Privacy Policy

Effective date

March 18, 2026

1. Introduction

This Privacy Policy explains how Sendpaper ("we", "us", "our") collects, uses, shares, and protects information when you:

Visit our marketing website (for example, sendpaper.io)
Create an account for our hosted service
Use our software to share documents, run data rooms, and view engagement analytics

If you use Sendpaper in a self-hosted environment (for example, your organization runs it on your own infrastructure), then your organization controls the processing of information and is responsible for its own privacy disclosures. This Privacy Policy applies to the hosted Sendpaper service we provide, unless a specific section says otherwise.

This policy also covers how we handle information related to "Viewer" activity. When you use Sendpaper to share content with others, you are responsible for telling those recipients how you use their information and for selecting and communicating your own privacy practices. Sendpaper processes Viewer information on your behalf, under your instructions and our customer agreements.

Not legal advice. Please have your legal counsel review and approve this draft before publishing.

2. Who this policy is for

This Privacy Policy applies to:

Customers and their administrators (people who create or manage Sendpaper accounts)
Users at customer organizations (people who access data rooms and document links)
Viewers (people who open or view shared content)
Visitors (people who browse our website but do not create an account)

3. The information we collect

We collect information in the following categories.

A. Account and contact information

When you create an account, we may collect information such as:

Name
Email address
Organization and job title (if you provide it)
Billing information needed to operate subscriptions (handled by our payment processor)

B. Content and content-related metadata

When you upload documents or create data rooms and share links, we process:

The documents and files you upload
Folder and link structure (for example, what you grouped and how you organized sharing)
Settings you configure, such as passwords, link expiry, view-only mode, download permissions, watermarking, and screenshot protection options

We may also process technical metadata created while using the service (for example, file format information and processing logs needed to deliver documents to authorized recipients).

C. Viewer engagement and access events

Sendpaper can show engagement analytics for shared links and data rooms. Depending on your configuration, we may collect and process information such as:

When a link or document was opened
Viewing and interaction timestamps
Pages or sections viewed (for example, for page-by-page analytics)
In-document search activity (for example, search queries and matches within an opened document)
Device and approximate location inferred from IP addresses (used for analytics and security)
Whether the viewer viewed content or downloaded it (based on your settings)
Security and access control signals related to your configured viewing protections (for example, events that are blocked)

Viewer engagement information is typically provided to customers who share the content. Sendpaper does not market viewer behavior as a standalone product; instead, we help customers understand engagement for the content they choose to share.

D. Communications and support

If you contact us (for example, via support or our contact form), we may collect:

Your message and the information you submit
Contact details so we can respond
Records of requests and support interactions

E. Automatically collected technical information

When you use the service or visit our website, we may collect:

IP address and approximate location
Browser type and version
Device type and identifiers
Request and error logs
Interaction and usage telemetry used to operate, secure, and improve the service

F. Cookies and similar technologies

We may use cookies, pixels, and similar technologies to:

Operate authentication and session management
Measure traffic and engagement on our website
Detect security events and prevent abuse
Improve features and user experience

You can control cookies through your browser settings and, where applicable, cookie consent tools on our website.

4. How we use information

We use information to:

Provide, operate, and maintain the Sendpaper service
Process content and deliver documents to authorized recipients
Enforce sharing controls you configure (for example, passwords, expiry, and view-only access)
Generate engagement analytics and reporting for customers
Provide customer support and respond to requests
Send operational notices, account updates, and security-related communications
Process billing and manage subscriptions
Protect security, prevent fraud, and enforce our policies
Improve and develop the service using aggregated and de-identified insights (where appropriate)

For information processing on the basis of applicable law, we may rely on one or more lawful bases, such as performing a contract, legitimate interests, or consent.

5. How we share information

We do not sell your personal information.

We may share information in the following cases.

A. Sharing with your organization or you

Customers can view engagement reporting for content they share through Sendpaper. If you are a customer administrator or user, you can typically access the information your organization generates through the service.

B. Sharing with service providers

We use third-party vendors to operate and support the service, such as:

Cloud infrastructure and hosting
Support and customer relationship systems
Security and monitoring tools
Payment processing services
Analytics services

These vendors receive information only as needed to perform services for us and are obligated to protect it.

C. Compliance and legal requests

We may disclose information if we reasonably believe it is necessary to:

Comply with applicable law or legal process
Respond to lawful requests by public authorities
Protect the rights, safety, and security of Sendpaper, our customers, and others
Enforce our Terms and policies, including investigating suspected abuse

D. Business transfers

If we participate in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

6. Use of customer content

Sendpaper customers and organizations control what content they upload, store, and share through Sendpaper. We do not use your customer content for our own independent purposes (for example, marketing it or using it as a general commercial asset).

We process customer content only as needed to:

Provide the Sendpaper service you request and to deliver it to authorized recipients
Enforce the sharing and access controls you configure (for example, passwords, expiry, and view-only access)
Generate engagement analytics and reporting that your organization requests through the service
Maintain system stability, security, and integrity
Comply with applicable law and respond to lawful requests

We may also analyze content-related metadata (for example, file size, access logs, and processing logs) to operate and secure the service.

7. Data retention

We retain information for as long as needed to:

Provide the service and maintain your account
Comply with legal obligations
Resolve disputes and enforce agreements
Maintain security and prevent abuse

For customer content and associated engagement records, retention depends on account status and any deletion or retention settings available through the service. If you request account deletion, we will take reasonable steps to delete or de-identify information where required and appropriate.

We may retain certain records for a longer period if we need them for legitimate business or legal purposes.

8. International data transfers

Your information may be processed in countries other than your own. Where required by law, we use appropriate legal mechanisms to transfer data internationally.

Sendpaper may process data in multiple regions to provide performance and availability. Where data residency options are available, we process data in the region you select, subject to contractual and operational constraints.

By using the hosted Sendpaper service, you understand that your information may be transferred and processed for the purposes described in this policy.

9. Security

We use administrative, technical, and organizational controls designed to protect information. This may include encryption in transit and at rest, access controls, and monitoring.

No method of transmission or storage is 100 percent secure, so we cannot guarantee absolute security. If you have security concerns, contact us using the "Contact us" section below.

10. Cookies and analytics on our marketing website

On our website, we may use analytics tools to understand usage and improve content. Where required by law, we provide cookie and tracking choices. You can control cookies through your browser settings.

If you disable cookies or certain tracking technologies, some site features may not work as intended.

We do not respond to "Do Not Track" signals in the same way across all browsers. If you prefer to reduce tracking, use browser privacy settings and cookie preferences.

11. Your rights and choices

Depending on your location and applicable law, you may have rights such as:

Access to the personal information we hold about you
Correction of inaccurate information
Deletion of information (where applicable)
Restriction or objection to certain processing
Data portability (where applicable)

To make a request, contact us at support@sendpaper.io. We may ask you to verify your identity before responding.

If you are a Viewer and your personal information is processed because a customer shared content with you, then you may be able to exercise requests through that customer as well. Sendpaper processes viewer information on the customer's behalf, so your customer may control access and instructions related to the content.

12. Children's privacy

Our service is not intended for children under 18. If you believe a child has provided information to us, please contact us at support@sendpaper.io so we can review and take appropriate action.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and change the effective date at the top of this page.

14. Contact us

For questions about this Privacy Policy, requests to exercise rights, or security concerns, email support@sendpaper.io.

If you are a customer and need a data processing agreement, contact us and we will provide the appropriate documentation.