Legal

Privacy Policy

Last updated: 28 October 2026

1. Who we are

Hatched Send is an email marketing platform. This policy explains how we collect, use, and protect your personal data when you use our service.

Data Protection Contact: privacy@hatched.digital

2. Data we collect

Account data

Email address, password (securely hashed), collected at signup

Subscriber data

Email addresses, names, tags, uploaded or collected by you via signup forms

Engagement data

Email opens, link clicks, timestamps, via tracking pixels and redirect links

Billing data

Payment method and invoices, processed by Stripe. We never see or store card numbers

Usage data

Feature usage, send counts, AI generation requests, for billing and service operation

3. How we use your data

Service delivery: sending emails, managing subscribers, generating content
Billing: processing payments, tracking usage against plan limits
Service improvement: aggregate usage patterns (never individual content)
Legal compliance: responding to lawful requests, preventing abuse

4. Lawful basis for processing

Account management

Contract performance (Art. 6(1)(b))

Email sending

Contract performance (Art. 6(1)(b))

Payment processing

Contract performance (Art. 6(1)(b))

AI content generation

Consent (Art. 6(1)(a))

Service analytics

Legitimate interest (Art. 6(1)(f))

Abuse prevention

Legitimate interest (Art. 6(1)(f))

5. Where your data lives

Platform account data (login, billing, workspace settings) is stored in Sydney, Australia (ap-southeast-2). Subscriber lists and campaign data live on a dedicated database for your workspace: we run it for you to start, or you plug in your own and pick the region.

Database

Dedicated per workspace: we run it, or you plug in yours

Authentication

Self-hosted (bcrypt + JWT), Sydney

Email delivery

Third-party email delivery provider, US/EU

Payments

Stripe: US (DPF certified)

AI generation

Anthropic Claude: US (no PII transmitted)

Connected AI apps

The provider you connect (e.g. Anthropic Claude: US). Only data you ask the app to read is shared

Where data crosses borders (e.g., payment processing via Stripe), we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

6. Connected apps and AI assistants

You can connect Hatched Send to AI assistants such as Anthropic's Claude. When you do:

You choose the access. On the consent screen you pick which workspaces the app can use and what it can do (view data, manage contacts, edit templates and drafts, send campaigns). Viewers can only grant read access.
What is shared. The app receives only the data its tools return for the workspaces you picked, such as audience names, contact details you search for, template content and campaign statistics. It never receives your password, API keys or payment details.
Where it goes. Data the assistant reads is processed by that assistant's provider under its own terms and privacy policy (for Claude, Anthropic's). We don't control how the provider stores conversation content.
What we keep. The connection (which app, which workspaces, which permissions, when it was last used) and hashed access tokens. We log each action the app takes (action, workspace, success or failure) for security and support, kept with our audit logs.
Sending needs your confirmation. The assistant can't send a campaign without showing you a preview and getting your explicit confirmation.
Your control. Disconnect any app at any time under Settings → Connected apps; access ends immediately. Removing a team member also removes their app access to that workspace.

7. Your rights

Under applicable privacy laws, you have the right to:

Access

Download all your data via Settings → Export Data

Rectification

Edit your data in account settings at any time

Erasure

Delete your account and all data via Settings → Delete Account

Portability

Export your data as machine-readable JSON

Restriction

Request processing limits: contact privacy@hatched.digital

Objection

Object to legitimate-interest processing, contact privacy@hatched.digital

We respond to all rights requests within 30 days. For California residents (CCPA): we do not sell personal information and do not use it for cross-context behavioural advertising.

8. Cookies

We use minimal, essential cookies only:

Name

Purpose

Duration

Type

session

Authentication

Session

Essential

cookie-consent

Your cookie preference

1 year

Essential

We do not use analytics cookies, advertising cookies, or third-party tracking.

9. Data retention

Account data

While account is active. Deleted within 30 days of closure.

Subscriber data

While account is active. Individual contacts deletable anytime.

Email content

Retained for your reference. Deleted with account.

Engagement data

24 months, then anonymized.

Audit logs

5 years (legal requirement).

10. Security

Encryption in transit (TLS 1.2+) and at rest (AES-256)
Row-level security enforcing strict tenant data isolation
Database access restricted to VPC with network-level controls
API rate limiting on all endpoints
No plain-text password storage (bcrypt hashing with secure JWT authentication)

11. Children's privacy

Hatched Send is not intended for individuals under 16. We do not knowingly collect data from children.

12. Changes

We may update this policy from time to time. Material changes are communicated via email or in-app notification at least 30 days before taking effect.