Privacy policy

1. Controller

Fabian Faraz Farid, sole proprietor trading as “LuminaX”, Richard-Wagner-Straße 137, 41065 Mönchengladbach, Germany. Email: [email protected]. No data protection officer is appointed, as the requirements of Art. 37 GDPR and § 38 BDSG are not met.

2. Two roles: provider and processor

We are the controller for visits to this website, customer accounts, billing and support, which this policy covers. Contacts, consent records and newsletters that our customers manage and send in Sendmora are processed on behalf of the respective customer (Art. 28 GDPR). The customer as sender is the controller, and our data processing agreement applies. Newsletter recipients should contact the sender first. We forward any requests we receive.

3. Visiting the website

When you open the pages, our host Contabo (servers in Germany) and the upstream service Cloudflare process technically necessary data: IP address, time, requested address, browser and operating system. This is needed to deliver the pages and fend off attacks (Art. 6(1)(f) GDPR). We keep the logs only as long as needed for operation and defending against attacks; after that they are overwritten automatically.

4. Cookies and analytics

Necessary storage (your cookie choice, your language) relies on § 25(2) no. 2 TDDDG. Only if you agree in the banner do we use PostHog Cloud EU (servers in Frankfurt) to measure which pages are viewed and which elements are clicked. Form inputs are never captured and sessions are not recorded. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time on the cookies page. We use no advertising trackers.

5. Free tools

• The double opt-in generator, cost calculator and migration check run in your browser. Your inputs are not sent to us.
• For the sender check we send the domain you enter to our server, which queries public DNS records. We do not store the domain or the result. To prevent abuse we briefly count checks per IP address in memory (Art. 6(1)(f) GDPR).

6. Reports under the Digital Services Act

Through the report content form we process the reported address, the reason, your explanation and, if provided, your name and email. The purpose is to review the report and inform you of our decision. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA. We keep reports for handling and as proof and delete them 12 months after handling is completed. We only share your details with the affected customer if this is necessary for the review and nothing speaks against it.

7. Customer account and contract

For your account we process email address, name, company, role, password only as a hash or sign-in links, settings and logs of important actions (for example send approvals). For billing we add billing address, VAT ID if any, plan and usage. Payment details are processed only by Stripe. The legal basis is the contract (Art. 6(1)(b) GDPR) and, for accounting, statutory retention duties (Art. 6(1)(c) GDPR).

System emails such as sign-in links, invitations and billing notices are sent through Resend. Newsletters are never sent through Resend.

8. Credentials for migrating from another provider

When you start a migration, you give us access to your account at your previous provider, either as an authorisation by sign-in (OAuth token) or as an API key. The only purpose is to transfer contacts, status, fields, tags, suppression lists, consent records and, where available, past issues to Sendmora. We store these credentials encrypted with AES-256-GCM, with the key kept separately from the database. As soon as the migration finishes or is cancelled, we delete the credentials. The legal basis is the contract (Art. 6(1)(b) GDPR). We recommend revoking the access at your old provider afterwards as well.

9. AI writing help

The AI writing help (subject lines, shortening, tone, translation) uses Claude by Anthropic. It only runs when you explicitly call it for a text. We then send that text excerpt, never contact lists. Under its API terms Anthropic does not use the data for training. Results are labelled as AI suggestions and only go into an issue after your approval. The legal basis is the contract (Art. 6(1)(b) GDPR). For the transfer to the USA see section 11. Under its terms, Anthropic generally deletes API inputs and outputs within 30 days, except where a breach of its usage policies is suspected.

10. Service providers

We use the following providers. Data processing agreements or equivalent data protection terms are in place with all of them.

11. Transfers to third countries

Some providers are US companies or belong to one (Cloudflare, Amazon, Anthropic, Resend, Stripe, PostHog). Where data may reach the USA, we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) if the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR). The database and newsletter sending run in Germany and the Frankfurt region.

12. Retention

We keep account data for the term of the contract. After the contract ends the data stays exportable for 14 days and is then deleted, unless statutory retention applies (invoices up to ten years). Backups are overwritten on a fixed schedule; deleted data disappears from them after 12 months at the latest. Migration credentials are deleted when the migration finishes.

13. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR), and you can withdraw consent with effect for the future. Write to [email protected]. You can lodge a complaint with a supervisory authority, for example the data protection authority of North Rhine-Westphalia (LDI NRW).

No automated decision making within the meaning of Art. 22 GDPR takes place. Automatic sending pauses (too many bounces or complaints) are reviewed by a human before an account is locked.

14. Changes

We update this policy when services or the law change. The version with the date above applies. Privacy contact: [email protected], abuse: [email protected].