sendroAI processes personal data in India in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), as they come into force. This page explains our role under the DPDP Act, how we support our customers in meeting their obligations, and how you can exercise your rights as an individual whose data is processed.
This page should be read together with our Privacy Policy, Terms & Conditions, our Data Processing Agreement (available on request), and our GDPR Compliance page.
1. Key Terms
| Term under the DPDP Act | What it means for sendroAI |
|---|---|
| Data Principal | The individual to whom personal data relates, such as a prospect whose business contact details a customer uploads to sendroAI. |
| Data Fiduciary | The person who decides the purpose and means of processing personal data. This is our customer for prospect data, and sendroAI for its own account, website and billing data. |
| Data Processor | A person who processes personal data on behalf of a Data Fiduciary under a valid contract. sendroAI has this role for prospect data processed on a customer's instructions. |
| Consent Manager | A registered entity through which a Data Principal can give, manage and withdraw consent. sendroAI does not act as a Consent Manager. |
2. Who We Are and Our Role Under the DPDP Act
sendroAI is an AI-powered sales outreach platform for founders, sales teams and growth teams. It is provided by Omniagentic Innovations LLP, based in Pune, India.
Our role depends on the data concerned:
| Personal data | sendroAI's role | Customer's role |
|---|---|---|
| Account, billing and login data of users who sign up to sendroAI | Data Fiduciary | Not applicable |
| Website visitor and analytics data collected through our website | Data Fiduciary | Not applicable |
| Prospect data uploaded or sourced by a customer for outreach campaigns, and related email activity | Data Processor, acting on the customer's documented instructions under a written contract | Data Fiduciary, responsible for the lawful basis, notices and consents required under the DPDP Act |
3. What We Process
3.1 Data about our customers and users
- Identity and contact details: name, business email address, phone number, company name and role.
- Account and billing data: login credentials (stored securely), subscription plan and transaction references. Card details are handled by our payment provider and are not stored by sendroAI.
- Usage and technical data: IP address, browser and device information, logs and product usage events.
- Communications: support requests and feedback.
3.2 Data about prospects (processed on behalf of customers)
- Business contact details: name, business email, job title, company and company website.
- Publicly available business information used for research and personalisation.
- Outreach records: emails sent, opens, clicks, replies, bounces, unsubscribes and suppression status.
We do not intentionally process children's personal data, and our services are not directed at children. Customers must not upload children's data, sensitive personal data or data about criminal convictions to the platform.
4. Notice and Consent
Under the DPDP Act, a Data Fiduciary must give a clear notice to each Data Principal before collecting personal data, and must rely on consent or another lawful ground set out in the Act. Because our customers decide how they reach prospects, the notice and consent obligations for outreach sit primarily with them. To help customers meet these obligations, sendroAI:
- requires customers to confirm that they have a lawful basis for the outreach they run, as set out in our Terms and Acceptable Use Policy;
- includes an unsubscribe or opt-out option in outreach emails sent through the platform;
- honours opt-outs across all of a customer's campaigns through a suppression list; and
- removes suppressed contacts from future sends.
Where sendroAI itself is the Data Fiduciary, for example for account and website data, we give notice and rely on consent or another lawful ground as the Act requires.
5. Purpose Limitation and Retention
We process personal data only for the purposes for which it was provided or as required by law. Where we act as a Data Processor, we process prospect data only to provide the service the customer has asked for. When a customer ends its subscription, we delete customer data within 90 days, unless longer retention is required by law. Suppression records are kept only as long as needed to honour an opt-out. Billing records are retained for the period required by Indian tax and accounting law.
6. Your Rights as a Data Principal
As an individual, you have the following rights under the DPDP Act:
- Right to access information about the personal data processed about you and the processing activities.
- Right to correction and erasure of inaccurate or incomplete data, and erasure of data no longer needed for its original purpose, subject to legal exceptions.
- Right to grievance redressal by contacting the grievance officer listed below.
- Right to nominate another individual to exercise your rights in the event of your death or incapacity.
- Right to withdraw consent at any time, with the consequences explained to you. Withdrawal does not affect processing carried out before it.
- Right to complain to the Data Protection Board of India if your grievance is not resolved, after first using the grievance process.
To exercise your rights, email hello@sendro.ai. We will verify your identity before acting. If your request concerns prospect data a customer uploaded, we will forward it to that customer, who is the Data Fiduciary, and may refer you to them for a response.
7. Security Safeguards
We apply reasonable security safeguards to prevent a personal data breach, as the DPDP Act requires, including:
- Encryption of data in transit (TLS) and of sensitive data at rest.
- Role-based and least-privilege access controls, with multi-factor authentication for staff accounts.
- Secure storage of credentials, including OAuth tokens for connected email accounts, scoped to the minimum permissions needed.
- Logging, monitoring and periodic review of access and security controls.
- Staff confidentiality obligations and security training.
8. Personal Data Breaches
If a personal data breach affects personal data we process, we will inform the affected Data Fiduciary without undue delay, so it can meet its obligations to notify the Data Protection Board of India and each affected Data Principal under the DPDP Act and DPDP Rules. Where sendroAI is the Data Fiduciary, we will make the notifications the Act and Rules require.
10. Cross-border Transfers
sendroAI is based in India. Personal data may be stored or processed outside India by sendroAI or its sub-processors. We do so only in ways permitted by the DPDP Act and any restrictions the Central Government may notify. We require our sub-processors to protect personal data to a standard no less than the DPDP Act requires.
11. Children
sendroAI is intended for business users aged 18 and over. We do not knowingly process personal data of children under 18. If we learn that we have processed a child's personal data, we will take steps to delete it. Processing children's data requires verifiable consent of a parent or guardian as the DPDP Act requires.
12. Significant Data Fiduciary Status
sendroAI is not currently notified as a Significant Data Fiduciary under the DPDP Act. If that status is notified to us, we will meet the additional obligations that apply, including appointing a Data Protection Officer based in India, carrying out periodic data protection impact assessments and audits, and complying with any data localisation requirements.
13. Grievance Officer and Contact
In line with the DPDP Act, we have appointed a grievance officer to answer your questions and resolve your complaints. Please contact them first before approaching the Data Protection Board.
Grievance Officer: Johnsy George, hello@sendro.ai
Email (all enquiries, including privacy, support and sales): hello@sendro.ai
Company: Omniagentic Innovations LLP (owner of the sendroAI brand)
Location: Pune, Maharashtra, India
We will acknowledge your grievance and respond within the time limit set by the DPDP Rules, 2025.
14. Changes to This Page
We may update this page to reflect changes in the DPDP Act, the DPDP Rules, or our practices. The “Last updated” date at the top shows when it was last revised. Material changes will be notified to customers through the platform or by email.
