Privacy Policy

1. Who We Are

SendOrchard ("we", "us", "our") is a private email service operated by SendOrchard GmbH, incorporated under the laws of Germany and headquartered in the European Union. We act as the Data Controller for the personal data described in this policy.

Our Data Protection Officer can be reached at dpo@sendorchard.com.

2. Data We Collect

We collect the minimum data required to operate the service:

• Account data: email address, hashed password, account creation date, and plan type.
• Email metadata: sender, recipient, timestamp, and message size. We cannot access the content of end-to-end encrypted messages.
• Usage data: login timestamps and IP addresses (retained for 7 days for security purposes).
• Payment data: Billing is handled by our PCI-DSS compliant payment processor. We do not store full card details.

We do not collect: browsing history, location data, device fingerprints, or any data for advertising purposes.

3. How We Use Your Data

We use your data solely to:

• Provide and maintain the SendOrchard email service.
• Protect the security and integrity of the service (spam prevention, abuse detection).
• Send essential service communications (e.g., billing receipts, security alerts).
• Comply with legal obligations under EU law.

We will never use your data for advertising, profiling, or any purpose not listed above. We do not sell your data to any third party.

4. Data Storage & Security

All data is stored exclusively on servers located within the European Union. We use industry-standard AES-256 encryption for data at rest, TLS 1.3 for data in transit, and OpenPGP for end-to-end encryption of email content.

Our infrastructure partners hold ISO 27001 and SOC 2 Type II certifications. Physical access to servers is restricted and monitored 24/7. We conduct regular third-party security audits.

5. Cookies

We use only essential cookies required to operate the service (e.g., session authentication tokens). We do not use advertising, tracking, or analytics cookies from third-party providers.

You can delete cookies at any time through your browser settings. Deleting session cookies will log you out of SendOrchard.

6. Third Parties

We share your data with third parties only when strictly necessary:

• Payment processors: To process subscription payments. They are GDPR-compliant and bound by Data Processing Agreements.
• Infrastructure providers: EU-based server operators bound by strict data processing agreements.

We do not use third-party analytics, advertising networks, or social media tracking pixels. We do not share data with governments unless compelled by a valid EU legal order, which we will challenge where legally possible.

7. Your Rights Under GDPR

As a resident of the EU or EEA, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and all associated data.
• Right to Portability: Export your emails in standard formats (MBOX, EML).
• Right to Restrict Processing: Limit how we use your data in certain circumstances.
• Right to Object: Object to processing based on our legitimate interests.

To exercise any of these rights, contact us at privacy@sendorchard.com. We will respond within 30 days. You also have the right to lodge a complaint with your national Data Protection Authority.

8. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• Your email content is deleted from our servers within 24 hours.
• Backups containing your data are overwritten within 30 days.
• Billing records are retained for 7 years as required by EU tax law.
• Anonymised, aggregated usage statistics may be retained indefinitely.

9. Contact & Data Protection Officer

For any privacy-related questions or to exercise your rights, please contact:

SendOrchard GmbH — Data Protection Officer
Email: dpo@sendorchard.com
Jurisdiction: European Union (Germany)

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email and by posting a notice on this page at least 30 days before any material changes take effect. The "Last updated" date at the top of this page will reflect the most recent revision.

Continued use of the service after the effective date constitutes acceptance of the revised policy.