FinchSend documents
Privacy policy
How FinchSend processes data, uses cookies and handles data subject rights.
Version dated
Service provider and account data controller
- Full legal name
- Ecom Mariusz Małachowski
- Registered / correspondence address
- ul. Poleska 23/6, 15-476 Białystok, Polska
- Tax ID and registration details
- NIP: 5432027712
- Contact, complaints and privacy
- biuro@brandstyle.pl
1. Who is responsible for your data
The operator identified above is the controller of data relating to your FinchSend account, support correspondence and billing. Contact the operator about privacy and data requests using the contact details provided.
If you receive a campaign from a FinchSend customer, that sender is generally your data controller. FinchSend processes their list and sends messages on their behalf. Ask the sender about the source of your address, grounds for marketing and retention periods. This policy does not replace the sender’s privacy notice or a data processing agreement.
2. Data we process
Account data: email address, optional name, a secured password hash, account creation and verification dates, permissions and status. Email verification uses a time-limited token stored in the database as a hash.
User materials: contact email addresses and first names, verification and unsubscribe statuses, import information, campaign content, sending domains, forms and uploaded images. Sending history includes recipient addresses, statuses, dates, message identifiers and error information.
Billing and correspondence: Stripe customer and subscription identifiers, selected plan, payment period and status, and support messages. DPA acceptance records include controller and representative details, verified account email, date, version and preserved agreement text as evidence of conclusion. Technical data, including IP addresses, may be processed when handling requests, preventing abuse and in infrastructure logs. FinchSend does not store full card details.
3. Purposes and legal grounds
Account creation and operation, service features and subscriptions are processed to enter into and perform the contract (Article 6(1)(b) GDPR). Tax, accounting and other statutory duties rely on Article 6(1)(c) GDPR.
Protecting the service from abuse, handling correspondence not directly related to the contract, and establishing, pursuing or defending claims may rely on the operator’s legitimate interests (Article 6(1)(f) GDPR), taking individuals’ rights into account.
Where a purpose requires consent, it is obtained separately and can be withdrawn. Senders determine the legal grounds for their recipient lists, marketing and campaign measurement. Creating an account or reading this policy does not constitute marketing consent.
4. Campaign measurement and unsubscribing
Campaign messages may contain an open-tracking pixel and individual redirect links that record clicks. Events are associated with a campaign and recipient and record the event type, time and, for clicks, the destination URL. The sender can see this information in reports.
The service also records delivery, delay, bounce, spam complaint and unsubscribe events. The application does not determine recipient geolocation. Mail privacy features and automatic link scanners may affect results.
The unsubscribe link lets you leave that sender’s list. This blocks future campaigns to the contact but does not automatically delete historical records or recall messages already handed to the provider. Contact the sender about measurement, objections or data deletion.
5. Providers and data recipients
Resend handles email sending and delivery events and receives the data needed to deliver messages, including recipient addresses and message content. Stripe handles payments and subscriptions and processes payment data according to its role and privacy documentation.
Hosting, file storage, technical support and accounting providers may access data needed for their tasks. Data may also be disclosed to authorised bodies where required by law. Campaign library images are served through public URLs so email clients can display them.
To be completed before adopting this policy: the actual hosting provider and region, the full processor list and their roles, and data protection officer contact details if one has been appointed.
6. Transfers outside the EEA
International providers may process data outside the European Economic Area. Such transfers require an appropriate legal basis, such as an applicable adequacy decision or standard contractual clauses and additional safeguards where necessary.
To be completed before adopting this policy: processing countries, the transfer mechanism for each provider and how to obtain a copy of safeguards. Choosing a European server region should not be assumed to eliminate all international transfers.
7. How long data is kept
Account data and materials are processed for the duration of the service. After it ends, only data still required for statutory duties, settlement or claims may be retained for the period resulting from applicable law and limitation periods. Recipient data is also subject to the sender’s instructions and data processing terms.
A verification link expiring after 24 hours does not automatically delete an unverified account. Removing a contact from a list does not automatically remove their address from all historical sending and event records.
To be completed before adopting this policy: specific retention periods and deletion procedures for unverified accounts, campaign history, correspondence, logs and backups, and deletion deadlines after account closure. The operator must confirm that these procedures are actually carried out.
8. Cookies and browser storage
FinchSend uses cookies to maintain login sessions, protect requests and handle return navigation after login. The admin_locale cookie remembers your language for up to one year. Blocking essential authentication cookies may prevent you from signing in.
A pop-up form embedded on a customer’s website may remember its dismissal in browser storage. That website’s operator is responsible for providing information and determining any consent requirements for this mechanism.
The current FinchSend website does not include third-party advertising analytics scripts. Email campaign measurement is described separately above. When you proceed to Stripe, Stripe’s privacy and cookie information also applies. Introducing additional optional tracking requires updated information and consent where required by law.
9. Your rights
Subject to the GDPR’s conditions, you can request access and a copy of your data, correction, deletion, restriction and portability. You can object to processing based on legitimate interests and can object to direct marketing at any time.
You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can complain to Poland’s Personal Data Protection Office (uodo.gov.pl) or another competent supervisory authority.
Send requests about your FinchSend account to the operator and requests about a newsletter list to its sender. Proportionate identity verification may be needed. Requests are generally answered within one month; any extension permitted by the GDPR and its reasons must be communicated within that period.
10. Optional data, automated decisions and updates
Providing data is voluntary, but an email address and password are needed to create an account, and information required at checkout is needed to purchase a plan. The registration name field is optional.
FinchSend does not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Automatic security and sending-eligibility checks support service operation.
This policy is updated when features, providers or legal requirements change. The version date appears at the beginning. The operator communicates material changes as appropriate to their scope.