This page is a draft awaiting Yorker Media's legal review. It describes how SendNeo works today; the binding terms are in the Terms and the Privacy Policy.
Our role
When you send email through SendNeo, you are the controller of your recipients' personal data — the addresses, names and message content you give us — and Yorker Media acts as your processor: we process that data only to deliver your email, report what happened to it and keep the service secure. For your own account details (your name, login and billing contact), Yorker Media is the controller.
Requests from the people you email
The owner or an admin of an account can answer a data-subject request under Settings → Privacy requests:
- Export downloads, as JSON, everything SendNeo holds for one address on that account: the emails sent to it (with their text while it is still kept, and without the other recipients' addresses), its delivery events, any audience contact record and its suppression status.
- Erase deletes the emails only that person received, their delivery events, webhook deliveries and contact records. On an email that also went to other people, their address and the email's body are removed and the other recipients' records stay. By default the address stays on the suppression list, so it is never emailed again; complaints always stay suppressed.
- Suppress adds the address to your suppression list without deleting anything. Nothing more is sent to it from your account, transactional mail included.
Every export and erasure is written to the account's audit log with a hash of the address, not the address itself.
How long we keep data
| Data | Kept for |
|---|---|
| Email bodies (HTML, text, attachments) | 30 days after sending |
| Email records and their delivery events | 90 days (copies of a broadcast stay with the broadcast) |
| Webhook delivery log | 14 days after delivery |
| Sign-in codes and password-reset emails | the body is cleared after one day |
| Account, domains, templates, suppression list | until you delete them or close the account |
Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Amazon Web Services (Amazon SES) | Email delivery | us-east-1 (N. Virginia, USA) |
| Leaseweb | Application servers and the database | Leaseweb data centres |
| Cloudflare | DNS and content delivery for the website and API | Global network |
| Dodo Payments | Billing, as merchant of record | — |
Data processing agreement
A data processing agreement (DPA) is available on request: write to hello@yorkermedia.com. We will tell you before adding or replacing a sub-processor.
Security
The measures we run are on the Security page.