sendroAI is committed to protecting personal data and respecting the privacy rights of individuals, including those located in the European Economic Area (EEA) and the United Kingdom. This page explains how we apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR, what our role is under those laws, and how you can exercise your rights.
This page should be read together with our Privacy Policy and Terms & Conditions.
1. Who We Are and Our Role Under the GDPR
sendroAI is an AI-powered sales outreach platform for founders, sales teams and growth teams. sendroAI is a brand owned by Omniagentic Innovations LLP, a Limited Liability Partnership registered under the Limited Liability Partnership Act, 2008, based in Pune, India. References to “we”, “us” and “our” mean Omniagentic Innovations LLP, which operates the sendroAI platform.
Under the GDPR, the organisation that decides why and how personal data is processed is the controller, and an organisation that processes data on the controller's behalf is the processor. Our role depends on the data concerned:
| Data | Role of sendroAI | Role of the customer |
|---|---|---|
| Account data of users (name, work email, billing details, login data) | Controller | Not applicable |
| Website visitor and marketing or analytics data collected through our website | Controller | Not applicable |
| Prospect and lead data uploaded or sourced by a customer for campaigns and related email activity | Processor, acting on documented customer instructions | Controller, responsible for having a lawful basis and complying with GDPR in its outreach |
Where we act as a processor, we process prospect data only to provide the service to the customer, under a Data Processing Agreement (DPA) that meets Article 28 of the GDPR. Customers who need a DPA can request one at hello@sendro.ai.
2. What We Do and Who We Serve
sendroAI provides B2B tools that help businesses research prospects, write and personalise outreach emails, send campaigns through the customer's own connected email accounts, manage follow-ups, and monitor replies and deliverability. Our typical customers are startups, SMEs, and sales and growth teams that sell to other businesses. We do not provide services directed at children or consumers for personal use.
Because outreach involves personal data of third parties, we design the product to support responsible outreach, including the ability to honour unsubscribe and opt-out requests, suppress contacts, and maintain sending-domain reputation controls.
3. Personal Data We Process
3.1 Data about our customers and users
- Identity and contact details: name, business email address, phone number, company name and role.
- Account and billing data: login credentials (stored securely), subscription plan and transaction references. Card details are handled by our payment provider and are not stored by sendroAI.
- Usage and technical data: IP address, browser and device information, log data and product usage events.
- Communications: support requests, feedback and correspondence.
3.2 Data about prospects (processed on behalf of customers)
- Business contact details: name, business email, job title, company and company website.
- Publicly available business information used for research and personalisation.
- Outreach records: emails sent, opens, clicks, replies, bounces, unsubscribes and suppression status.
We do not intentionally collect special category data (such as health, religion or political opinions) or data about criminal convictions, and customers must not upload such data to the platform.
4. Lawful Bases for Processing
| Purpose | Lawful basis (Article 6 GDPR) |
|---|---|
| Creating and managing your account; providing the service you request | Performance of a contract |
| Billing, invoicing and tax compliance | Legal obligation; performance of a contract |
| Security, fraud prevention, abuse detection and service reliability | Legitimate interests |
| Product analytics and improvement | Legitimate interests where they do not override your rights; consent for non-essential cookies |
| Marketing emails to you about sendroAI | Consent, or legitimate interests for soft opt-in to existing customers, with an easy opt-out in every message |
| Processing prospect data for a customer's outreach campaigns | Set by the customer as controller, typically legitimate interests supported by a documented assessment; sendroAI processes only on customer instructions |
| Responding to legal requests and enforcing our terms | Legal obligation; legitimate interests |
5. Sources of Prospect Data
Customers are responsible for the source of prospect data they bring to sendroAI. Prospect data may be supplied by the customer or obtained from publicly available sources or third-party data providers integrated into the platform. Customers must ensure they have a lawful basis for outreach and honour objections and removal requests received from recipients.
6. Email Outreach and Recipient Rights
- Every outreach email sent through sendroAI must include a clear way for the recipient to unsubscribe or opt out, and the platform honours unsubscribe requests across all of a customer's campaigns.
- Recipients who object to processing, or ask to be removed or have their data deleted, can contact the sender directly or write to us. We will forward and act on these requests in line with the customer's instructions.
- Customers must comply with applicable anti-spam and electronic marketing rules, including the EU ePrivacy Directive and national implementations, the UK PECR, and the CAN-SPAM Act where relevant.
7. Your Rights Under the GDPR
If you are an individual whose personal data is processed by sendroAI, you have the following rights:
- Right of access (Article 15): obtain a copy of your personal data and information about how it is used.
- Right to rectification (Article 16): correct inaccurate or incomplete data.
- Right to erasure (Article 17): ask us to delete your data, subject to legal exceptions.
- Right to restriction (Article 18): ask us to limit processing in certain cases.
- Right to data portability (Article 20): receive your data in a structured, machine-readable format.
- Right to object (Article 21): object to processing based on legitimate interests, including direct marketing, at any time.
- Right to withdraw consent (Article 7): where processing is based on consent, without affecting the lawfulness of earlier processing.
- Automated decision-making (Article 22): our AI features assist with drafting and prioritising outreach. They do not make decisions with legal or similarly significant effects on individuals without human involvement.
- Right to lodge a complaint: contact a supervisory authority, such as the data protection authority in your EU/EEA member state or the UK Information Commissioner's Office (ICO).
To exercise your rights, email hello@sendro.ai. We will verify your identity and respond within one month. This may be extended by two further months for complex requests; we will tell you why. If we process your data as a processor, we may refer your request to the relevant customer (controller), who will respond to you.
8. Data Security
We apply appropriate technical and organisational measures (Article 32 GDPR), including:
- Encryption of data in transit (TLS) and encryption of sensitive data at rest.
- Role-based and least-privilege access controls, with multi-factor authentication for staff accounts.
- Secure storage of credentials, including OAuth tokens for connected email accounts, scoped to the minimum permissions required.
- Logging, monitoring and periodic review of access and security controls.
- Staff confidentiality obligations and security training.
In the event of a personal data breach, we will notify the relevant controller without undue delay and, where the breach is ours as controller, notify the competent supervisory authority within 72 hours where required by Article 33 GDPR. We will inform affected individuals where the breach is likely to result in a high risk (Article 34).
10. International Data Transfers
sendroAI is based in India and uses service providers that may be located outside the EEA and UK, including in the United States and India. Where personal data of individuals in the EEA or UK is transferred outside those areas, we rely on appropriate safeguards under Chapter V of the GDPR, such as:
- the European Commission's Standard Contractual Clauses (SCCs) and, for the UK, the International Data Transfer Addendum or UK IDTA; and
- adequacy decisions where they apply, including the UK-US Data Bridge and EU-US Data Privacy Framework where a provider is certified.
Copies of the relevant safeguards are available on request.
11. Data Retention
| Data | Retention period |
|---|---|
| Account data | For the life of your account, then deleted or anonymised within 90 days after closure, unless longer retention is required by law. |
| Billing and invoice records | Retained for the period required under Indian tax and accounting law. |
| Prospect data and outreach records processed for a customer | Retained for the period set by the customer, and deleted when the customer deletes it or ends the contract, subject to the DPA. |
| Suppression and unsubscribe records | Retained as long as needed to honour the opt-out, on a suppression list so the person is not contacted again. |
13. Data Protection by Design, DPIAs and Accountability
- We apply privacy by design and by default, including data minimisation, purpose limitation and configurable retention.
- We carry out Data Protection Impact Assessments (DPIAs) where processing is likely to result in a high risk, including for new AI features that involve large-scale profiling or personalisation.
- We maintain records of processing activities (Article 30) and review our practices regularly.
14. Children
sendroAI is intended for business users aged 18 and over. We do not knowingly collect personal data from children under 16 (or the lower age set by local law).
15. Data Protection Officer and EU/UK Representative
Data Protection Officer: Johnsy George, hello@sendro.ai
EU Representative (Article 27): Johnsy George, hello@sendro.ai
UK Representative (Article 27 UK GDPR): Johnsy George, hello@sendro.ai
16. Changes to This Page
We may update this GDPR Compliance page from time to time to reflect changes in law, our services or our practices. The “Last updated” date at the top shows when it was last revised. Material changes will be notified to customers through the platform or by email.
17. Contact Us
If you have questions about this page or how we handle personal data, please contact us:
Email (all enquiries, including privacy, support and sales): hello@sendro.ai
Data Protection Officer: Johnsy George, hello@sendro.ai
Company: Omniagentic Innovations LLP (owner of the sendroAI brand)
Location: Pune, Maharashtra, India
