Privacy Policy

1. Two different roles, and which one applies

OneMoreSend handles personal data in two distinct ways, and the difference decides which rules apply.

As a business in our own right, we decide why and how we handle data about visitors to onemoresend.com and about the people who hold accounts with us. That is what this policy describes.

On behalf of our customers, we store and send to the contact lists that ecommerce stores bring to the platform. We act only on that store's instructions, we do not decide what happens to those contacts, and we do not market to them ourselves. If you shopped with a store and received an email or text from them, the store sent it and is responsible for that data, for having your consent, and for the products it sells. Ask the store, and their own privacy policy governs. To stop texts, reply STOP to the text; to stop email, use the unsubscribe link in it. Our handling of store data is set out in the data processing agreement we sign with every customer, not in this policy.

We do not sell, rent, or share mobile numbers or text messaging consent with third parties or affiliates for their marketing. Mobile numbers are shared only with the carriers and messaging providers that deliver a store's texts.

2. What we collect

When you visit the site. Pages requested, the approximate location implied by your IP address, referring page, and browser and device type. We keep this to understand what people need and to defend the service against abuse.

When you get in touch. Your name, email address, telephone number if you give one, the company you represent, and what you wrote.

When you open an account. The name, email address and role of each person who logs in; the registered legal name, trading name, postal address and website of the business; the identity and contact details of the person authorised to accept our terms; and, where you intend to send text messages, the business and campaign details the mobile carriers require before they will carry your traffic.

When you pay. Card and bank payments are processed by Stripe, and some older plans by Whop. Your card details go straight to the processor, which is certified to PCI DSS; we never see or store your full card number. We receive the billing name, email, and address, the last four digits and brand of the card, whether each payment succeeded, and the plan or usage it relates to. Stripe also uses payment details to prevent fraud, under its own privacy policy at stripe.com/privacy.

While you use the platform. Logs of actions taken in the dashboard, sending activity and its outcomes, and technical diagnostics. We use these to run the service, to investigate problems, and to show who changed what.

3. Why we use it, and on what legal basis

• To provide the service you asked for, including creating your account, sending on your instruction, and supporting you — performance of our contract with you.
• To take payment and keep accounts — performance of our contract, and our legal obligations around tax and record keeping.
• To keep the platform safe and deliverable, which includes monitoring bounce and complaint rates, investigating abuse reports, and screening for prohibited content — our legitimate interest in protecting the service and everyone else sending through it.
• To register your business with mobile carriers where you have asked us to enable text messaging — performance of our contract, and compliance with the rules that govern that channel.
• To tell you about the product, where you are a customer or asked to hear from us — your consent, or our legitimate interest in communicating with existing customers about a service they use. You can stop these at any time without affecting your account.
• To meet our legal obligations and to establish or defend legal claims — legal obligation and legitimate interest.

4. Who else sees it

We do not sell personal data, and we do not share it for anyone else's advertising. We use a small number of providers to run the service, each under contract and each only able to use data to do the job we gave them. The categories are:

• Cloud hosting and managed databases, which is where the platform runs.
• Email and text message delivery providers, which carry the messages you send.
• Payment processing, which handles your subscription.
• Error monitoring and logging, which tells us when something breaks.
• Google Analytics, when you allow it, to measure visits and demo inquiries on our marketing pages.

A current list of the specific companies, what each does, where it processes data, and the safeguard relied on for any international transfer, is maintained for customers and provided with the data processing agreement. We will tell account holders before adding a new one that handles contact data.

We will also disclose data where the law requires it, and to an acquirer if the business is sold, in which case we will say so before it happens.

5. Where it goes

We operate from the United States and our providers are primarily United States based. If you are in the United Kingdom, the European Economic Area or Switzerland, your data will be transferred outside that area. Where it is, we rely on the European Commission's standard contractual clauses together with the United Kingdom addendum, and we assess the destination before relying on them. Ask us and we will tell you which mechanism applies to a given provider.

6. How long we keep it

• Account records, for as long as the account is open and for six years afterwards, which is how long we may need them for tax and legal claims.
• Enquiries that do not become accounts, for two years.
• Sending records and delivery outcomes, for two years, because they are the evidence behind a deliverability dispute.
• Security and access logs, for twelve months.
• Suppression records, indefinitely, because the whole purpose of a suppression is that it is never forgotten.

Contact data belonging to a customer is deleted or returned when their agreement ends, on the terms in the data processing agreement.

7. Your rights

Depending on where you live you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, to receive it in a portable form, and to withdraw consent you previously gave. You may object to direct marketing at any time and we will stop.

If you are in California or another United States state with a privacy law, you may also ask what we have collected and who we disclosed it to, ask us to delete or correct it, and appeal if we refuse. We do not sell or share personal data as those laws define it, and we do not use it for cross-context behavioural advertising. We honour the Global Privacy Control signal where your state requires it. We will not treat you differently for exercising a right.

Write to privacy@onemoresend.com. We will respond within the time the law allows, normally a month. We may need to confirm who you are first. If you are unhappy with the outcome you can complain to your data protection regulator.

If your request concerns an email you received from a store that uses us, we will pass it to that store, because the data is theirs and only they can act on it.

8. Cookies and measurement

The dashboard sets a single cookie that keeps you signed in. It is strictly necessary, it is never used for advertising, and the service cannot work without it.

With your permission, we use Google Analytics on our public marketing pages to understand page visits, referring websites, demo-button clicks, and confirmed demo bookings. Google receives standard browser and device information and processes the connection's IP address to provide the service. We do not send names, email addresses, phone numbers, booking details, or customer workspace data to Google Analytics. Reported page URLs omit query strings and fragments, and we do not enable advertising personalization.

Google Analytics loads only after you choose “Allow analytics.” You can decline or withdraw permission using “Analytics choices” on our marketing pages. We store your choice in your browser. Changing it does not affect access to the site. Google's handling of data is described at How Google uses information from sites that use its services.

On our public pages only — the marketing site, the offer pages, these policies, and the pages you see after signing up — we run the Whop measurement pixel. Whop processes payments for some of our plans, and the pixel tells us which marketing a signup came from so we know what is worth doing again. It records the page visited and standard technical details such as browser, device and approximate location from your IP address, and it links a later purchase back to the visit that led to it.

It is deliberately absent from the signed-in dashboard. Nothing about your workspace, your campaigns or your contacts is visible to it. We rely on our legitimate interest in understanding how the business acquires customers, and where your local law requires consent for this kind of measurement we will ask for it before it runs.

9. Security

Data is encrypted in transit and at rest. Access to production is limited to the people who need it. Every customer's data is isolated at the database level so that one account cannot read another's, and that isolation is enforced by the database itself rather than only by application code. We keep audit records of changes made in the dashboard. No system is perfect; if a breach affects your data we will tell you and the relevant regulator within the time the law requires.

10. Children

The platform is sold to businesses and is not for children. We do not knowingly collect data about anyone under sixteen. If you believe a child's data has reached us, write to privacy@onemoresend.com and we will delete it.

11. Changes

We will post any change here and update the date at the top. If a change materially affects you we will tell account holders before it takes effect. The Terms of Service and the Acceptable Use Policy sit alongside this policy.

12. How to reach us

Write to hello@onemoresend.com for general questions, privacy@onemoresend.com about personal data, and abuse@onemoresend.com to report abuse of the platform.