Effective date: July 30, 2026 — Last updated: July 30, 2026
This Privacy Policy explains how [Legal Entity Name], operating as SenderRank (“SenderRank,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with our website at senderrank.com, our application at app.senderrank.com, and related services (collectively, the “Service”). SenderRank is a deliverability intelligence platform for Klaviyo customers that monitors sender reputation, email authentication, sending infrastructure, campaign performance, and subscriber engagement.
By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree with this policy, please do not use the Service. This Privacy Policy is incorporated into, and should be read together with, our Terms of Service.
1. Who We Are
SenderRank is operated by [Legal Entity Name], registered at [Registered Business Address]. For most customers, SenderRank acts as a data processor (or “service provider” under applicable US privacy law) with respect to the Klaviyo, Google Postmaster Tools, and DNS data you connect to the Service, and you (or your agency’s client) act as the data controller. Where SenderRank collects information directly from visitors to our marketing website, or from you as our own customer for account administration and billing, SenderRank acts as the controller. See Section 7 (“Data Processing Roles”) for how this applies to agencies managing client domains.
2. Information We Collect
2.1 Account and Contact Information
When you create a SenderRank account, we collect your name, email address, password (stored as a salted hash, never in plain text), company name, and any information you provide when contacting support or Crisp live chat.
2.2 Information From Your Klaviyo Account
SenderRank is a Klaviyo-exclusive integration. When you connect Klaviyo via OAuth, we access and store campaign-level metrics (send volume, open/click/bounce/unsubscribe/spam-complaint rates), list and segment statistics, and account-level configuration relevant to deliverability scoring.
We do not store individual subscriber email addresses. During subscriber list sync, each address is classified in memory only — checked against disposable-domain, role-account (e.g. “info@”, “support@”), and free-webmail lookup tables — and only the resulting true/false flags are written to our database. The email address itself is discarded immediately after classification and is never persisted.
2.3 Google Postmaster Tools Data
If you connect Google Postmaster Tools, we retrieve aggregate, domain-level reputation data Google makes available for domains you have verified ownership of — including spam-rate bands, IP and domain reputation, feedback-loop identifiers, authentication pass rates, and delivery errors. This data is aggregate and does not include the content of any individual message or any individual recipient’s identity.
2.4 DNS and Domain Data
We look up publicly resolvable DNS records for the domains you add to SenderRank — including SPF, DKIM, DMARC, MX, and NS records, and public WHOIS/RDAP registration data — all of which is already publicly available on the internet.
If you choose to connect a supported DNS provider (Cloudflare, GoDaddy, or Porkbun) to enable one-click fixes, we store your API credentials in encrypted form. These credentials are used only to display available fixes and to write a specific DNS record when you click to authorize that exact change — never automatically, and never without a logged, attributable action from you. See our Terms of Service for the full scope and limits of this feature.
2.5 Campaign Email Diagnostic Data
For domains where you enable automatic post-send campaign analysis, SenderRank receives a copy of certain outbound campaign emails at a dedicated capture address. We use this copy only to generate structured diagnostic findings — authentication results (SPF/DKIM/DMARC pass-fail), spam-filter signals, content-safety checks (e.g. broken links, disallowed content types, unsubscribe-mechanism presence), and select individual header lines needed for those diagnostics.
The full raw captured email — including complete headers, HTML/MIME body, and attachments — is never written to our database. It exists only in memory for the duration of the automated analysis and is discarded once the structured findings are stored.
2.6 Billing Information
Subscription payments are processed by Stripe. SenderRank does not receive or store full payment card numbers; we retain only limited billing metadata (plan tier, subscription status, invoice history, and a Stripe customer/subscription reference) needed to administer your account.
2.7 Usage, Device, and Log Data
Like most web applications, we automatically collect standard technical data when you use the Service — IP address, browser type, device information, pages viewed, referring URLs, and timestamps — for security, troubleshooting, and product-improvement purposes.
2.8 Communications
We retain records of support conversations (including through our live-chat provider, Crisp), emails, and any feedback you send us.
3. How We Use Information
We use the information described above to:
- Provide, operate, and maintain the Service, including calculating your SR Score and generating alerts, reports, and recommendations;
- Authenticate your account and enforce plan-based domain and feature limits;
- Process payments, manage subscriptions, and administer trials, upgrades, and cancellations;
- Send transactional emails (alerts, digests, receipts) and, where you have opted in, product updates;
- Provide customer support and respond to your requests;
- Detect, investigate, and prevent fraud, abuse, and security incidents;
- Improve and develop the Service, including through aggregate, de-identified analysis of usage patterns;
- Comply with legal obligations and enforce our Terms of Service.
4. Aggregate and Benchmark Data
SenderRank calculates industry and platform benchmarks (for example, average open rates or authentication pass rates across Klaviyo senders) using aggregated, statistical data drawn from multiple customer accounts. Consistent with our internal policy, we do not display any benchmark until at least 50 active domains contribute to it, and benchmark figures never identify, or allow re-identification of, any individual customer, domain, or subscriber.
5. Legal Bases for Processing (EEA/UK Users)
Where the UK or EU GDPR applies, we process personal data on the following legal bases: performance of a contract with you (providing the Service you signed up for); our legitimate interests (securing and improving the Service, preventing fraud, and marketing our own products to existing customers); compliance with a legal obligation; and, where applicable, your consent (for example, optional marketing communications).
6. Data Processing Roles
SenderRank’s agency partner program means data sometimes flows through more than one party. The following roles apply:
- Direct customers: you act as the controller (or “business” under US state privacy law) for the Klaviyo, Postmaster, and DNS data you connect, and SenderRank acts as your processor (or “service provider”).
- Agencies managing client domains: your client remains the controller of its own data, you act as a processor on your client’s behalf, and SenderRank acts as a sub-processor. Agencies are responsible for having a lawful basis and appropriate authorization from their clients before connecting client Klaviyo, Postmaster, or DNS accounts to SenderRank.
- Website visitors and prospects: SenderRank acts as the controller for personal data collected directly through our marketing site, signup flow, and sales communications.
A data processing addendum is available on request for customers and agencies who require one — contact us at the address in Section 15.
7. How We Share Information
We do not sell your personal information. We share information only in the following circumstances:
7.1 Service Providers (Subprocessors)
We use the following categories of subprocessors to operate the Service, each bound by contractual confidentiality and data-protection obligations:
- Hosting & infrastructure: Vercel (application hosting), Supabase (database hosting, with row-level security enforced on all production tables), Inngest (background job orchestration).
- Payments: Stripe (subscription billing and payment processing).
- Email service provider integration: Klaviyo (source of campaign, list, and engagement data you connect).
- Deliverability data sources: Google (Postmaster Tools API), Postmark (inbound email processing for campaign capture and DMARC aggregate reports, transactional email delivery), Resend (transactional email delivery).
- DNS providers: Cloudflare, GoDaddy, and Porkbun — only for domains where you have explicitly connected that provider.
- Domain and identity data: WhoisJson (WHOIS/RDAP lookups), logo.dev (domain favicon/logo display).
- Customer engagement: Crisp (live chat support), FluentCRM (customer lifecycle email automation).
- Affiliate and referral tracking: Referly (administers our customer referral and agency partner commission programs — see Section 12).
7.2 Legal and Safety Reasons
We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.
7.3 Business Transfers
If SenderRank is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
7.4 Agency Directory and Client Access
If you are an approved agency partner, your agency name and profile information may be displayed in our public agency directory, and you may be granted access to your clients’ SenderRank accounts consistent with the agency permissions your clients have authorized.
8. International Data Transfers
Our infrastructure is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other jurisdictions where our subprocessors operate. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for such transfers.
9. Data Retention
We retain personal information for as long as your account is active and as needed to provide the Service. After you close your account or a domain is disconnected, we delete or de-identify the associated data within a reasonable period, except where we are required or permitted to retain it for legal, tax, dispute-resolution, or legitimate security purposes (for example, invoice records required for accounting compliance, or fraud-prevention logs). Structured campaign diagnostic records are retained separately from — and never include — the raw email content described in Section 2.5, which is never retained at all.
10. Data Security
We maintain technical and organizational measures designed to protect your information, including:
- Encryption in transit (TLS) for all connections to the Service;
- Encryption at rest for sensitive credentials, including DNS provider API tokens;
- Row-level security enforced across production database tables, restricting data access by default;
- DNS write actions gated behind an explicit, logged customer click — no automated or background process ever writes a DNS record on your behalf;
- Access controls limiting internal access to customer data to what is necessary to operate and support the Service.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.
11. Your Privacy Rights
11.1 EEA, UK, and Similar Jurisdictions
Subject to applicable law, you may have the right to access, correct, delete, or port your personal information, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local data protection authority.
11.2 California and Other US State Privacy Rights
If you are a California resident, or a resident of another US state with a comprehensive privacy law, you may have the right to know what personal information we collect, to request deletion or correction of that information, to opt out of certain sharing, and to non-discrimination for exercising these rights. We do not sell or “share” personal information as those terms are defined under the CCPA/CPRA.
11.3 Exercising Your Rights
To exercise any of these rights, contact us using the details in Section 15. We may need to verify your identity before processing your request. Where you are an end subscriber of a Klaviyo list managed by one of our customers (rather than a SenderRank account holder yourself), please direct your request to that business directly, as they are the controller of your data; we will assist our customer in responding as required by our processor obligations.
12. Cookies and Tracking Technologies
Our marketing website and application use cookies and similar technologies for authentication, session management, security, and analytics. You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Service. We do not currently respond to browser “Do Not Track” signals.
13. Referral and Affiliate Programs
If you participate in our customer referral program or apply to our agency partner program, we share limited information (such as your name, email, referral link activity, and commission-relevant subscription events) with Referly, our affiliate-tracking provider, in order to attribute and pay commissions. See our Terms of Service for the terms governing these programs.
14. Children’s Privacy
The Service is a business-to-business product intended for use by business professionals and is not directed at, marketed to, or intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:
[Legal Entity Name]
[Registered Business Address]
privacy@senderrank.com
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised “Last updated” date, and, for material changes, provide additional notice (such as an email or in-app notification). Your continued use of the Service after a change takes effect constitutes acceptance of the revised policy.
