, import, extract or sync data about their prospects and leads;
• from a third-party B2B data provider, which licenses to us the business contact data in our lead database;
• from our service providers, for example payment status from Stripe and sign-in events from Clerk.

Information You Provide to Us

The information you provide to us may include:

• Account and profile data: your name, email address, company, job title and workspace settings, and the names and email addresses of teammates you invite.
• Billing data: your billing name and address, tax or VAT details, and your payment history. You enter payment card details into Stripe, which processes them. We do not store full card numbers.
• Content you create in the Services: campaigns, sequences, message templates, voice notes, ICP definitions, drafts of posts and lead magnets, and lead statuses.
• Correspondence: records and copies of your emails and chat messages with our sales and support teams, including problems you report, messages you send through our contact form, and meetings you book with us through Calendly.
• Transaction details: your subscription, your plan and your orders, and how they were fulfilled.

Giving us personal data is voluntary. We need your name and email address to create your account. If you buy a paid plan, we also need your billing details to invoice you, and the Swedish Bookkeeping Act then requires us to keep the invoices. Without this data we cannot provide the Services.

Content you share with others. You may share information with other members of your workspace, or publish content you create with Sendpilot, such as a LinkedIn post. You decide who sees it. We cannot control what other people do with information you share with them. Copies of content you publish elsewhere may remain there after you delete it from Sendpilot.

Information We Collect Automatically

As you use our Website and the Services, we and our service providers collect some information automatically:

• Device and connection data: your IP address, browser type and operating system, and your approximate location based on your IP address.
• Website usage: the pages you visit, the links you click and how you arrived at the Website. With your consent, this includes how you scroll and move through pages.
• Service logs: sign-ins, actions taken in your workspace, API and MCP requests, webhook deliveries, errors and security events.

We use this information to run and secure the Website and the Services, remember your preferences, recognize you when you return, estimate how many people use them and how, and improve them.

The technologies we use include:

• Cookies. A cookie is a small file stored on your device. Necessary cookies keep the Website and the Services working and secure, and remember your cookie choices. On our Website, we set non-essential cookies, such as support-chat, analytics and advertising cookies, only after you consent in our cookie banner. See Cookies and Consent and our Cookie Policy.
• Web beacons. Pages of our Website may contain small electronic files known as web beacons (also called pixel tags), which count the people who visit a page. They are part of the tools described in Website Analytics and Advertising, which explains when they run.

Data We Collect Through Integrations

When you connect an integration, we collect the data described below. We use it only to provide the features you enable (see How We Use Integration Data).

LinkedIn accounts. You connect a LinkedIn account through our LinkedIn API provider, LinkupAPI. Each connected account runs through its own dedicated proxy, supplied by LinkupAPI. On the Growth plan and above, you can use your own proxies instead. For each connected account, we collect:

• the account's profile and its connections;
• its conversations and messages, including voice notes;
• connection invitations it has sent and received;
• comments and reactions on your own LinkedIn posts, which inbound automations use;
• the access credentials and session tokens needed to keep the account connected. We store them encrypted and use them only to operate the account for the features you enable.

HubSpot. When you connect HubSpot, we read and write contacts, companies and deals, including the properties stored on them, such as names, job titles, contact details, company details and deal information. We do not log activities or messages to the HubSpot timeline. We store the OAuth tokens HubSpot issues so that the connection keeps working. Like all data in the Services, they are encrypted in transit and at rest, and we delete them when you disconnect HubSpot.

Slack. When you connect Slack, we store the access token Slack issues and the channel you choose. The token is encrypted, and we delete it when you disconnect Slack. We use the connection only to post the alerts you set up, for example when a lead replies or a connected LinkedIn account disconnects. An alert can include details about the lead and the event.

API keys, MCP connections and webhooks. If you create Sendpilot API keys, connect an AI assistant to our MCP server, or set up webhooks, we store the API keys, the OAuth authorizations (handled by Clerk), and your webhook endpoint URLs and signing secrets. We also log the requests and deliveries made with them.

Message content. Across these integrations we process the content of messages: the LinkedIn messages and voice notes your connected accounts send and receive, any message content included in your Slack alerts, and the event data you choose to receive by webhook.

Permissions We Request

We ask only for the permissions our features need, and we use each permission only for the reason given below. Our HubSpot app requests the scopes listed below. We keep this table up to date with the permissions we request.

HubSpot and Slack show you the permissions an app asks for before you approve the connection. You can disconnect HubSpot, Slack or a LinkedIn account at any time in Sendpilot, which also deletes the data that came through it, or revoke our access in the other service (see Disconnecting Integrations, Uninstalling and Deleting Your Account).

Prospect and Lead Data You Upload or Sync

Customers add prospects and leads to their workspace from these sources:

• CSV files they upload;
• LinkedIn and Sales Navigator search URLs, through the lead extractor;
• people who comment on or react to their LinkedIn posts, through inbound automations;
• contacts they import from HubSpot;
• the Sendpilot API and MCP server;
• our lead database.

This data may include a lead's name, job title, company, LinkedIn profile URL and public LinkedIn profile information, details about the lead's company, and any custom fields the customer adds. It also includes the lead's status, ICP score and campaign activity, and the conversations between the lead and the customer's connected LinkedIn accounts.

Enrichment. For leads that come from Sendpilot sources (our lead database, the lead extractor and inbound automations), we can add LinkedIn profile and company fields. We do not enrich leads imported from CSV files or other sources. We never look up email addresses or phone numbers.

The customer is the controller of this data, and we process it on the customer's behalf (see Our Role: Controller or Processor). Customers are responsible for having a lawful basis to process it, and for giving their prospects the information the law requires. Customers must not upload special categories of personal data, such as data about health, religion or political opinions.

People in Our Lead Database

This section is for people whose business contact details are in our lead database. It gives the information that GDPR Article 14 requires when personal data is not collected from the person it is about.

What the database is. Our lead database holds more than 300 million business contact records. Customers search it to find relevant business contacts and add them to their workspace for outreach on LinkedIn.

Where the data comes from. We license the records from a third-party B2B data provider.

What data we hold. A record may include your name, job title and seniority, your employer, details about your employer such as industry, size and location, your general location, and your LinkedIn profile URL and public professional profile information. Records do not include email addresses or phone numbers. We do not intentionally hold special categories of personal data.

Why we use it. We make records available to our customers so that they can find and contact relevant business contacts. Once a customer adds your record to its workspace, the customer decides whether to score it against its ideal customer profile (see AI Processing) or to add LinkedIn profile and company fields to it, and we do this on the customer's behalf.

Legal basis. We rely on legitimate interests (GDPR Article 6(1)(f)): our interest in providing a B2B prospecting service, and our customers' interest in finding and contacting relevant business contacts. In balancing these interests against your rights, we take into account that the data is limited to professional information and is used in a business context, and that you can opt out at any time.

Who receives it. Our customers who use the lead database, and the service providers that help us run it (see Sub-processors and Sharing). When a customer adds your record to its workspace, that customer becomes the controller of its copy and is responsible for its own outreach to you.

Transfers. Some service providers that process records, such as our AI providers, may do so outside the EEA, under the safeguards described in International Data Transfers.

How long we keep it. We keep a record for as long as it is part of the data we license, and we delete your record if you object.

Your right to object. You can object at any time, free of charge, to our use of your data in the lead database, including for direct marketing and any related profiling. To object, email hello@sendpilot.ai with your name and your LinkedIn profile URL. We will delete your record and keep only a minimal suppression entry, such as your LinkedIn profile URL, so that your record is not imported again.

If a customer has already added your details to its workspace, that customer controls its copy. We will pass your request on to that customer where we can identify it. You also have the other rights described in Your Rights Under the GDPR, including the right to complain to IMY.

How We Use Your Information

As the controller, we use the personal data we collect to:

• present our Website and its contents to you;
• create and manage your account, and provide the Services and the features you enable;
• provide the information, products and services you request from us;
• send you notices about your account, including billing, expiration and renewal notices;
• bill you, collect payment, carry out our obligations and enforce our rights under our contracts with you;
• tell you about changes to the Services or this policy;
• answer your questions and provide support, including through Support Mode (see Support Access);
• keep the Website and the Services secure, and detect and prevent fraud, abuse and misuse;
• understand how the Website and the Services are used, and improve them;
• comply with our legal obligations, such as bookkeeping;
• tell you about our own products and services;
• measure our own advertising, with your consent (see Website Analytics and Advertising).

Marketing. We may contact you about our own services that may interest you. Where the law requires your consent for marketing emails, we ask for it first. You can opt out at any time with the unsubscribe link in our emails or by emailing hello@sendpilot.ai. Opting out does not stop service messages about your account, such as billing notices.

No third-party advertising. We do not show third-party advertisements on our Website or in the Services, and we do not use your information to target ads for anyone else.

New purposes. If we want to use personal data for a new purpose that is not compatible with the purpose we collected it for, we will tell you first and, where the law requires it, ask for your consent.

How We Use Integration Data

Integration data is the data we receive through the integrations you connect: your LinkedIn accounts, HubSpot and Slack, and your API, MCP and webhook connections. We use it only to provide the features you enable:

• running your LinkedIn sequences and inbound automations;
• publishing the LinkedIn posts you schedule;
• showing your conversations and lead statuses in the unified inbox;
• importing, matching and syncing leads with HubSpot;
• posting your Slack alerts;
• scoring leads and drafting content, when you use our AI features;
• delivering your webhooks and answering your API and MCP requests;
• keeping these features secure, working and supported.

We never:

• use integration data for advertising, or upload it to advertising platforms;
• sell integration data, or share it for cross-context behavioral advertising;
• use integration data to train AI models, whether ours or our AI providers';
• make integration data available to other customers.

We may create aggregated, anonymized statistics about how the Services are used, such as how often a feature is used, to operate and improve the Services. These statistics do not identify you, your company or any other person.

Our staff access integration data only when that is needed to provide the Services: for example in Support Mode, when you ask us for help (see Support Access), to investigate a security issue, or to comply with the law.

AI Processing

Sendpilot uses large language models (LLMs) for three features:

• ICP scoring. We compare a lead's LinkedIn profile, including title, seniority, industry, company size, skills, experience and activity, with the ideal customer profile (ICP) you define, and produce a fit score from 0 to 100.
• Drafts of posts and lead magnets. We draft LinkedIn posts and lead magnets from your instructions.
• Inbox draft replies. When you use the AI draft button in the inbox, we draft a reply based on the conversation.

To provide these features, we send the data each one needs, such as the lead's profile, your ICP criteria, your instructions or the conversation, to our AI providers: Azure OpenAI Service (Microsoft) and the Anthropic API. They process it on our behalf under data-processing terms.

No training on your data. Your data, including integration data and lead data, is never used to train AI models, whether ours or our AI providers'. Our AI providers may keep inputs and outputs for a limited time to monitor for abuse, as their terms allow, but they may not use them to train models.

Drafts are suggestions. You can review and edit an AI draft before you send or publish it.

Profiling and automated decisions. ICP scoring is a form of profiling: it evaluates how well a person's professional profile fits a customer's target audience. Customers use the score to prioritize and filter their outreach, and a campaign can branch on it. The score does not lead to any decision that has legal or similarly significant effects on the person, so we do not make decisions covered by GDPR Article 22. ICP scoring runs on our customers' instructions, and the customer is the controller of the score. To object to it, contact the customer. If you contact us instead, we will pass your objection on where we can identify the customer. To have your record removed from our lead database, see People in Our Lead Database.

Legal Bases for Processing

Where we are the controller, we rely on the following legal bases under GDPR Article 6(1). Where we process data as a processor for a customer, the customer decides the legal basis.

Sale of Personal Data

We never sell, rent or trade the personal data in your workspace or the data we receive through your integrations, including LinkedIn, HubSpot and Slack data, leads and messages, and we never use it for advertising. We do not upload customer, lead or integration data to advertising platforms.

Some US state privacy laws, such as California's, define "sale" and "sharing" broadly. Two of our activities may count as a sale or as sharing under those definitions:

• Our lead database. Making lead-database records available to customers who pay for the Services may be treated as a "sale" of those records.
• Advertising on our Website. With your consent, the Meta Pixel and Google Analytics on sendpilot.ai help us measure our own ads and show them to people who visited our Website. This may be treated as "sharing" for cross-context behavioral advertising, or as "targeted advertising".

To opt out of the first, email hello@sendpilot.ai and we will remove your record from the lead database. To opt out of the second, reject or withdraw advertising cookies in the cookie settings on our Website. See also Your US State Privacy Rights.

Website Analytics and Advertising

We do not show third-party advertisements. On our Website only, we use the tools below. None of them loads until you accept it in our cookie banner.

• Google Analytics 4, loaded through Google Tag Manager, to understand how visitors use the Website and to measure our own ads. Google Ireland Limited processes this data on our behalf. We keep Google Analytics data for 14 months.
• Meta Pixel, to measure our own ads on Meta's platforms and to show our ads to people who visited our Website.
• Microsoft Clarity, to see how visitors scroll, click and move through pages so that we can improve the Website. Microsoft acts as an independent controller for Clarity data.

These tools use cookies and similar technologies. The companies that provide them may collect information about your activity on our Website over time and combine it with information about your activity on other websites and online services. We do not control how these companies use their own tracking technologies. If you have a question about an ad, contact the company responsible for it. Data from your workspace and your integrations is never sent to these tools.

Meta Pixel joint controllership. For the collection of Pixel data on our Website and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers under GDPR Article 26. We are responsible for telling you about this processing and for asking for your consent. Meta is responsible for what it does with the data after it receives it, including for enabling your rights over that data. The terms are set out in Meta's Controller Addendum. You can exercise your rights with either of us.

Your choices. You can reject these tools, or withdraw your consent, at any time in the cookie settings on our Website. You can also set your browser to block cookies, and you can opt out of targeted ads from members of the Network Advertising Initiative (NAI) on the NAI's website.

Sub-processors and Sharing

We share personal data only as described in this section. We use the service providers listed below to run the Services and the Website. Except where we say otherwise below, each one processes personal data only on our instructions, under data-processing terms that include confidentiality and security obligations. Our Sub-processors page lists every sub-processor with its location and transfer safeguard. We notify customers at least 10 days before we add or replace a sub-processor that processes customer data, and customers can object within 30 days, as the DPA describes.

For the Services

• Microsoft: Azure cloud hosting and database in the Sweden Central region (EU), and Azure OpenAI Service for AI features.
• Anthropic: the Anthropic API, for AI features.
• LinkupAPI: LinkedIn connectivity and dedicated proxies for each connected account.
• Clerk: sign-in, authentication and MCP OAuth.
• Svix: webhook delivery.
• Resend: email delivery.
• Intercom: support chat in the Services.
• Stripe: payments and billing. Stripe also acts as an independent controller for its own fraud-prevention and legal-compliance purposes.

For the Website

• Vercel: website hosting.
• Cloudflare: content delivery, security and bot protection.
• Google: Google Analytics 4 and Google Tag Manager.
• Meta: the Meta Pixel (joint controller; see Website Analytics and Advertising).
• Microsoft: Microsoft Clarity (independent controller).
• CookieYes: our cookie consent banner and consent records.
• Intercom: support chat on the Website.
• Calendly: meeting booking. Calendly is an independent controller for the cookies on its booking pages.
• Resend: delivery of the messages you send through our contact forms to our team.

Integration data. We share data that we receive through your integrations only:

• with the sub-processors that the feature you use needs, such as LinkupAPI to operate your LinkedIn account, Microsoft or Anthropic for AI features, and Svix for webhooks. They may use it only to provide their service to us, under data-processing terms with confidentiality obligations and, where data leaves the EEA, under one of the safeguards described in International Data Transfers;
• with the destinations you choose: your HubSpot account, your Slack workspace, your webhook endpoints, the AI assistants you connect through our MCP server, and, through LinkedIn, the people you message;
• where the law requires it, or to a buyer or successor of our business, as described below.

When data reaches a destination you chose, that service's own terms and privacy policy apply. We never share integration data with third parties for their own purposes, including advertising.

Other disclosures. We may also disclose personal data as listed below. For integration data, only the first two apply.

• to comply with a court order, law or legal process, including to respond to a government or regulatory request;
• to a buyer or successor if we sell, merge or restructure all or part of our business, including in insolvency;
• to enforce our Terms of Service and other agreements, including for billing and collection;
• where necessary to protect the rights, property or safety of Sendpilot, our customers or others, for example to prevent fraud.

We may disclose aggregated information that does not identify any individual without restriction.

International Data Transfers

We host the Services' application data and database in the EU, in Microsoft Azure's Sweden Central region. Some of our sub-processors, and some of the destinations you choose, process personal data outside the European Economic Area (EEA), mainly in the United States. For example, Anthropic, Clerk and Resend store or process data in the United States.

When we or our sub-processors transfer personal data outside the EEA, one of these safeguards applies:

• An adequacy decision by the European Commission, which confirms that a country protects personal data to EU standards. This covers, for example, the United Kingdom, and US companies certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). You can check a company's certification on the Data Privacy Framework list.
• Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), where no adequacy decision applies, together with supplementary measures, such as encryption and access controls, where they are needed.

When you send data to a destination you choose, such as your HubSpot account or an AI assistant, the transfer is made on your instructions, and that provider's own transfer terms apply.

Our Sub-processors page shows which safeguard applies to each provider. To get a copy of the safeguards that apply to your data, email hello@sendpilot.ai. We may remove commercial terms from the copy.

Where We Store Data and How We Protect It

We host the Sendpilot platform and its main database on Microsoft Azure, in the Sweden Central region in the EU, so the data in your workspace is stored primarily in the EU. Some sub-processors store or process specific data elsewhere, mainly in the United States (see International Data Transfers). Data is encrypted in transit and at rest.

Our measures include:

• encrypted storage of LinkedIn access credentials and session tokens, and of the tokens HubSpot and Slack issue, which we use only to operate the connection for the features you enable;
• access controls in the Services, depending on your plan: workspaces and roles, single sign-on (SAML SSO), and an audit log of activity in your workspace;
• staff access limited to what is needed, with Support Mode access logged and revoked when the issue is resolved (see Support Access);
• a duty of confidentiality for everyone who processes personal data on our behalf;
• data-processing terms with our sub-processors.

Security breaches. If a personal data breach occurs, we will notify IMY within 72 hours where the GDPR requires it, and tell the people affected without undue delay where the breach is likely to result in a high risk to them. If a breach affects customer data that we process as a processor, we will notify the customer without undue delay.

Your part. The safety of your information also depends on you. You are responsible for keeping your sign-in details and API keys confidential, and we ask you not to share them with anyone. No method of transmitting or storing data over the internet is completely secure, so we cannot guarantee the security of your data.

Support Access

If you contact our support team for assistance, our authorized support personnel may temporarily access your account in a restricted “Support Mode”. This access is used solely to investigate, diagnose, and resolve the issue you reported. While in Support Mode, our team may view certain data or configurations within your account that are necessary to understand and fix the problem. We will not modify or delete your data unless you expressly request it or it is required to resolve the issue. All access in Support Mode is logged, monitored, and revoked as soon as the support request is resolved.

How Long We Keep Data

We keep personal data only as long as we need it for the purposes described in this policy, or as long as the law requires. Then we delete or anonymize it.

Disconnecting Integrations, Uninstalling and Deleting Your Account

Disconnecting an integration. When you disconnect HubSpot, Slack or a LinkedIn account in Sendpilot, syncing stops immediately. We then delete everything that came through that integration, promptly and at the latest within 30 days: its tokens and credentials, and its data, such as the records imported from HubSpot or the conversations of that LinkedIn account. Copies in backups roll off within a further 30 days.

Uninstalling from HubSpot or Slack. If you uninstall the Sendpilot app from your HubSpot account, or remove it from your Slack workspace, that service revokes our access, so syncing and alerts stop. To have the data that came through it deleted from Sendpilot, also disconnect it in Sendpilot or email hello@sendpilot.ai.

Data in the other service. Disconnecting does not delete data held by the other service. Records we created or updated in your HubSpot account, alerts we posted to Slack, and messages sent from your LinkedIn account stay there, under that service's control and terms.

Accounts that disconnect on their own. If a connected LinkedIn account becomes disconnected without you removing it, for example because its session expired, and it stays disconnected for more than 10 days, we may remove it from the platform together with its credentials, integrations and data, as our Terms of Service describe.

Deleting leads and conversations. You can delete individual leads and conversations in the app at any time.

Deleting your account. To delete your account, email hello@sendpilot.ai. We may ask you to confirm the request, for example from the email address on your account. We erase your account and its workspace data within 30 days, except the records listed under "What we keep after deletion" below, and copies in backups roll off within a further 30 days. If your subscription ends and you do not ask us to delete your account, we still delete your workspace data within 30 days, so contact us before then if you need a copy.

What we keep after deletion. Only what the retention table above lists: invoices and accounting records for as long as the Swedish Bookkeeping Act requires; sales and support correspondence for 24 months; security and audit logs for up to 24 months; website analytics data for up to 14 months; and a suppression entry if you objected to processing. For customers, the DPA in our Terms of Service also governs the return or deletion of customer data when the agreement ends.

Copies held by our sub-processors. Our sub-processors delete the copies they hold under their own retention terms. Some keep logs for a limited time to keep their services secure, and our AI providers may keep inputs and outputs for a limited time to monitor for abuse (see AI Processing).

Your Right to Object

You can object at any time to our use of your data for direct marketing, including profiling for that purpose. We will then stop. You can also object, on grounds relating to your particular situation, to any processing we base on legitimate interests (see Legal Bases for Processing), including profiling. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

To object, email hello@sendpilot.ai or use the unsubscribe link in any marketing email. If you are in our lead database, see People in Our Lead Database for what happens to your record. If a Sendpilot customer holds your details, object to that customer. If you contact us instead, we will pass your objection on where we can identify the customer.

Your Rights Under the GDPR

You have these rights over your personal data:

• Access: ask whether we process your data, and get a copy of it.
• Rectification: have inaccurate data corrected and incomplete data completed. You can also update your details yourself on your account profile page.
• Erasure: ask us to delete your data.
• Restriction: ask us to limit how we use your data, for example while we check whether it is accurate.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another company, where we process it by automated means on the basis of your consent or a contract.
• Objection: object to our processing of your data; see Your Right to Object.
• Withdrawing consent: withdraw your consent at any time, for example in the cookie settings on our Website. This does not affect processing that took place before you withdrew it.
• Automated decisions: not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not make such decisions (see AI Processing).

How to exercise your rights. Email hello@sendpilot.ai. We may ask for information to confirm your identity. We will respond without undue delay, and within one month. If your request is complex, or you send many requests, we may extend this by up to two further months; if we do, we will tell you within the first month and explain why. If we decide not to act on a request, we will tell you why within one month, and that you can complain to IMY or another supervisory authority, or go to court. Exercising your rights is free, but we may charge a reasonable fee for, or refuse, requests that are manifestly unfounded or excessive.

Some rights have limits. For example, we keep data that the law requires us to keep, and we may not make a change if we believe it would break the law or make the information inaccurate.

If we process your data as a processor for a customer, we will pass your request on to that customer where we can identify it. The customer is responsible for answering it.

Complaints. You have the right to complain to a supervisory authority. In Sweden, that is:

• Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection
• Box 8114, 104 20 Stockholm, Sweden
• imy@imy.se, +46 (0)8 657 61 00
• www.imy.se

You can also complain to the supervisory authority in the EU or EEA country where you live or work, or where you believe the infringement took place, and you can take the matter to court. We would welcome the chance to address your concern first, so please contact us at hello@sendpilot.ai.

Cookies and Consent

Our Website uses a consent banner from CookieYes. Necessary cookies, which keep the Website working and secure and remember your cookie choices, are always on. We set non-essential cookies, such as support-chat, analytics, session-recording and advertising cookies, only after you consent. When you choose to book a meeting with us, our booking page then loads Calendly's scheduler, which sets the cookies Calendly needs to make the booking.

You can change or withdraw your consent at any time through the cookie settings link on our Website. Withdrawing consent does not affect processing that took place before you withdrew it. You can also set your browser to refuse all or some cookies, or to alert you when cookies are being sent. If you block necessary cookies, some parts of the Website may not work properly.

Our Cookie Policy lists the cookies we use, what they do and how long they last.

Children Under the Age of 16

Sendpilot is a service for businesses and is not meant for children. We do not knowingly collect personal data about anyone under 16, and if we learn that we have, we delete it. If you think we hold such data, email hello@sendpilot.ai.

Your US State Privacy Rights

Privacy laws in some US states give their residents additional rights over their personal data. California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah and Virginia provide, now or in the future, rights to:

• confirm whether we process their personal data;
• access and delete certain personal data;
• correct inaccurate personal data, taking into account the nature of the data and the purpose of the processing (excluding Iowa and Utah);
• data portability;
• opt out of processing for targeted advertising (excluding Iowa), for sales, or for profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah);
• limit, or require consent for, the processing of sensitive personal data.

The exact scope of these rights varies by state, and some of these laws do not apply to personal data processed in a business or employment context. We do not sell workspace or integration data, but see Sale of Personal Data for two activities that some state laws may treat as a sale or as sharing, and how to opt out of them.

To exercise any of these rights, or to appeal our decision on a request, email hello@sendpilot.ai. We will not discriminate against you for exercising these rights.

Changes to Our Privacy Policy

We post any changes to this policy on this page and update the date at the top. If we make material changes to how we treat your personal data, we will tell you before the changes take effect, by email to the primary email address on your account or through a notice on our Website or in the Services.

Please keep the email address on your account up to date and active, and check this policy from time to time.

Contact Information

To ask a question or comment about this policy and our privacy practices, or to exercise your rights, contact us:

• Sendpilot AI AB (org. no. 559528-8447)
• Danderydsgatan 28A, 114 26 Stockholm, Sweden
• hello@sendpilot.ai