// Privacy statement

Privacy by design, not by promise.

This statement explains how SenderDeck accesses and handles information when you connect Google or Microsoft email accounts.

Last updated 4 August 2026

1. Who operates SenderDeck

SenderDeck is operated by DEVECTUS Pty Ltd (“DEVECTUS”, “we”, “us” or “our”), Level 33, 385 Bourke Street, Melbourne VIC 3000, Australia. This statement applies specifically to SenderDeck and supplements the broader DEVECTUS Privacy Policy.

2. Information we handle

Depending on the features you use, SenderDeck handles:

  • Your site-specific ChatGPT or Codex account identifier and email address, used to keep each user’s connections separate.
  • Connected account information, including provider, email address, account label, granted scopes and connection timestamps.
  • OAuth access and refresh tokens issued by Google or Microsoft. Tokens are encrypted before storage.
  • Email search results, message content and attachment data requested by you. These are fetched on demand and processed transiently.
  • Draft details needed to create, inspect and send provider-hosted drafts.
  • Limited technical and security information needed to operate, diagnose and protect the service.

3. How we use information

We process information only to:

  • connect, label, route and disconnect the email accounts you authorise;
  • search and read messages when you request it;
  • create and inspect drafts with your chosen email provider;
  • list, download or send attachments when you request it and applicable security limits permit it;
  • send a provider-hosted draft only after confirmation of the sender, recipients, subject and attachments;
  • maintain service security, reliability and support; and
  • comply with applicable legal obligations.

We do not sell email data, use it for advertising, build marketing profiles from it, or use mailbox content to train general-purpose AI models.

4. Storage and retention

SenderDeck does not synchronise or index entire mailboxes and does not intentionally retain message bodies or attachment contents. Messages and attachments are retrieved only for the requested operation. Drafts remain with Google or Microsoft.

Encrypted OAuth tokens and account preferences remain until you disconnect the account or the service must remove them for security, legal or operational reasons. OAuth transaction state is short-lived. SenderDeck connection access tokens expire after one hour and refresh tokens expire after 30 days unless they are rotated or revoked sooner. Limited operational records may be retained only as long as reasonably necessary for security, troubleshooting and legal obligations.

5. Disclosure and service providers

Information may be processed by Google or Microsoft as your email provider, by OpenAI services that supply the authenticated product experience, and by infrastructure providers used to host and secure SenderDeck. These providers process information under their own terms and privacy commitments. Processing may occur outside Australia.

We may also disclose information where required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards.

6. Your choices and controls

  • Choose which accounts to connect and what label to give each account.
  • Disconnect an account from SenderDeck to remove its stored connection and encrypted tokens.
  • Revoke SenderDeck directly from your Google Account or Microsoft account consent settings.
  • Request access, correction or deletion of personal information held by DEVECTUS.

Disconnecting SenderDeck does not delete email or drafts stored by your email provider.

To delete all SenderDeck connection data, disconnect each account and email privacy@devectus.com.au from the address associated with your SenderDeck sign-in. We may request reasonable identity verification before completing the request.

7. Security

We use safeguards designed for the sensitivity of connected mailbox access, including encrypted token storage, least-privilege delegated OAuth permissions, per-user account separation, configurable attachment restrictions and exact confirmation before sending. No internet service can guarantee absolute security.

8. Children

SenderDeck is intended for business and adult users and is not directed to children under 16.

9. Contact and complaints

Privacy questions, access or deletion requests and complaints can be sent to privacy@devectus.com.au. You may also write to the Privacy Officer, DEVECTUS Pty Ltd, Level 33, 385 Bourke Street, Melbourne VIC 3000, Australia.

10. Changes

We may update this statement when SenderDeck, its providers or legal requirements change. The current version and effective date will be published on this page.