Privacy Policy

For customer account data (your login, organisation, billing) and for data collected on this marketing site, ASTRA Digital Solutions LTD is the data controller.

For end-viewer data captured through a gate, the customer who published the gate is the controller and SendClaw acts as their processor: we collect, store, and forward that data on their instructions. If you submitted a form on a gated page and want your data corrected or deleted, the publisher of that page is your first point of contact. We also action requests sent to us directly at privacy@sendclaw.io.

Customers are responsible for having a lawful basis to collect lead data through their gates and for their own privacy notices to their visitors. A data processing agreement (DPA) is available on request from hello@sendclaw.io.

When you submit a gate form, we collect the form fields the publisher asks for. Depending on how the gate is configured these can include:

Every visit to a public share page records technical data used for lead attribution, the publisher's view analytics, and abuse prevention:

Account email, name, and organisation details, managed through our authentication provider Clerk. If you upgrade to a paid plan, payment is handled by Stripe: your card details are collected by and stored with Stripe and never touch our servers. We hold only your billing status and a reference to your Stripe subscription. We also collect product usage analytics inside the app dashboard (via PostHog, configured without cookies) so we can improve the service. We do not run product analytics scripts on public share pages.

We send account holders two kinds of email: service emails about your account and content (welcome, lead notifications, link expiry and billing notices), and optional product emails such as usage summaries and tips tied to your activity. Every product email includes an unsubscribe link; service emails are sent only where necessary to run the service.

All customer and lead data is stored in Supabase Postgres in eu-west-1 (Ireland). Uploaded documents are stored in Supabase Storage in the same region. Data is encrypted in transit and at rest, every table is protected by row-level security, and file access goes through expiring signed URLs.

We do not transfer lead data outside the UK or EEA except to the subprocessors listed below, under appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision.

End-viewer data is forwarded to the publisher who collected it, including to destinations the publisher configures: their CRM or other systems via webhooks, their Slack workspace, and a notification email. IP addresses are never included in webhook payloads or notification emails.

Beyond the publisher and the subprocessors below, we do not sell, rent, or share customer or lead data with anyone, we do not use it for advertising, and we do not train AI models on your content or your leads.

We rely on the following providers to run the service:

Lead data, including incomplete form submissions, is retained until the publisher deletes it or closes their account, after which it is removed within 30 days. For incomplete submissions that are never finished, the IP address and browser details we collected are removed automatically after 30 days; the contact details remain so the publisher can follow up. When a lead is deleted, the view activity linked to it (including IP address and user agent records) is deleted with it.

Customer account data is deleted within 30 days of account termination, after the export window described in our Terms of Service.

We set only first-party cookies that are strictly necessary to make the service work. We set no advertising cookies, no third-party tracking cookies, and no analytics cookies anywhere, which is why you do not see a cookie consent banner.

Under the UK GDPR and the EU GDPR you have the right to access, correct, export, delete, and restrict or object to the processing of your personal data. Customers can export all lead data and delete individual leads self-serve from Settings, and can email us for anything else.

Submit any request to privacy@sendclaw.io and we will respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to your local supervisory authority in the EU.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we hold about you, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information beyond what is necessary to provide the service. We will never discriminate against you for exercising these rights. Residents of other US states with similar laws have the equivalent rights. Requests to privacy@sendclaw.io.

SendClaw is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data through a gate, contact privacy@sendclaw.io and we will delete it.

We will post any changes on this page and update the date at the top. For material changes affecting customers we will give notice by email before they take effect.

Data controller: ASTRA Digital Solutions LTD, trading as SendClaw, registered in England and Wales. For any privacy question or request, email privacy@sendclaw.io.