Privacy Policy

Definitions

Personal Data: Any information that identifies or relates to an identified or identifiable individual (sometimes called “personal information” under certain laws such as the CCPA/CPRA).

Client Data: Personal Data and other information about your Clients that you (the User) input into the Service (e.g., contact details, invoices, notes, communications). You act as the data controller of Client Data; SendWork processes it on your instructions.

User: The individual or business entity registered to use the Service.

Client: A customer of the User.

Sell and Share (CPRA): “Sell” means disclosing Personal Data to a third party for monetary or other valuable consideration. “Share” means disclosing Personal Data for cross-context behavioral advertising. We do not sell or share Personal Data as those terms are defined under the CCPA/CPRA.

Information We Collect

When you use the Service, we collect several types of information from you or about you. The categories of information we collect include:

How We Use Data

We use Personal Data and Client Data to:

Provide and Operate the Service: To deliver the features and functions of our platform, set up your account, authenticate you, and ensure technical performance.

Maintain, Improve, and Develop our Service: To analyze usage trends and fix bugs. We may use de-identified data to develop new features and services, including AI-driven tools.

Communicate with You: To send transactional communications (e.g., confirmations, alerts, legal notices) and, with your consent, for marketing purposes.

Facilitate Payments and Financial Operations: To process payments and keep records of transactions for accounting and reporting tools.

Customer Support: To assist you when you contact us with questions or issues.

Security and Fraud Prevention: To maintain the security of the Service, monitor for suspicious behavior, and investigate fraud.

Legal Compliance and Enforcement: To comply with legal requirements and to establish, exercise, or defend our legal rights.

Aggregated and De-Identified Data: We may aggregate or de-identify Personal Data for research, data analysis, and marketing purposes.

Automated Decision-Making & AI: We use AI-assisted features to help classify data, suggest actions, or generate content. These features are designed to assist Users; final decisions remain with you. We do not use Client Communications to train public models. Where third-party AI processors are used, they act as our service providers under contract.

We do not sell or share Personal Data as defined by the CCPA/CPRA. We also do not use or disclose sensitive Personal Data for purposes beyond those permitted by the CPRA (e.g., providing the Service, security, short-term transient use).

Data Sharing

We only share Personal Data in the ways described below, and with appropriate safeguards in place:

With Your Direction or Consent: We share your information with third parties if and when you expressly instruct or consent to us doing so.

Service Providers: We employ third-party companies to perform business functions on our behalf, such as hosting, payment processing (e.g., Stripe), and communication delivery services. These providers are contractually obligated to use the data only for our purposes.

Legal Compliance and Protection: We may disclose Personal Data if we believe such action is necessary to comply with the law, respond to legal process, enforce our rights, prevent fraud, or protect the safety and rights of any person.

Business Transfers: In the event of a merger, acquisition, or sale of company assets, your information may be transferred as part of that transaction.

Aggregated or De-Identified Data: We may share aggregated or anonymized data with third parties for various business purposes, which do not contain any Personal Data that can identify you or any individual.

Data Roles and Responsibilities

SendWork as Data Controller: SendWork acts as the Data Controller for Personal Data that we collect about you and decide how to use (for example, account creation and usage data).

SendWork as Data Processor: SendWork acts as a Data Processor for Client Data that you input into the Service. We process this data only on your behalf and under your instructions, and you are responsible for ensuring you have a lawful basis to do so.

Data Processing Addendum: Where required, our relationship with Users is governed by a Data Processing Addendum (DPA). We also maintain a Subprocessor List identifying third parties that process Personal Data on our behalf and provide notice of material changes.

Legal Bases

Where required (e.g., EEA/UK), we process Personal Data under one or more legal bases: (i) performance of a contract (to provide the Service); (ii) legitimate interests (e.g., to maintain and improve the Service, secure our platform, prevent fraud); (iii) consent (for certain marketing or optional features); and (iv) legal obligations (record keeping, compliance). You may request details on how a specific processing activity maps to a legal basis by contacting us.

Data Retention

We retain Personal Data only as long as necessary for the purposes described in this Policy or as required by law. Typical periods include: account/profile data for the life of the account plus up to 24 months; transactional and invoicing records up to 7 years (accounting/tax); security logs generally up to 12 months unless needed longer for investigations; backup media for limited cycles consistent with our disaster recovery policies. After retention, data is deleted or irreversibly de‑identified.

Data Security

We implement administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit and at rest, hardened infrastructure, least‑privilege access controls, and audit logging. No system is 100% secure; you are responsible for safeguarding credentials and enabling available security controls (e.g., strong passwords, role permissions).

International Transfers

Personal Data may be processed in the United States or other jurisdictions where we or our subprocessors operate. For EEA/UK data transfers, we rely on approved mechanisms such as Standard Contractual Clauses (SCCs) and (where applicable) the UK Addendum, plus transfer impact assessments and supplementary safeguards (e.g., encryption, access controls) when appropriate.

Cookies and Tracking

We use cookies, web beacons, and similar technologies for authentication, session continuity, analytics, feature usage metrics, and optional personalization. See our Cookie Notice for categories (e.g., essential, analytics), purposes, and retention. You can manage non‑essential cookies through browser settings and, where provided, our cookie preference center.

Data Subprocessors

We engage carefully vetted subprocessors (infrastructure, analytics, email delivery, payment processing) under written agreements requiring appropriate security, confidentiality, and data protection commitments. A current Subprocessor List is maintained and material changes are notified in advance where legally required.

Your Rights

Depending on your jurisdiction, you may have certain rights regarding your Personal Data, including:

The right to access, correct, or delete your Personal Data.

The right to object to or restrict certain processing.

The right to port your data to another provider.

The right to withdraw consent (where processing is based on consent).

To exercise your rights, contact privacy@sendwork.com. We may request information to verify your identity (or the authority of your agent). Where applicable law provides an appeals process, you may appeal our response by replying “Appeal” to our decision email.

Regional Addenda

The following supplemental disclosures apply where required by local law. If a jurisdiction-specific provision conflicts with another part of this Policy, the jurisdiction-specific provision controls to the extent necessary for compliance.

• United States (California): CCPA/CPRA rights include: (i) know/access categories & specific pieces of Personal Data; (ii) correction & deletion (subject to exceptions); (iii) opt-out of any “sale” / “sharing” (we do not sell/share); (iv) limit use of sensitive Personal Data (only allowed purposes); (v) non‑discrimination. Exercise via privacy@sendwork.com (appeal by replying “Appeal”).
• EEA & United Kingdom: Rights of access, rectification, erasure, restriction, portability, objection, consent withdrawal. Complaints may be made to your supervisory authority. Representative details (if appointed) will be published on our website.
• Canada: Nothing here limits rights under PIPEDA or provincial privacy / consumer statutes. Access & correction rights preserved; complaints via Office of the Privacy Commissioner or provincial authority.
• Brazil: LGPD rights—confirmation, access, correction, anonymization/deletion, portability, information on sharing, consent withdrawal, objection (when applicable), review of automated decisions. Complaints to the ANPD.
• Australia & New Zealand: Compliance with Australian Privacy Act 1988 (APPs) and New Zealand Privacy Act 2020; statutory consumer guarantees & access/correction rights cannot be waived.
• Local Law Prevails: Mandatory privacy or consumer rights in your jurisdiction apply and prevail over conflicting terms.

Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect Personal Data from children under 16. If we become aware of such data, we will delete it.

Changes to This Policy

We may update this Privacy Policy periodically. If material changes are made, we will notify you by email or in-Service notice at least 30 days before the new version takes effect. Continued use of the Service after the effective date constitutes acceptance.