Privacy Policy

This policy explains what personal data JustSendIt collects, why, and what we do not collect. It covers the JustSendIt website, the JustSendIt web application and the JustSendIt MCP server.

1. Controller

Simon Tautz, sole proprietor, trading as JustSendIt Albert-Roßhaupter-Straße 70, 81369 München, Germany Email: simon@justsendit.ai · Phone: +49 151 65140425

We have not appointed a Data Protection Officer and are not required to under Art. 37 GDPR or § 38 BDSG.

2. The one thing worth reading first

JustSendIt is a zero-persistence relay. When you connect a mailbox or messaging account and read or send messages through JustSendIt — from the app or from an AI assistant over MCP — the content of those messages is not stored on our systems. There is no message database, no search index and no content cache. Messages pass through in memory to serve your request and are then discarded.

What we do store is the data needed to run accounts, permissions and billing, listed in section 5.

Three honest caveats:

• Your AI assistant is not us. If you use JustSendIt from Claude, ChatGPT or another agent, message content you retrieve is transmitted to that assistant's provider and is governed by their privacy policy. We have no control over what they retain.
• Our upstream provider does persist. Unipile, the API we relay through, holds the OAuth credentials for your connected accounts and processes message content on its own infrastructure. See section 7.
• Zero-persistence applies to message content, not to metadata. We record that an action happened — see the audit trail in section 5.3.

3. Legal bases

4. Who we process data about

• Website visitors — see sections 4.1 and 6.
• Customers and their users — sections 5.1 to 5.4. Both consumers and businesses use JustSendIt; the same rules apply to both.
• The people our customers contact. For that data we are a processor, not a controller, and our customer decides everything. See section 9.

4.1 Server logs

Our hosting providers record IP address, timestamp, user agent, requested route, referrer and response status for every request. This is technically unavoidable and is used for security and debugging on the basis of Art. 6 (1)(f) GDPR. Retention: 30 days at most, and in practice whatever shorter period the provider's own log retention allows.

5. What we store

5.1 Account and workspace data

• Email address and an authentication credential (passwords are stored only as a hash by our identity provider; we never see the plaintext)
• Workspace name, membership records, invitations you send to collaborators
• If you request access before signup: your name, email address, requested plan and the decision/verification state. After a redeemed request is removed, the admission ledger keeps only a one-way or random reference needed to prove that access was granted.

5.2 Connected account data

• The provider (e.g. Gmail, LinkedIn) and the provider-side account identifier
• A pseudonymous handle derived by keyed hash (HMAC), used to bind an account to your workspace — we deliberately avoid storing your mailbox address in plaintext where a derived identifier will do
• Connection status, capability snapshots and lifecycle records
• Which permissions and skills you have granted to which AI client

We never receive or store the OAuth tokens or passwords for your connected accounts. Those are held by Unipile (section 7).

5.3 Usage, billing and audit data

• Subscription plan, entitlements and usage counters (call counts, connected-account counts) — counts, not content
• Audit events: who did what, when, from which client — action type, timestamp, actor, and result. An audit event records that a message was sent, not what it said. Retained for 12 months, then deleted.
• Payment status. Card details never reach us — see section 7.

5.4 What we do not store

• Message bodies, subjects, attachments or drafts
• Contact lists or address books
• Credentials for your connected accounts
• Special-category data under Art. 9 GDPR. We never ask for it. If it appears inside message content it passes through the relay without being retained.

6. Cookies, consent, analytics and advertising

6.1 Consent management

Consent is managed through CookieCrumbs (cookiecrumbs.eu), a consent-management platform. Its banner script is loaded from app.cookiecrumbs.eu and its configuration is retrieved from the CookieCrumbs backend; like every retrieval of a file from a server, both transmit your IP address. When you make, change or withdraw a choice, a consent receipt is recorded with the CookieCrumbs backend on our behalf as evidence of the consent (Art. 7 (1) GDPR): your decision per category, a random consent ID generated in your browser, the version of the consent texts shown, your regulatory region and the time. The receipt contains no name, no email address and no account identifier, and the consent ID is not used for measurement or advertising.

Your decision is additionally mirrored into the first-party cookie jsi-consent (section 6.2), which is what our measurement stack and our server-side conversion reporting obey. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.

The banner offers accepting and refusing with equal prominence as single clicks, plus a choice per category. Refusing is exactly as easy as accepting, and nothing is pre-selected.

Before you consent, no information is stored on your device and no information already stored there is read, beyond what is strictly necessary (§ 25 (2) TDDDG): the consent platform keeps your decision and a cache of its own configuration in your browser's local storage, which is exactly what makes the decision enforceable on your next visit. No analytics or advertising cookies are set and no advertising identifiers are transmitted before your decision. One exception concerns load order only -- the tag container itself -- and is described in section 6.3.

6.2 Strictly necessary cookies

These cookies and local-storage entries are required to operate the site and do not require consent under § 25 (2) TDDDG.

6.3 Tag management (Google Tag Manager)

We use Google Tag Manager (Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland; parent: Google LLC, USA) to manage the services listed in section 6.4 and to enforce your consent decision technically.

The tag container loads before you have decided. This is technically necessary because the container is what holds every measurement and advertising tag at "denied" until you decide (Google Consent Mode v2). The container itself sets no cookies, reads no information stored on your device and transmits no advertising identifiers. Retrieving the container file does transmit your IP address to Google, which is unavoidable whenever any file is requested from a server.

Because no information on your device is accessed, § 25 (1) TDDDG is not engaged. The legal basis for processing your IP address is our legitimate interest in being able to deliver measurement and advertising tags under consent control at all, Art. 6 (1)(f) GDPR.

6.4 With your consent only

Analytics (Google Analytics 4) and advertising are separate choices in the banner. Declining advertising while accepting analytics leaves the advertising services in the table above entirely inactive, and the reverse holds too.

These services set cookies and similar identifiers on your device, transmit your IP address, and can link your visit to an existing account you hold with the provider. Google and Meta process this data partly in the United States. For Google we operate Google Consent Mode v2; no analytics or advertising identifiers are set before your decision.

The jsi-attr cookie is written only after you consent to advertising cookies, and is deleted if you withdraw. Until then the click identifiers exist for that page view only and are not stored.

#### Conversions sent from our server (Meta and OpenAI Conversions APIs)

Some events are reported to Meta and to OpenAI by our server rather than by your browser. This is necessary because the two events that matter most — a trial starting and a payment settling — are confirmed to us by our payment provider hours or days after you leave the site, when no browser of yours is involved at all.

So that such a conversion can still be matched to the advertisement you clicked, and only if you have consented to advertising, we store the following at the moment you start a checkout, and transmit it to Meta when the corresponding event occurs:

• the Meta click and browser identifiers described above (_fbc, _fbp), and the equivalent OpenAI references (oppref, obref)
• your email address as an irreversible SHA-256 hash, never in plain text
• your IP address and browser user agent
• the plan, amount and currency of the checkout

If you have not consented to advertising, none of this is stored and nothing is transmitted. It is deleted after 90 days, the longest period over which these platforms attribute a conversion to a click; after that it can no longer serve its purpose. Each event is reported once per platform: a subscription's renewals are not reported again, and telling one platform does not stop or duplicate the other.

Both the browser and the server copy of one event carry the same identifier, so Meta recognises them as a single event rather than counting it twice.

Joint controllership. For the collection and transmission of data by the Meta Pixel, we and Meta Platforms Ireland Ltd are joint controllers under Art. 26 GDPR on the basis of Meta's Controller Addendum. Meta's subsequent processing for its own purposes is Meta's sole responsibility. You may exercise your data subject rights against either of us; Meta is the more effective address for its own processing.

Risk disclosure. Transfers to the USA carry the residual risk that US authorities access the data without you having an effective legal remedy. By consenting you also consent to that transfer under Art. 49 (1)(a) GDPR, in addition to the safeguards below.

7. Recipients and processors

Not every recipient above is a processor. Google classifies Google Analytics and Google Tag Manager as processor services, which act on our instruction under the Google Ads Data Processing Terms; Google Ads is a controller service and Google decides its own purposes there. Meta is our joint controller under Art. 26 GDPR for the pixel and the Conversions API, as described in section 6.4. Only the processors appear in the subprocessor annex of our Data Processing Agreement, which is why that list is shorter than this one.

Transfers outside the EU/EEA

Where a recipient is established outside the EU/EEA, or where its parent may access data from a third country, the transfer is based on the EU-US Data Privacy Framework adequacy decision where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by encryption in transit and at rest. You may request a copy of the relevant clauses at simon@justsendit.ai.

We do not sell personal data and do not share it with third parties for their own marketing purposes.

8. Retention

9. When we are a processor rather than a controller

For the personal data inside the accounts you connect — including the personal data of the people you contact — you are the controller and we are your processor. We process that data only on your documented instructions, which are the API and MCP calls you or your AI agent make. Our Data Processing Agreement (dpa.md) governs that relationship and forms part of our Terms.

This matters for outreach: you are responsible for having a lawful basis to contact the people you contact, for honouring their objections, and for complying with § 7 UWG and Art. 13 of the ePrivacy Directive on unsolicited commercial communication. JustSendIt is a tool; it does not make your outreach lawful.

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of prior processing (Art. 7 (3)).

To exercise any of these, email simon@justsendit.ai. We respond within one month.

You may lodge a complaint with a supervisory authority. Ours is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany · poststelle@lda.bayern.de

We do not carry out automated decision-making producing legal effects under Art. 22 GDPR.

11. Security

We apply the technical and organisational measures described in Annex 2 of our DPA, including encryption in transit (TLS) and at rest, least-privilege access, tenant isolation enforced at the database and application layer, keyed pseudonymisation of account identifiers, and an append-only audit trail.

12. Changes

We may update this policy as the service changes. Material changes are announced by email or in-app at least 14 days before they take effect. The date at the top always reflects the current version.