Privacy statement.

1. Who we are

This website is operated by OneMinded, the company behind SendSafe. OneMinded is the controller for the personal data described in this statement.

Company

OneMinded B.V.

Address

High Tech Campus 5, 5656 AE Eindhoven, the Netherlands

Chamber of Commerce

97404829

General contact

info@sendsafe.ai

Data protection

privacy@sendsafe.ai

2. What this statement covers

This statement applies to visits to this website, the contact and pilot forms, the risk check and its report, and the waitlist for individuals. How personal data is processed when an organisation uses the SendSafe product is set out in the agreement with that organisation, together with a data processing agreement where one is required.

3. Which data we process, and why

Contact and pilot forms

When you use the form on the contact page, including for a demo request, we receive the details you enter: your name, work email address, company, team size, your role, the AI tools you select, an optional message and, if you came from the pricing page, the plan you were looking at. If you choose the waitlist for individuals there, we use your details only for that waitlist.

When you request a pilot, we receive your company, work email address, your role, company size, sector, the AI tools in use, which kinds of data your teams handle, who leads the project and when you could start.

Each form has one unticked box. By ticking it, you allow OneMinded to contact you about your request, by email and, if you add your number, by phone (Article 6(1)(a) GDPR). The phone number is optional. We store it only with that consent, and we use it to call you about your request. You can withdraw your consent at any time via privacy@sendsafe.ai.

From your answers on these forms and on the risk check report form, we calculate a fit score (A, B or C) and a short qualification of your request (fit, need, role and timing). We use these only to decide how we follow up your request. If you tick a box for updates about SendSafe, we also email you about SendSafe every few weeks, on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw that consent at any time through the link in the email or via privacy@sendsafe.ai.

We use these details only to respond to your request, arrange a demo or pilot and, where relevant, prepare a proposal. The legal basis is taking steps at your request before entering into an agreement, and our legitimate interest in following up on business enquiries (Article 6(1)(b) and (f) GDPR).

If you arrived through a link with origin details (source, utm_source, utm_medium, utm_campaign, utm_content or, from a report or email, rid, band and route), we also store those values with your request. We use them only to see which links and campaigns lead to enquiries, on the basis of our legitimate interest in knowing that (Article 6(1)(f) GDPR).

A booking link goes through sendsafe.ai/book. On the same basis, we count there how often each link label (utm_content) is clicked. That count holds only the label and the number, no IP address and no personal data.

Risk check

Your answers in the risk check stay in your browser until you request a report. The link for sharing your result contains only option numbers, no personal data. When you request the report, your answers and your first name, work email address and, if you add them, your organisation and phone number go to OneMinded to create the report. The box on that form covers this report, a few emails (at most five) and, if you add your number, a call about your result. The download link for the report works for 7 days.

Every report request gets a report code (rid). We keep it with your request, together with the result of the check (low, medium or high) and the route that goes with it. If the result is medium or high and you added your number, that is our reason to call you.

Email

If you email us, we process your email address, the content of your message and any details you choose to include, to answer your question. The legal basis is our legitimate interest in responding to enquiries.

Technical data

When you visit the website, your browser shares technical data such as your IP address, browser type and the pages requested. Our hosting provider, Vercel Inc., may record this in server logs to deliver and secure the website. The legal basis is our legitimate interest in running a secure website.

The fonts on this website are served from our own domain, so your browser does not connect to Google Fonts or any other font service.

Visitor statistics

We use Vercel Web Analytics to see how the website is used as a whole: which pages are visited, which website a visitor came from, the approximate location (country, region and city), and the device type, operating system and browser. It sets no cookies and stores nothing on your device. Visits are counted with a hash of the incoming request that is discarded after 24 hours, so we cannot identify you or follow you across other websites. We only see aggregated numbers. The legal basis is our legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR).

4. Who receives your data

We store form submissions with Upstash, in their EU region (Frankfurt). Upstash is a US company. Any access from the US is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

A 20-minute call you book runs through Microsoft Bookings, in OneMinded's Microsoft 365 environment. Microsoft then processes your name, email address, the time you choose and, if you fill them in, your phone number and notes. The booking link also carries a reference (RefID) with the label of the link, the result of the risk check, the sector and the report code, so we can connect the booking to your request.

Emails reach OneMinded at info@sendsafe.ai. We use service providers only where needed to run this website and to respond to you, and we do not sell personal data.

Vercel hosts the website and processes the visitor statistics described above on our behalf. Vercel is based outside the European Economic Area. For this transfer we rely on appropriate safeguards, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.

5. Cookies and local storage

This website sets one functional cookie and uses no statistics, tracking or advertising cookies. The visitor statistics described in section 3 store nothing in your browser.

• ss-lang is a cookie that remembers the language you chose with the language switch. It is set only when you use that switch, is kept for one year and goes along with your requests to this website, so the home page can open in your language (Path=/, SameSite=Lax, and Secure over https).

If you open the home page without that cookie, the server looks at the country of your IP address and your browser's first language to decide whether to open the Dutch version. That step sets no cookie.

The website also keeps two small preferences in your browser. They stay on your device and are never sent to us:

• ss-theme remembers whether you chose the light or dark look (local storage, kept until you clear it);
• ss-pre remembers that you have seen the opening animation, so it plays once per visit (session storage, removed when you close the tab).

We use these only to remember choices you make and to keep the website working as you expect, which is why there is no cookie banner. You can remove them at any time by clearing the site data in your browser. If we ever add other cookies, we will update this statement first and ask for your consent where the law requires it.

One value does travel with a form: ss-origin remembers the origin details from the link you arrived through, if it has any, so they are still there if you look around first (session storage, removed when you close the tab). We receive them when you submit a form or click a booking link. With such a click we keep only the count from section 3, and the reference from section 4 goes along to the booking page.

6. How long we keep data

We keep data you leave with us (contact form, pilot request, risk check report, demo request) for up to 24 months after the last contact. Business contact details we collected ourselves to approach you are kept for at most 6 months if no contact follows.

7. How we protect data

We take appropriate technical and organisational measures to protect personal data against loss and unauthorised access, and limit access to the people who need it to respond to you.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data erased;
• restrict or object to processing, including processing based on our legitimate interest;
• receive your data in a structured, commonly used format.

To use these rights, email privacy@sendsafe.ai. We respond within one month. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

9. Changes

We may update this statement, for example when the website changes. The version date at the top shows when it was last changed.