Privacy Policy

SplashSend is an email marketing service and a trading name of CKR Digital Limited, a company registered in England and Wales (company number 17290887). Our registered office is 135 High Street, Needham Market, Suffolk, IP6 8DH. We are registered with the Information Commissioner's Office under registration number ZC248757.

This policy explains what we do with personal information, in plain language. If anything is unclear, email hello@splashsend.com and a person will answer.

We have two roles, and it matters which one applies:

• Your account. When you sign up for SplashSend, we are the controller of the details we hold about you and your business.
• Your list. The people you email are on your list, and for their details we act as your processor: we store and use them only to run your account, on your instructions, under our Data Processing Agreement. If you are on somebody's list and want to know why, or want to be taken off it, the sender is the right person to ask, and every marketing email they send through us has an unsubscribe link that works straight away.

• Account details: your name, email address and password, your business name, brand colours, logo, website and postal address, and the settings you choose. We keep your password only in a scrambled form that can't be turned back into it. When you choose a password, we check it against Have I Been Pwned's list of passwords exposed in data breaches. We send only the first five characters of a scrambled form of it, which can't identify the password or you. If you sign in with Google, Google gives us your name, email address and profile picture. Your Google password stays with Google.
• Billing: your plan and payment status. Card details go straight to Stripe; we never see or store them. If you installed SplashSend from the Shopify App Store, Shopify bills you and we hold only your plan.
• What you put in: designs, campaigns, photographs, product details, forms, notes on the calendar, replies to our check-in emails, and anything you type into the product.
• From services you connect: when you connect a Shopify store we receive your customers' names, email and postal addresses, phone numbers, language, tags, email and texting consent, their orders and abandoned checkouts, and your product catalogue. When you disconnect, new data stops arriving. 48 hours after you uninstall the app from your store, its orders and products are deleted; the people it brought in stay on your list until you delete them.
• Automatically: the address and browser your requests come from, kept in server logs for security and rate limiting; when you sign in, and the address and browser of each sign-in, kept until that sign-in ends; and error reports (through Sentry) when something breaks, which can include your account id and the page you were on.
• Visit counts: Cloudflare Web Analytics counts visits to our website and app: which pages are viewed, the site that sent you, your type of browser and device, and your country. It sets no cookies, keeps nothing in your browser and is not linked to your account.
• Support: what you write to us in the app or by email, and our replies.

For the people on your list we hold what you give us or collect through your forms: names, email and postal addresses, the details you add, the consent record (when, how, and the address the sign-up came from), engagement (which emails were opened and which links clicked), the products they view on your website if you use our tracking script, orders and abandoned checkouts from a connected store, and answers to your forms. Where a connected store provides a phone number and texting consent we store those too, ready for a future SMS feature; nothing sends texts today.

• To run the service you signed up for (contract): storing your account, sending your emails, showing your reports, billing you.
• To keep the service safe and working (legitimate interests): security logs, rate limits, abuse detection, backups and error monitoring.
• To understand how our website and app are used (legitimate interests): visit counts that set no cookies and are not linked to you.
• To tell you about SplashSend (legitimate interests, as an existing customer): occasional product emails. We also see which links in these emails are clicked, to learn which emails help. Every one carries an unsubscribe link, and there is a switch under Setup in the app; account notices (sign-in codes, receipts, billing and closure) are separate and always sent.
• To meet our legal duties (legal obligation): tax and accounting records for billing.

We use the details of the people on your list only on your instructions: to deliver your emails, run your automations and show you what happened.

SplashSend's writing and design help, Cruise, the reviewer crew and check-in replies run on Anthropic's Claude models, called from our servers, in the United States. We send only what the job needs: your brand description and voice, product names, descriptions and pictures, your photographs and their tags, calendar notes and check-in replies, and the words of an email being written or reviewed. We do not send your list. The only details about the people on your list that can reach a model are ones you choose to put in front of Cruise yourself, such as a data set of form answers you switch on for it to read. Under Anthropic's commercial terms your content is not used to train their models, and we never use it to train anything. Every request is logged so we can see exactly what was sent; the text of those logs is kept for 30 days.

We do not sell personal information, and we do not share it with anyone for their own marketing. We share it only with the providers that run parts of the service for us, each bound by contract to use it for nothing else:

• Railway: application hosting and our database (EU, Netherlands).
• SMTP2GO: delivers the emails you send and the emails we send you (EU).
• Amazon Web Services: backup email delivery (London).
• Cloudflare: image hosting, bot protection on our forms, routing of replies and support email, rendering of email previews, counting visits to our website and app, and the nightly copies of our database (global; the database copies are stored in Western Europe and kept for 30 days).
• Anthropic: the AI models described above (United States).
• Stripe: billing (United States and EU).
• Sentry: error reports, and timing measurements from a sample of requests to our servers (EU, Germany).
• Pexels: stock photo search; receives only the words you search for.
• Google Fonts: when you pick a Google typeface for a form on your site, or in our image editor, the browser showing it fetches the font from Google.
• Shopify: when you connect a store, data flows both ways under Shopify's own terms.

The public data we can put into your emails, such as weather forecasts, public holidays and town names, involves no personal data. The full list, with what each provider processes, is in our Data Processing Agreement. We will also disclose information where the law requires it.

Every marketing email sent through SplashSend carries a tiny image that records when it is opened, and every link goes through us first so the click is recorded before the reader is sent on. That is how your reports work. People whose email app blocks images record no opens.

If you add our tracking script to your website, a link in one of your emails that leads to your site carries a token, and the script keeps it in the visitor's browser, on your site, so that product views and abandoned baskets can be matched back to the person on your list. On a Shopify store the script follows the store's own cookie banner and keeps nothing until the visitor allows marketing; on other sites you can set it to wait for your own banner. The script never creates a person from a visit; it only recognises someone already on your list. Forms you embed keep a small note in the visitor's browser so a pop-up someone has closed or filled in does not keep coming back. Your own website's privacy notice should mention these.

Our application and database run in the European Union, and backup email goes out from London. Some providers are in the United States or serve from around the world: Anthropic, Stripe and Cloudflare. For those we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

• While your account is open: everything in it, including the details and engagement history of the people on your list, and the consent records that show who said yes.
• When you close your account: it is scheduled for deletion 30 days later, and you can restore it at any point in those 30 days. After that everything is permanently deleted.
• If your account goes quiet: after a year with no sign-in, no emails sent and nobody new joining your list (or 90 days if the account holds no people at all) we email you a warning. If nothing happens in the next 30 days we schedule closure and email you again, and 30 days after that the account is deleted. Signing in at any point stops the clock.
• Logs: the text of AI requests for 30 days and the record that they happened for 180 days; product views from your site for 180 days; webhook delivery logs for 30 days.
• Copies of the emails you send: the full copy of each email, which its “view in browser” link shows, for 90 days. The record that it went out, with its opens and clicks, stays while your account is open.
• Backups: nightly copies of our database, used only to restore the service, each deleted automatically 30 days after it was taken. So deleted data can remain in a backup for up to 30 days after it has gone from the live service, and no longer.
• Support conversations: for as long as we need them to help you.

Data travels encrypted (TLS). Every record is tied to one account and every query checks it, so one customer can never see another's data. Access to our systems is limited to named staff. Secrets live in our hosting platform's environment store, never in code. We take nightly backups and monitor errors as they happen. No system is perfectly secure; if we ever have a breach that puts you at risk we will tell you and the regulator without undue delay.

You can ask us to show you the data we hold about you, correct it, delete it, give you a copy to take elsewhere, restrict what we do with it, or stop a particular use, and you can withdraw a consent at any time. Much of this you can do yourself: your details under Setup, your list as a download from People, and closing your account under Setup. For anything else, email hello@splashsend.com and we will answer within a month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

If you are on a customer's list, ask them first; they hold the relationship with you. If you ask us directly we will pass your request to them and help them answer it.

SplashSend is for businesses and is not aimed at anyone under 16. We do not knowingly hold an account for anyone younger.

When this policy changes we update the date at the top, and we let account holders know by email about anything material.

Email hello@splashsend.com, or write to us at CKR Digital Limited, 135 High Street, Needham Market, Suffolk, IP6 8DH.