Privacy Policy

CentricSell, Pune, Maharashtra, India, operates CentricSell Mail. We handle personal data in two roles:

• Controller for data about our customers: the people who sign up and use the Service.
• Processor for data our customers upload about their own recipients (contact lists, email addresses, message content). For that data, the customer decides why and how it is used; we process it only on their instructions to provide the Service. Recipients who want to exercise their rights should contact the sender, who can use the Service's tools to act on the request.

Contact for privacy questions: centricsell@gmail.com.

• Account data: company name, email address, password (stored only as a one-way hash).
• Billing data: plan and subscription status. Payment details go directly to Razorpay; we never see or store them.
• Security data: IP addresses of sign-ups, log-ins and form submissions, kept briefly for rate limiting and abuse prevention.
• Usage data: logs of API and dashboard activity needed to run, secure and support the Service.

We use this to provide the Service, secure accounts, bill paid plans, send service emails (such as email verification and password resets) and answer support requests. The legal bases are performing our contract with you and our legitimate interest in keeping the Service secure. We do not sell personal data and do not use it for advertising.

• Contacts and lists the customer uploads.
• Emails sent: recipient, sender, subject and delivery status. The message body is held only in the sending queue until it is delivered; campaign content is kept with the campaign until the customer deletes it.
• Delivery events: bounces, complaints and unsubscribes, plus opens and clicks on campaign email (via a tracking pixel and rewritten links). These record which email was opened or clicked and when - not the reader's IP address or device.
• Suppression lists: addresses that bounced, complained or unsubscribed, kept so they are not emailed again.
• Credentials for the customer's email providers and servers, stored encrypted (AES-256-GCM).

• Email logs: 90 days. Tracking and analytics events: 180 days. Usage records: 400 days (for billing).
• Suppression entries: until the customer removes them or closes their account - this is what keeps an unsubscribed person from being emailed again.
• Account data: while the account is open. When an account is deleted, all of its data is removed from the live database at once.
• Database backups: 14 days, after which deleted data is gone from backups too.

We use these service providers (sub-processors), each bound to protect the data:

Email is delivered by the providers each customer connects (such as Amazon SES, SendGrid or Mailgun). Those are chosen and contracted by the customer, not by us. Where data leaves the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

The dashboard uses one essential cookie, which keeps you signed in; it is not used for tracking. If the signup CAPTCHA is enabled, Cloudflare Turnstile may process technical data to tell people from bots. We use no advertising or analytics cookies.

Data is sent over encrypted connections and each customer's data is isolated in the database. Passwords are hashed; API keys are stored only as hashes; provider credentials are encrypted. Admin access requires two-factor authentication. If a breach affects your personal data, we will tell you without undue delay, as the law requires.

Depending on where you live, you can ask to access, correct, export or delete your data, object to or restrict its use, and complain to your data protection authority. Account owners can export their data and delete their account themselves under Settings in the dashboard (or via GET /v1/account/export). Deleting an account also cancels any paid subscription. To make any request, email centricsell@gmail.com or contact us.

If you received an email sent through CentricSell Mail, the sender is responsible for it - use the unsubscribe link in the email or contact the sender. You can also write to us and we will pass the request on, or erase your address from our systems while keeping a suppression record so you are not emailed again.

We will post changes here and update the date above; for material changes we will also email account owners.