Privacy Policy

SNDR is operated by Rkiza Labs, headquartered in Riyadh, Kingdom of Saudi Arabia. This Privacy Policy explains how we handle personal data when you use our marketing site (sndr.sh), our customer dashboard (app.sndr.sh), our public API (api.sndr.sh), and our outbound mail infrastructure.

Two distinct categories of data flow through our platform: (a) data about you, our customer, and (b) data that you process through us — most notably the recipient addresses and message content you send to your end users. We treat each category differently. This policy describes both.

Account data. When you register, we store your name, email address, a bcrypt hash of your password, your workspace name, and a derived workspace slug. We never store your password in plaintext.

Authentication data. Login activity, IP address, user agent, JWT issuance and expiry, OTP issuance and verification attempts. We send a security alert email on every successful login.

Billing data. Plan selection, subscription status, invoice history. The payment instrument itself (card number, IBAN, etc.) is stored by Paddle, our payment processor — we receive only a Paddle customer ID and a transaction reference back.

Sender configuration. Domains you add, DKIM keypairs we generate for those domains, the verification status of each DNS record, and the API keys, webhooks, and templates you create. API keys are stored as SHA-256 hashes; the raw key is shown once at creation and never again.

Mail metadata. For each message you send, we record the message ID, the From address, the recipient list, the subject, the size, the time of submission, the delivery status, the receiving MX response, and any bounce / complaint feedback. We also retain the rendered RFC 5322 source for the time window described in section 5 to allow incident investigation and replay.

Suppressions. Hard-bounce, complaint, and unsubscribe addresses are added to a per-organisation suppression list and are checked on every send.

Operational telemetry. HTTP request logs (path, status code, latency, IP, user agent), error traces, and audit entries for sensitive admin actions. We do not run third-party page-analytics scripts on our marketing site or dashboard.

We use the data above only for the following purposes:

• Operating, maintaining, and securing the service.
• Authenticating you, issuing sessions, and protecting your account from takeover.
• Relaying your messages and providing the delivery analytics you see in the dashboard.
• Enforcing plan limits, computing invoices, and processing payments.
• Sending you transactional and security mail (OTP codes, login alerts, deliverability changes, suspension notices, billing receipts).
• Investigating abuse, debugging incidents, and complying with lawful requests.

We do not sell personal data. We do not run behavioural advertising. We do not train any model on the body of your messages or on your recipient lists.

We share data only with subprocessors that perform a defined function for us under a written data-processing agreement. The current list is:

Your customer mail is delivered directly from our own MTA infrastructure to the recipient's mail server — no third-party mail provider sits in that path. We use Resend only for our own platform mail to you (codes, receipts, alerts) so that an outage on either plane cannot disable the other.

We may also disclose data when required by a valid legal process or to protect the rights, property, or safety of SNDR, our customers, or the public.

• Account & billing data: retained for the lifetime of the account, plus the period required by Saudi tax and commercial law (currently up to ten years for invoices).
• Mail metadata: retained for 90 days, then aged out of the live database.
• Rendered RFC 5322 source: retained for 30 days for incident investigation, then deleted.
• Authentication & access logs: retained for 90 days.
• Suppressions: retained for the lifetime of your organisation. Hard bounces and complaints persist; you can remove unsubscribe entries from /suppressions in the dashboard.
• Deleted accounts: recoverable for 30 days, then permanently deleted except for records we are legally required to retain.

We protect your data with the following technical and organisational measures, among others:

• TLS 1.2+ on every public endpoint; HSTS preload-eligible.
• Bcrypt cost 12 for password hashes; SHA-256 for API key hashes.
• JWT sessions with short expiry; signed with a 32-byte secret.
• OTP codes hashed at rest with a 5-attempt cap and a global per-user rate ceiling.
• MTA bearer secrets encrypted at rest with AES-256-GCM.
• DKIM private keys generated server-side and never exported.
• HMAC-SHA256 signing on outbound webhooks; SSRF-hardened dispatcher with DNS-rebinding defence.
• Boot-time guards refuse to start the API in production with weak or default secrets.
• Role-based access on the admin console with permission checks at every handler.
• Audit logging of sensitive admin actions, persisted to Postgres.

Despite these measures, no system is perfectly secure. If we discover a breach affecting your data, we will notify you without undue delay and in line with applicable law. Security disclosures from researchers are welcomed at sndr@rkiza.sa.

The infrastructure that runs SNDR is distributed across Saudi Arabia, the European Union, and the United States. Where personal data is transferred outside its country of origin, we rely on Standard Contractual Clauses or comparable safeguards with each subprocessor.

Depending on where you live, you may have the right to access, correct, port, restrict, object to, or delete your personal data. You can exercise most of these rights from inside the dashboard:

• Access & correction: see and edit your account fields at /settings.
• Export: download your data via the dashboard export tool, or request a JSON export by email.
• Deletion: close your account from /settings — data is permanently removed after the 30-day recovery window.
• Restriction or objection: contact us at the address below.

For requests about data we process on your behalf (i.e. data about your end-users), you remain the data controller — please direct end-user requests to your own privacy contact, and we will support you as the processor.

We use a small number of strictly necessary cookies and local-storage entries:

• The dashboard stores your JWT session in localStorage under sndr.session so that you stay signed in across reloads.
• The marketing site uses no analytics cookies and no advertising cookies.
• The dashboard remembers your last-used range filter and a few interface preferences in localStorage.

SNDR is not directed at children under 18 and we do not knowingly collect personal data from minors. If you believe a minor has registered, contact us at the address below and we will delete the account.

We may update this Privacy Policy from time to time. Material changes will be announced in the dashboard or by email at least 14 days before they take effect. The effective date at the top of this page is always the date of the most recent revision.

Privacy questions and rights requests can be sent to sndr@rkiza.sa. Security disclosures should go to sndr@rkiza.sa.

Operator: Rkiza Labs, Riyadh, Kingdom of Saudi Arabia.