SimpleSend
Start free

Privacy Policy

Last updated: October 29, 2026

SimpleSend (“SimpleSend,” “we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, and security of personal information belonging to our users and to the individuals whose information our users process through the service. This Privacy Policy explains how personal information is collected, used, and disclosed when you use the SimpleSend website and application at simplesend.tech (including the free drafting demo), the SimpleSend Talk Tracks browser extension, and the SimpleSend connector for AI assistants (together, the “Service”).

We will not use or share your information with anyone except as described in this Privacy Policy. By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined here, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.

Our two roles. SimpleSend acts in two capacities. For your account data (registration details, billing information, usage records, and support conversations), SimpleSend is the data controller. For prospect and lead data that you upload, import, or collect through the Service (for example, a CSV upload, a lead list, a HubSpot list, people you find with lead search or import from a LinkedIn or Sales Navigator search, a contact captured from your CRM with our browser extension, the people you email or message through a campaign, and their replies), you are the data controller and SimpleSend acts as a data processor on your instructions. When you use the public drafting demo without an account, SimpleSend is the controller of what you enter there.

1. What information do we collect?

a) When you visit our website or sign up

  • Usage statistics: We track usage of our website and application, including which pages you visit, how long you view them, and how you interact with features. We use PostHog for product analytics and session replay, and Google Analytics for website traffic measurement; both load on every page of the website and the application. Text you type into input fields is masked in session recordings, but a recording can include other text shown on screen, such as the names and companies in your lists and the drafts the Service writes. When you are signed in, PostHog links these events to your account ID and email address.
  • Account details: If you create an account, we ask for your name, work email address, an optional phone number, how you heard about SimpleSend, your company, role, approximate team size, outreach goals, and expected sending volume. We use this to set up your workspace, personalize your experience, and send onboarding and transactional emails. We send your answer to “How did you hear about us?”, with your account ID and sign-up time but never your name or email address, to n8n, the workflow tool we use to report on where sign-ups come from.
  • Unfinished sign-ups: The sign-up form saves your details as you go. Once you enter a valid email address, we store it together with whatever else you have entered (name, phone number, company, how you heard about us, and the plan you chose), how far you got, and the referral code and campaign parameters described below, even if you do not finish signing up. We use this to follow up on unfinished sign-ups and to improve the sign-up process.
  • Campaign and referral parameters: If you arrive through a link that carries campaign parameters (such as utm_source) or an ad-click identifier (Google’s gclid, Meta’s fbclid, or LinkedIn’s li_fat_id), we keep them in your browser for that session and store them with your sign-up. If you arrive through an affiliate link (simplesend.tech/r/…), we set a cookie for 30 days that records the referral code; when you sign up, we record that code, the page you landed on, and the campaign parameters with your account. The affiliate sees only how many people signed up and how many became paying customers through their link, never who you are.
  • Free trials: To offer one free trial per person, we keep a normalized form of the email address that started each trial (for example, lowercased), including after the account is deleted.
  • Payment information: If you become a paying customer, your payment card information is collected and processed by our payment provider, Stripe, Inc. Card details are sent directly to Stripe and are never stored on our servers. We retain only billing metadata such as your subscription plan, status, and billing period. For team plans, Stripe also collects a billing address and, if you provide one, a tax ID, and we store the billing email address.

b) When you subscribe to updates on our public website

  • Contact details: If you subscribe to our blog or product updates, we collect your email address and the IP address from which you subscribed (used for abuse prevention).

c) When you use the Service

  • Uploaded prospect data: When you upload a CSV of leads, import a list from HubSpot, save people from lead search, import a LinkedIn or Sales Navigator search, or build a LinkedIn campaign, we store the prospect information you provide or select: typically names, job titles, companies, company websites, industries, locations, email addresses, phone numbers, and LinkedIn URLs. You are the controller of this data; we process it only to provide the Service.
  • Lead search: When you search for new leads, we send your search filters (such as job titles, seniority, locations, industries, and company names or sizes) to our lead-data provider (currently FullEnrich) and show the matching people’s names, job titles, companies, company domains, LinkedIn URLs, industries, and locations. If you describe the leads you want in your own words, that description is sent to our AI provider, Anthropic, to turn it into search filters. Results you do not save are deleted 48 hours after your search session goes idle, and we remember which people you have already been shown for 90 days so that later searches do not repeat them.
  • LinkedIn and Sales Navigator search imports: If you paste a LinkedIn or Sales Navigator search or lead-list address, the search runs through your connected LinkedIn account and we save each person’s name, job title or headline, company, LinkedIn URL, industry, and location to a lead list. We store the search address with the list.
  • Research data: To personalize your drafts, the Service gathers publicly available business information about the prospects and companies in your lists using web search (currently Tavily) and by reading public web pages. This may include company descriptions, the technologies a company uses, funding and product news, hiring signals, and public posts or articles. If you have connected a LinkedIn account, the Service also reads your prospects’ LinkedIn profiles through it (including their headline, about section, experience, education, and skills) and the LinkedIn pages of their companies. Profile details are kept for your connected account and deleted when you disconnect it; company pages are kept in a shared cache of public company information.
  • Contact enrichment data: When you use the lead-enrichment features, we send a contact’s name, employer, company domain, and LinkedIn URL to a contact-data provider (currently FullEnrich) to find a verified business email address and phone number. To avoid paying for the same lookup twice, results are cached for 30 days, and a result found for one customer may be returned to another customer who enriches the same person in that time.
  • Scheduled lead searches (Scout): Where Scout is enabled for your account, it re-runs saved lead searches and watches the companies you choose on a daily or weekly schedule. It reads company websites and careers pages, the public job boards those pages link to (Greenhouse, Lever, and Ashby), and news and web search results, and uses Anthropic to judge how well each person fits the profile you describe and to summarize company news. If you turn on the weekly digest, we email you a summary that can include the names, job titles, and companies of people it found. People you reject and the history of runs are deleted after 90 days.
  • Writing samples: If you paste examples of your past emails so the AI can match your voice, we store those samples in your account to generate your drafts.
  • Generated content: We store the email and LinkedIn message drafts, cold-call talk tracks, research findings, and campaign reports the Service generates for you, together with the talk-track playbooks you and your team create.
  • Team sharing: If you belong to a team, the lead lists, campaigns (with their contacts, research, and drafts), briefs, and talk tracks you create are shared with your teammates by default, and you can make any of them private. Team admins can also see records you have made private. Team admins can see each member’s email address, role, status, credit usage, and when they were last active, and every member can see how many lead credits each teammate has used. Your email and LinkedIn inboxes are visible only to you.
  • Browser extension data: If you install the SimpleSend Talk Tracks browser extension, it reads the contact record displayed on the CRM or dialer page you have open (specifically the contact’s name, email address, phone number, company, and job title) in order to identify who you are about to call. It runs on HubSpot and Salesforce Lightning, and on any other site (including the Zoho CRM, HighLevel, Nooks, Orum, Kixie, and PhoneBurner pages it supports) only after you turn it on for that site; it reads no contact details until you accept the disclosure shown in the extension. While its side panel is open, those details are sent to our servers to match the contact and show their talk track, and they are saved to your account only when you explicitly choose to save the contact. Page addresses are read on your device to recognize record pages and are not sent to us, with one exception: if you use “Map this page”, the site’s address (for example, https://crm.example.com) and the page-structure rules you create are saved to your team’s account so the mapping works for your teammates — never a contact’s details. If you select text on a page and choose to look it up from the extension’s right-click menu, or type a search into its side panel, that text (up to 200 characters) is sent to our servers to search your SimpleSend contacts and is not stored. If you log a call outcome, the outcome, any note you write, and your choice to stop the contact’s email sequence or add their address to your team’s do-not-email list are saved to your account. The extension stores locally in your browser: your SimpleSend session token so that you stay signed in, a cached copy of your team’s talk-track playbooks and of the rules for reading CRM pages so that matching works without a network round trip, the list of sites you turned it on for, your acceptance of the disclosure, and display preferences such as where the on-page prompt sits and whether it is hidden on a site. Contact details detected on a page are held in memory only and are never written to browser storage. When the extension syncs (about every 15 minutes), we record its version and the time of the last sync with your account, so that your team admin can see how many teammates have it connected. The extension contains no analytics, tracking, or advertising code, and reads no data from any site other than HubSpot, Salesforce, and the sites you turned it on for, apart from text you select and choose to look up from its right-click menu.
  • LinkedIn account connection: If you connect a LinkedIn account for LinkedIn campaigns, your LinkedIn login credentials (email, password, and, if you use one, a two-factor authentication secret or one-time code) are passed through, encrypted, to our LinkedIn automation provider (We-Link), which keeps them to keep your session signed in until you disconnect. SimpleSend does not store your LinkedIn password or two-factor secrets. We store connection metadata such as your LinkedIn profile name, headline, profile photo address, profile ID, account status, whether the account has LinkedIn Premium, and the connected email address. We-Link connects your account through a proxy located in the United States.
  • LinkedIn campaigns: When a LinkedIn campaign runs, SimpleSend uses your connected account, as you configure the campaign, to view each prospect’s profile, like one of their recent posts, send connection requests, messages, and InMail, and check for replies.
  • LinkedIn inbox: While a LinkedIn account is connected, SimpleSend receives and stores the messages that account sends and receives, as they happen, including conversations that are not part of a SimpleSend campaign, so you can read and answer them in SimpleSend and so a campaign stops when a prospect writes to you. For each conversation we keep the other person’s name, headline, and profile photo address, and for each message its text, time, and sender and the name, size, and type of any attachments, never the attachment files. When a prospect replies, we can email you a notification that includes their name, headline, and the start of their message. Messages are deleted after 180 days, and the whole inbox is deleted when you disconnect your LinkedIn account or when your SimpleSend account is deleted.
  • Sending infrastructure: If you set up email sending, you buy sending domains and mailboxes through SimpleSend. We collect the sender identity for each mailbox (first and last name, email signature, and an optional photo) and the registrant details a domain registration requires (name, organization, email, phone, and postal address), which we pass to our infrastructure provider, InboxKit, and through it to the domain registrar and to Google or Microsoft, who host the mailboxes. Sequences are sent, and replies read, through our sending provider, SendKit, which receives each recipient’s address, name and company and every message as it is sent. If an account is allowed to connect its own Google or Microsoft inbox, the sign-in happens on SendKit’s consent screen and SendKit holds the access it grants. SimpleSend never holds your mailbox passwords: the credentials we store for these connections are one-way hashes of webhook tokens and SendKit’s API key for your account, encrypted. Warmup traffic between your mailboxes and a warmup network is operated by InboxKit.
  • Sequences and sent email: When you launch a sequence, we store the recipients you enrolled (email address, name, employer, title, and any custom columns you mapped), the steps you wrote, and a copy of each message as sent. Message bodies are removed 365 days after sending; the record that a message was sent, and to whom, is kept with your account. Addresses that reply asking to stop, that bounce, or that you add by hand go on your suppression list so they are not emailed again from your team.
  • Email inbox: Replies to your sequences are read from your mailboxes and stored in SimpleSend so you can answer them. We keep the text, time, and sender of each message; message bodies and headers are removed after 365 days. Each human reply is classified by an AI model (for example, as interested, not interested, or an out-of-office), and you may ask the Service to draft an answer; see section 2 for how AI providers are used.
  • Open and click tracking: If you turn tracking on for a sequence, each message carries a tiny image and rewritten links. When a recipient’s mail client loads the image or the recipient clicks a link, we record the time, a salted one-way hash of the network address (the address itself is not stored), the browser or mail client’s user-agent string, which link was clicked, and whether the request looked automated. Tracking is on for a new sequence and can be turned off in its settings. Tracked links point at a tracking host on your own sending domain (for example, t.yourdomain.com), which you authorize us to configure, or at simplesend.tech until that host is active. When a recipient uses the unsubscribe link that every message carries, we record the request the same way.
  • Images in your emails: Images you add to a sequence step are stored at an unguessable public web address so that recipients’ mail clients can load them. Anyone with the address can view the image, so do not upload images you would not send to a recipient.
  • HubSpot connection: If you connect HubSpot, we store an access token (encrypted) with read-only access to your contacts and lists, and we import the lists you choose. We never write to your HubSpot account.
  • Custom columns: Any extra columns in a CSV you import are stored with each lead so they can be used as merge fields in your emails.
  • Server logs: We log requests made to the Service, which may include IP address, approximate location, browser type, and similar technical information, for security, rate limiting, and troubleshooting. Records of errors can include details of the request that failed, such as a recipient’s email address.
  • Usage metering: We record usage events (such as drafts generated, models used, how long each model call took, and credits consumed) to operate metered billing, enforce plan limits, and monitor performance.

d) When you contact us or support

  • Contact and support requests: If you reach out via our contact form, our support form, or email, we keep the conversation and anything you send during the exchange. For messages sent through our forms, we also store the IP address they were sent from (used for abuse prevention), and if you are signed in when you use the support form, we link the request to your account. We keep these messages as a record of our correspondence; when we delete your account at your request, we delete them within 90 days as well, unless we need them to resolve a dispute or meet a legal obligation.

e) When you try the drafting demo

The public demo at simplesend.tech/try writes a sample email and talk track without an account.

  • What you enter: a prospect’s name, company or website, and LinkedIn profile address (whichever you provide), a short description of what you sell, the tone you want, and the topics to research. To research the prospect, we send these details to Tavily for web search and read the public web pages of the prospect’s company, including to identify the software its website uses; we then send what we find, with your description, to Anthropic to write the sample. Please enter details about a person only if you have a legitimate business reason to research them.
  • What we keep: each demo run, with what you entered and what we found and wrote, for up to 30 days. To limit how many demos one visitor can run, we store a keyed one-way hash of your IP address (the address itself is not stored with the run) and set a cookie for 180 days that identifies your browser to the demo only. Cloudflare Turnstile checks that you are not a bot and receives your IP address.
  • Your email address: If you leave your email address on the demo, we store it with that run and in our sign-up records, and may use it to follow up with you about SimpleSend.
  • Starting a trial from the demo: If you start a trial from the demo results, what you entered is kept in your browser’s session storage and used to fill in your first campaign once you have signed up.

2. What do we do with your personal information?

As a data controller, SimpleSend collects your personal data fairly and lawfully and in accordance with applicable law (including the EU General Data Protection Regulation (GDPR), where it applies), our Terms and Conditions, and any data processing agreement in place. The main purpose of collecting personal data is to provide you with a safe, efficient, and personalized experience.

We may use your personal data to:

  • Provide the Service: When you create an account, you agree to our Terms and Conditions, which allow us to process your data so you can use SimpleSend: find and upload leads, run research, generate drafts, run LinkedIn campaigns, send email sequences from mailboxes you set up, invite team members and share records with them, and export your results.
  • Generate drafts and talk tracks with AI: We send relevant campaign inputs (your brief, writing samples, prospect details, and research findings) to our AI provider, Anthropic, to plan research, summarize the pages we read, and generate and quality-check your drafts. The same applies to talk tracks: when you request one, we send the contact’s name, company, job title, and industry, the research and notes we hold about them, your brief, any instructions you add, and the matching playbook from your team’s library to Anthropic to draft it. When you use the email inbox, the text of a reply is sent to Anthropic to classify it and, if you ask, to draft an answer. Anthropic also turns plain-language lead descriptions into search filters, as described in section 1(c). Your uploaded CSVs, writing samples, playbooks, and CRM contact data are not used to train AI models.
  • Provide customer support: To help you get full value from the Service and resolve any problems. A small number of SimpleSend administrators can view account details, usage, and sending status, and can sign in to an account as its user. They do so only to resolve a support request you have made, to investigate a security, abuse, or delivery problem, or where required by law. We record who started each such session and when it started and ended, and some actions, such as sending email or buying sending infrastructure, are blocked while an administrator is signed in as you. You can also give an administrator access to your account through their AI assistant, as described in section 9(i).
  • Understand where our customers come from: We use your answer to “How did you hear about us?”, campaign and referral parameters, and unfinished sign-ups to measure our marketing, credit referrals to affiliates, and improve sign-up.
  • Prevent fraud and abuse: We actively detect misuse of the Service, payment fraud, and abusive usage patterns (including rate limiting by IP and account).
  • Communicate product updates: We may let you know about new features and releases. You can opt out of these emails at any time.
  • Protect the Service: Any other function we believe in good faith is necessary to protect the security or proper functioning of the Service.

If we use collected data for another purpose, you will be informed at the time the data is collected and asked to accept.

Prospect data and lawful basis. Where our customers use SimpleSend to research and draft outreach to business prospects, the lawful basis for processing under the GDPR is legitimate interest: the interest of our customers in conducting business-to-business outreach using professional information that is publicly available or lawfully obtained. Prospect data enters the platform in three ways: imported directly by the customer (for example, via CSV upload or from their CRM); found by the customer through lead search in our data provider’s business-contact database or through their own LinkedIn and Sales Navigator searches; or supplemented by research and enrichment from our data providers based on the prospect details the customer supplies or selects. Where a customer launches a sequence, SimpleSend sends the customer’s messages from mailboxes the customer controls; the customer is the sender and decides who receives them. Every message tells the recipient how to stop further email, and a request to stop is honored across the customer’s team. Individuals may object to this processing at any time by replying to the message or by contacting us at hello@simplesend.tech. The customer controls what prospect data is uploaded, where exported drafts are used, and who is enrolled in a sequence, and is responsible for that use, including compliance with our Acceptable Use Policy.

Limited use of browser extension data. Data that the SimpleSend Talk Tracks browser extension collects is used only to provide the talk-track features you see in the extension. We do not sell it. We do not transfer it to others except as needed to provide those features (see the third-party services listed below) or where we are required to do so by law. We do not use it for advertising, and we do not use it to determine creditworthiness or for lending purposes. No human reads it except with your permission to resolve a support request, to investigate security or abuse, or where required by law.

3. How long do we keep your personal information?

We retain the personal information we process on behalf of our customers for as long as needed to provide the Service, in accordance with our Terms and Conditions. You can delete individual campaigns (including their contacts, research, and drafts) at any time from within the platform. To delete your account, contact us at hello@simplesend.tech. When your account is deleted, we remove your data within 90 days, except for limited records we retain for a reasonable period as necessary to pursue our legitimate business interests, conduct audits, comply with legal obligations (for example, billing and tax records), resolve disputes, and enforce our Terms and Conditions, and except for the free-trial record described in section 1(a).

Some records are removed on a schedule regardless of account status:

  • the bodies of sent and received email, after 365 days (subject lines and a short preview of each received message stay with the conversation);
  • open and click events, after 180 days;
  • webhook records from our email and LinkedIn providers after 30 days, and logs of our requests to them after 30 to 90 days;
  • LinkedIn messages, after 180 days (the conversation list keeps the other person’s name, headline, and a short preview of the latest message until you disconnect);
  • connector tool-call records, after 90 days;
  • unsaved lead-search results, 48 hours after the search session goes idle, and the record of which people you have been shown, after 90 days;
  • cached contact-enrichment results, after 30 days;
  • rejected Scout candidates and Scout run history, after 90 days;
  • public drafting-demo runs, after 30 days.

Disconnecting the browser extension removes the session token and the cached talk-track playbooks from your browser immediately, and uninstalling it removes everything it stored. Contacts you explicitly chose to save to your account, and the talk tracks generated for them, remain until you delete them or your account is deleted.

4. What third-party services do we use to process your personal information?

AI and research services

  • Anthropic, PBC (AI research planning and summaries, draft and talk-track generation, quality checks, reply classification, lead-search parsing, and the drafting demo)
  • FullEnrich (lead search in its business-contact database, and contact data enrichment: verified business emails and phone numbers)
  • Tavily (web research)
  • Public job boards hosted by Greenhouse, Lever, and Ashby (read for the open roles a company’s own website links to, used only by Scout)

IT and infrastructure services

  • Supabase, Inc. (database, authentication, and backend hosting)
  • Vercel, Inc. (web application hosting)
  • Cloudflare, Inc. (Turnstile bot protection on sign-up and the drafting demo; receives your IP address)
  • Resend, Inc. (transactional and notification email delivery)
  • n8n (workflow automation for our internal sign-up reporting; receives your account ID and your answer to “How did you hear about us?”)

Email sending infrastructure

  • InboxKit (domain registration, mailbox provisioning on Google Workspace and Microsoft 365, warmup, DNS, and the API through which sequences are sent and replies are read; used only if you set up email sending)
  • SendKit (sending sequence email, tracking delivery, reading replies, and connecting your own inbox when your account is allowed to; used only if you set up email sending)
  • Google LLC and Microsoft Corporation (mailbox hosting for the mailboxes you buy)
  • The domain registrar InboxKit uses for your domains

CRM connections

  • HubSpot, Inc. (read-only import of the contacts and lists you choose, used only if you connect HubSpot)

LinkedIn automation

  • We-Link (LinkedIn account connection, campaign automation, LinkedIn and Sales Navigator search imports, profile research, and the LinkedIn inbox, used only if you connect a LinkedIn account)

Analytics

  • PostHog, Inc. (product analytics and session replay)
  • Google LLC (Google Analytics: website traffic measurement)

Communication and scheduling

  • Calendly, LLC (demo scheduling; its booking widget loads when you open our contact page or the “Talk to sales” dialog)

Embedded content

  • Google LLC (YouTube videos, in privacy-enhanced mode; a video loads only when you press play, but its preview image loads from YouTube’s servers with the page)
  • Vimeo, Inc. (videos in some in-app product update notes)
  • Giphy, Inc. (animated images on some of our guides)

When your browser loads content from these services, they receive your IP address and browser information and may set their own cookies.

Financial services

  • Stripe, Inc. (payments)

5. What are your rights regarding your personal information?

Our Service stores prospect information on behalf of our customers. As a data processor of that information, SimpleSend has limited ability to act on it independently. If a SimpleSend customer has uploaded or captured your personal information into the Service and you would like it corrected, deleted, or no longer processed, the fastest path is to contact that customer directly; you may also contact us at hello@simplesend.tech and we will assist or forward your request.

If you received an email sent through SimpleSend, the sender is the SimpleSend customer named in the message, who must follow our Acceptable Use Policy. Replying to that message with a request to stop places your address on that customer’s suppression list. You may also contact us at hello@simplesend.tech: we will forward your request to the customer and, where the request is to stop receiving email, add your address to that customer’s suppression list ourselves.

To exercise any of the rights below, contact us at hello@simplesend.tech.

a) Right of access. You have the right to confirmation as to whether we process personal data about you and, where we do, to access a copy of it. As a customer, you can access your personal information through your account.

b) Right to rectification. You have the right to have inaccurate personal data corrected and incomplete data completed. As a customer, you can update your information at any time in your account settings, or by contacting us.

c) Right to erasure (“right to be forgotten”). You have the right to have your personal data erased without undue delay where it is no longer necessary, where consent is withdrawn, or where it has been unlawfully processed. As a customer, you can delete campaigns yourself in the platform and can request deletion of your account and personal data by contacting us. We permanently delete your data within 90 days of account deletion and confirm deletion requests in writing within 30 days.

d) Right to restriction of processing. You can ask us to limit how we use your data while a complaint or correction is being resolved.

e) Right to data portability. You have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format. As a customer, you can export your campaign data in CSV format from within the platform at any time, or request a copy by contacting us.

f) Right to object. You have the right to object at any time to processing based on legitimate interest, and to processing for direct marketing. If you object to receiving marketing from us, we will stop immediately; contact us or use the unsubscribe link in any email.

6. California privacy rights

If you are a California resident and the processing of your personal information is subject to the California Consumer Privacy Act (“CCPA”), you have certain rights with respect to that information.

  • Right to know. You may request that we disclose the personal information we have collected about you and additional information about our collection, use, and disclosure of it. Much of this is described in this policy. Submit a request at hello@simplesend.tech.
  • Right to request deletion. You may request that we delete your personal information, subject to certain exceptions. Submit a request at hello@simplesend.tech.
  • Right to opt out of “sales”/“sharing.” We do not sell personal information for money. Note that the CCPA defines “sell” and “share” broadly: our use of analytics providers (which collect identifiers such as IP addresses and cookie IDs) may qualify under those definitions. You may opt out by contacting us at hello@simplesend.tech or by disabling non-essential cookies.

You may designate an authorized agent to make requests on your behalf; we will require proof of authorization and may need to verify your identity directly. You also have the right not to be discriminated against for exercising these rights.

7. Choice / opt-out

If you subscribe to our updates, we will use your email address to send them to you. You may stop receiving marketing or update emails at any time by following the unsubscribe link included in every such email, or by contacting us at hello@simplesend.tech. Transactional emails (such as billing receipts, security notices, and password resets) are sent as needed to operate your account.

8. LinkedIn account connections

If you connect a LinkedIn account to use LinkedIn campaign features:

  • Your LinkedIn credentials are transmitted, encrypted, directly to our automation provider (We-Link), which keeps them, and your two-factor secret if you provide one, so it can keep your session signed in. SimpleSend never stores your LinkedIn password or two-factor secrets.
  • While the account is connected, SimpleSend stores the LinkedIn messages it sends and receives, including conversations that are not part of a SimpleSend campaign, as described in section 1(c).
  • SimpleSend is an independent product and is not affiliated with, endorsed by, or certified by LinkedIn. Automated activity on LinkedIn may be restricted by LinkedIn’s own policies; see our Terms and Conditions for details.
  • You can disconnect your LinkedIn account at any time from within the platform. This ends the automation session, asks We-Link to delete your stored credentials, and deletes your LinkedIn inbox and the profile details read through your account from SimpleSend.

9. AI assistants and the Model Context Protocol

SimpleSend can be connected to an AI assistant, such as Claude, through our Model Context Protocol (MCP) server. Once you connect, the assistant can call a fixed set of SimpleSend tools on your behalf, using your own SimpleSend account. This section describes that flow; it adds to, and does not replace, the rest of this policy.

a) What the assistant sends us

The assistant sends us only the arguments of the tools it calls. We do not receive your conversation with the assistant. Depending on the tool, those arguments can include:

  • Prospect details you ask it to save: first and last name, business email address, phone number, LinkedIn URL, job title, employer, company website, industry, and location.
  • Your campaign brief: what you sell, who you sell to, your value propositions, tone, call to action, any sample emails you choose to provide, and your email signature.
  • Free-text research instructions describing what you want us to look for.
  • Lead-search filters (such as job titles, locations, industries, and company names), or a plain-language description of the leads you want.
  • The email copy the assistant writes, which names the recipient.
  • The steps, schedule, and settings of a sequence, and which lead list to enroll.

Arguments that carry content become your data in your SimpleSend account, held on the same terms as information you enter in the web app.

b) What we send back

Tools return data from your own account: your lead lists and contacts, your campaigns, drafts and quality checks, exports, lead-search results, and the company research produced for your campaigns. No tool returns another customer’s account data. Some public company information, such as a short summary of a company’s public homepage and the software its website uses, is held in a shared cache keyed by website domain, so the copy you receive may have been produced for another customer’s research. That cache holds public web content only and is not linked to any account. Contact-enrichment results are also cached for 30 days, as described in section 1(c).

c) Third-party services involved

  • Anthropic, PBC. Used to plan research, summarise fetched pages, extract company dossiers, turn a plain-language lead description into search filters, and classify any notes you supply about a contact, which can include that contact’s first name, employer, and job title. If you ask SimpleSend to write the drafts itself, the drafting and quality checks also run here. If you have stored your own Anthropic key, these calls run on your key and under your own agreement with Anthropic. When the assistant writes the drafts, which is the default, SimpleSend makes no drafting call to any AI provider.
  • Tavily. Receives search query strings. Where your research instructions concern a person rather than a company, a query can contain that person’s name, job title, or LinkedIn URL.
  • Websites we fetch. Company research reads public web pages. Our requests identify themselves as SimpleSendBot and carry no personal information beyond the address being requested.
  • Supabase, Inc. Database, authentication, and backend hosting for the connector.

Connector tools reach the same providers the web app does for the same actions: lead search and enrichment tools use our lead-data provider, LinkedIn tools use our LinkedIn automation provider, and sequence tools send through our email sending infrastructure provider. No connector tool sends data to your CRM.

d) What we record about connector activity

We write one record per tool call, containing the tool name, the time, whether the call succeeded, an error code if it did not, the credits it consumed, how long it took, the IP address it came from, and a short one-way digest of the arguments. When a SimpleSend administrator makes the call through shared access (section 9(i)), the record also names that administrator. The arguments themselves are never stored in this record. We also store the IP address last used by each personal access key, and one rate-limiting record per request, which includes your IP address.

Our hosting providers’ operational logs may contain limited personal information, such as company names, record identifiers, the addresses of pages we fetched, and fragments of drafted copy. These logs are retained under those providers’ own schedules.

e) How long we keep it

  • Tool-call records: 90 days.
  • Rate-limiting records: 7 days.
  • Cached search results: 14 days.
  • Company research dossiers: 45 days.
  • Sent message bodies and inbox message bodies: 365 days.
  • Open and click events: 180 days.
  • Shared public homepage summaries: regenerated before they are used again once they are more than 30 days old, and kept as public web content.
  • Lead lists, contacts, campaigns, briefs, and drafts: no automatic deletion. They remain until you delete them or your account is deleted, as described in section 3.

f) Your own AI provider key

You may optionally store your own Anthropic API key so that model usage is billed to your account. It is encrypted at rest using AES-256-GCM. The encryption key is held as a server-side secret and is never stored in our database. Only the last four characters are shown back to you; the key is never displayed in full, never written to our logs, and never shared. We decrypt it in memory only to make the model calls you have asked for. You can remove it at any time from your profile, which deletes the stored key.

g) AI model training

We do not use your data, or the prospect data you process through the Service, to train AI models, and we do not provide it to any third party for that purpose. The requests we make to our AI provider carry no setting that permits training use. Where you have supplied your own provider key, your own agreement with that provider governs how your requests are handled.

h) Revoking access, and what revoking does not do

You can see every connection and personal access key on the Claude card in your profile, and revoke any of them at any time. Revoking stops further access immediately. Rotating a key instead leaves the previous key valid for 24 hours so that you can update your configuration.

Revoking access does not delete data. Lead lists, campaigns, and drafts created through the assistant remain in your account until you delete them, exactly as if you had created them in the web app. Deletion requests are covered in section 5(c).

i) Shared access for SimpleSend administrators

You can let a named SimpleSend administrator operate your account through their own AI assistant connection, either with full access or read-only, until a date you agree or until you end it. With full access they can do what the connector’s tools allow, such as building lists, running research, drafting, and launching campaigns and sequences, which can spend your credits; read-only access lets them see your lists, campaigns, sequences, and inboxes without changing or sending anything. They cannot change your password, email address, billing, or team, or see your keys. If SimpleSend set up your account for you as a managed account, full access is granted with the invitation, for 90 days by default, and we email you when it starts. You can see, and end at any time, every grant of shared access in the Shared access section of your profile, along with the tool calls made through it.

10. Do we use cookies?

A cookie is a small file placed on your device by a web server. Our website and Service use cookies and similar technologies, such as your browser’s local and session storage, to: (i) keep you signed in; (ii) remember your preferences; (iii) improve the quality of the site and Service; (iv) carry out traffic and statistical analysis via our analytics providers; and (v) attribute sign-ups to referrals and campaigns.

In particular, we use:

  • Browser storage that keeps you signed in (your session is held in your browser’s local storage rather than in a cookie);
  • Cookies set by Google Analytics and PostHog for audience and statistical measurement;
  • A referral cookie, set for 30 days when you follow an affiliate link, that records the referral code, and session storage that holds campaign parameters until you sign up;
  • A cookie, set for 180 days when you use the drafting demo, that limits how many demo runs one browser can make;
  • Browser storage that improves your browsing experience and stores your preferences (for example, remembering dismissed tips and tours).

Services we embed, such as Calendly, Cloudflare Turnstile, and YouTube, may set their own cookies when they load. You are free to block, delete, or disable cookies and site data in your browser settings; however, some areas of the Service (such as staying signed in) may not function properly if you do.

The browser extension does not use cookies. It stores only the items described in section 1(c) in your browser’s local extension storage, and it does not read the cookies of any site you visit.

The tracking image in sequence email is not a cookie and sets none; it is described in section 1(c).

11. How do we secure your data?

We take the security of the data we manage seriously. Measures include encryption in transit, row-level access controls so accounts can only access their own data and the records their team shares with them, masked inputs in analytics session recordings, credential pass-through (rather than storage) for LinkedIn connections, no storage of mailbox passwords (mail is sent through our provider’s API), a browser extension that keeps detected contact details in memory rather than writing them to disk, and delegation of card handling to a PCI-compliant payment processor. Access to production data is limited to what is necessary to operate and support the Service. Administrative changes to user accounts are logged, as are administrator sessions signed in as a user (see section 2) and administrator activity through shared access (see section 9(i)).

No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your information using industry-standard practices.

12. Children’s privacy

The Service is intended for business use by adults and does not address anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at hello@simplesend.tech and we will take steps to remove it.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page and updating the “Last updated” date. You are advised to review this Privacy Policy periodically. Changes are effective when posted on this page.

Contact information

Questions about this Privacy Policy should be sent to us at hello@simplesend.tech.