MillionSendStart at 1

Legal

Privacy Policy

Last updated October 18, 2026

1. Overview

CODARI GLOBAL, LLC, a Wyoming limited liability company doing business as MillionSend ("MillionSend", "we"), operates a hosted email platform. This policy distinguishes two roles:

  • For account data — the information customers give us to open and operate an account — we are the data controller.
  • For Customer Content — the contacts, recipient addresses, and email content our customers submit in order to send email, and the email others send to our customers' domains and inboxes — we are a data processor acting on the customer's instructions. The customer is the controller.

2. Data we collect as controller

  • Account data: name, email address, password hash, organization name, locale.
  • Billing data: plan, invoices, and the last four digits and brand of your card. Full payment credentials are held by Stripe, not by us.
  • Usage and log data: API request logs, IP addresses (including the address and browser used to sign up), user-agent, dashboard actions, and security events.

3. How we use account data

To provide and secure the service (including comparing new accounts with accounts we closed for abuse), bill for it, respond to support requests, meet legal obligations, and send service notices. Creating an account also subscribes you to occasional product updates from MillionSend (new features, announcements); every such email carries a working unsubscribe, and unsubscribing never affects account notices such as password resets or invitations. We do not sell personal data, do not use Customer Content to train machine-learning models, and do not permit our subprocessors to do so.

4. Customer Content, processed on behalf of customers

Customer Content includes recipient email addresses, contact attributes, segments, templates, message bodies, and delivery events (sent, delivered, bounced, opened, clicked, complained). We process it only to deliver email, render the customer's dashboard and metrics, operate suppression lists and unsubscribes, and provide support. Email bodies are encrypted at the application layer with AES-256-GCM before being stored. Section 5 sets out every case in which a person at MillionSend, or an automated check, can see it.

Customer Content also includes the email that reaches a customer's receiving domains and inboxes: its sender, recipients, headers, body, and attachments, the authentication results we record for it, and what we read from it to show it to the customer and to the customer's agents (its visible text, the history it quotes, and any verification code or sign-in link it carries). We process it only to store it and show it to the customer, to file it into the customer's inboxes and conversations, to send it to the customer's webhooks and forwarding addresses, and to screen it as Section 5 describes. It is encrypted the same way, and its retention follows that of sent email (Section 7).

5. When MillionSend staff can see Customer Content

Inside the product, a person at MillionSend, or an automated check, can see Customer Content only through the six paths below.

  • Automated deliverability checks. Every message you send is checked inside MillionSend, without leaving our systems, for problems that hurt delivery or suggest phishing, such as missing authentication, links that point somewhere other than your domain, link shorteners, or a missing plain-text part. We keep only the results (each check's outcome, a score, and bare hostnames, counts, and sizes, never text or full links), which appear as Insights in your dashboard. A message that fails a serious check, or that automated content screening holds before delivery, is listed for our staff.
  • Automated content screening. To keep phishing, malware, and spam off a platform whose sending reputation every customer shares, mail you send is scored automatically. Mail from a team that has only recently started sending, and mail that links to, or asks for replies at, a domain your team has not used before, is scored before it is delivered; if the score indicates abuse, the message is held for review instead of being delivered, and it is delivered if the review clears it. Other mail is scored by sampling after it has been accepted for delivery. What is sent for scoring is your team's name, verified domains, plan, and how long it has been sending; the From and Reply-To headers; the subject; the visible rendered text (up to 6,000 characters, taken from its beginning and its end, leaving out hidden elements) and, separately, the inbox preview line (up to 200 characters) and up to 1,000 characters of other text hidden from the reader; when it differs, up to 1,500 characters of the plain-text version; up to 30 links from the message and up to 20 more found in QR codes and attachments, each shown as its anchor text or source and the domain it points to; for a Pix code, the payee's name and city, the amount, and the kind of key, never the key; the number of images; attachment file names, types, and sizes; up to 4,000 characters of text extracted from PDF, Office, calendar, HTML, and SVG attachments; up to 3,000 characters of text, and the brands shown, read from images and from attachment pages that are images; and a count of hidden characters. Before the text goes to TypeSafe, the subject, text, anchor text, file names, and the text taken from images and attachments are redacted: links are cut to their domain and a short part of the path, key- and token-shaped strings are masked, as are numeric codes that follow words such as "code", "PIN", or "password", email addresses are reduced to their domain, and CPF and CNPJ numbers are masked. Names, phone numbers, postal addresses, and other personal details written in the text are not removed. What is sent to TypeSafe never includes recipient addresses, raw HTML, or the images and files themselves. QR codes are decoded and attachments are read inside MillionSend. To read the text in images, and in attachment pages that are images, we send those images to Anthropic's Claude model running in Amazon Bedrock, a service of AWS (Section 6), in the United States. Amazon Bedrock does not store them, and neither AWS's operators nor Anthropic can access them, except that AWS may keep an image its automated checks flag as child sexual abuse material in order to review and report it. Scoring is carried out by TypeSafe (Section 6). We do not store the text sent for scoring; we keep only the result (a score, a verdict, and short labels for the reasons, the category, and the language) for 90 days and, for a message held for review, what screening read from it (extracted text, decoded links, and small previews of its images), which is deleted with the message body (Section 7). TypeSafe processes the text under its data processing addendum, may keep it for as long as necessary to provide its service, to monitor that service for fraud and abuse, to derive service telemetry, and to comply with law, and does not use it to train models.
  • Automated screening of received mail. An agent inbox is an inbox a customer sets up for an AI agent to read. Mail that reaches one is scanned for viruses and given a spam score inside MillionSend. Unless it comes from the customer's own people or senders the customer trusts, or continues a conversation the inbox already has, it is also scored for phishing and for text written to take over the agent (prompt injection) before the agent can read it, when the customer leaves screening on; a message the score flags is held in the inbox's quarantine, which the agent cannot read. What is sent for scoring is the customer's team name and verified domains; the From and Reply-To headers and the sender's authentication results; the subject; the visible text of the message and of the history it quotes (up to 6,000 characters) and, separately, the inbox preview line (up to 200 characters) and up to 1,000 characters of other text hidden from the reader; when it differs, up to 1,500 characters of the plain-text version; up to 30 links, each shown as its anchor text and the domain it points to; attachment file names and types; a count of hidden characters; and whether the message says it was sent automatically. The text is redacted as for sent mail before it goes to TypeSafe, so a code that follows a word such as "code" is masked, and what is sent never includes the recipient addresses, raw HTML, or the files themselves. Scoring is carried out by TypeSafe (Section 6) on the same terms as for sent mail. We do not store the text sent for scoring; we keep the result (a score, a verdict, and short labels for the reasons) with the message.
  • Names on the shared inbox domain. Each team gets its own subdomain of MillionSend's shared inbox domain, derived from the team name, and inboxes on it can take a chosen username and display name. So that these addresses don't imitate other brands, we send each team's name to TypeSafe (Section 6) to be checked when the team is created or renamed, and once for teams created before this check began, and we send a chosen username or display name when an inbox is created or changed. Only the name itself is sent, with no other account data. A team name that is refused gives the team a random subdomain instead; a refused username or display name can't be used. We do not store what is sent for checking; we keep the resulting address.
  • Support access. An authorised operator may open your dashboard in a read-only support view for up to 30 minutes, for example to help with a request you made, to look into a billing dispute, or as part of a trust and safety review; each session records its reason and reference. The view shows what your dashboard shows, including your contacts, each email's sender, recipients, subject, tags, and delivery events (a clicked link shows only its domain), and draft or scheduled broadcasts. It never shows the bodies or attachments of emails once they are sent or received (broadcasts included, from the moment they start sending), template bodies, API request and response bodies, exports, or secrets (API keys, SMTP credentials, and webhook signing secrets).
  • Trust and safety review. Our trust and safety team may read specific messages to investigate suspected phishing, malware, spam, fraud, or other abuse, or a threat to the security of the service; to enforce our Terms; when you ask us to look at a message; or when the law requires it. This access is limited to authorised staff and to these purposes.

Outside the product, the people who operate our infrastructure can reach the servers and databases that store Customer Content; they use that access only to keep the service running, such as diagnosing faults and restoring backups, or to meet a legal obligation. We do not read Customer Content for any other purpose, and none of the paths above is used to build profiles, advertising, or training data.

6. Subprocessors

We use the following subprocessors to operate the service:

  • Amazon Web Services (AWS) — Email delivery via SES, application hosting, storage, and reading images for automated content screening (Amazon Bedrock). Location: Data storage and application hosting in the United States; email delivery via SES in the region chosen per sending domain; image reading for screening in the United States.
  • Stripe — Payment processing and billing. Location: United States.
  • Cloudflare — DNS, content delivery, and network security. Location: Global edge network.
  • TypeSafe — Automated screening of sent message content for phishing, malware, and spam, of mail received by agent inboxes for phishing and prompt injection, and of names used for addresses on MillionSend's shared inbox domain for brand impersonation. Location: United States.

We will provide notice of subprocessor changes to customers with an executed DPA before the change takes effect.

7. Retention

  • Account data: for the life of the account and up to 90 days after deletion, except records we must keep for tax and accounting law.
  • Customer Content: for the life of the account; deleted within 30 days of account deletion, and earlier when the customer deletes specific contacts or messages.
  • Email bodies, attachments, what screening read from a message held for review, API request logs and delivery-event payloads: 30 days by default. Email metadata (sender, recipients, subject, status) and webhook delivery records: 30 days. Billing event ledger: 90 days. Expired sign-in sessions are purged hourly.
  • Suppression entries (bounces, complaints, unsubscribes): retained while the account exists, because deleting them would cause re-sending to people who opted out.
  • Accounts we suspend or close for abuse, such as phishing, malware, spam, or fraud: we may keep the records of the account and of the abuse (account and billing details, sending domains, audit trail entries, the results of our automated checks, and the messages concerned) beyond the periods set out in this policy, including after the account is deleted or its erasure is requested, for as long as they are needed to establish, exercise, or defend legal claims, to comply with legal obligations, and to keep the same people from abusing the service again. We do so under Article 17(3)(b) and (e) of the GDPR and our legitimate interest in preventing fraud and abuse (Article 6(1)(f)), and under Articles 7(VI), 7(IX), and 16(I) of the LGPD.

8. Security

Data is encrypted in transit (TLS) and at rest; email bodies carry an additional application-side AES-256-GCM layer. Access to production systems is restricted and logged. API keys are shown once and stored hashed. If we learn of a personal-data breach, we will notify affected customers without undue delay and within the timelines the GDPR and LGPD require.

9. International transfers and residency

Our application and its database run in a single primary region in the United States; your account data and stored email content (encrypted at rest) reside there. Message content screened, and names checked, as described in Section 5 are processed by TypeSafe in the United States, and images from it are read through Amazon Bedrock in the United States. When you add a sending domain you choose an AWS region — that choice selects where Amazon SES delivers that domain's mail, and does not change where your data is stored. Where personal data subject to the GDPR or UK GDPR is transferred to a third country, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum. TypeSafe's data processing addendum includes the EU Standard Contractual Clauses (Modules 2 and 3) and the UK Addendum. For LGPD data, we rely on the contractual safeguards of Article 33; these do not cover the screening transfer to TypeSafe.

10. AI assistants and MCP clients

You can connect an AI assistant or another Model Context Protocol (MCP) client, such as Claude, to your MillionSend account through OAuth. On the consent screen you choose the team the client may act on, either a single team or All teams (every team you belong to, including teams you join later), and the permissions (scopes) to grant; the client can reach only the team or teams you chose, and only within those permissions.

The connected client receives the results of the tools it calls within those permissions. Depending on what you grant, that can include sent emails with their content and delivery status, contacts and their properties and preference links, segments, topics, suppressions, broadcasts, templates and their content, sending domains and their DNS records, usage figures, webhooks, API key metadata, and, on an All teams grant, the names of your teams, and, for owners and admins who grant those permissions, newly created API keys and webhook signing secrets. The client can also act within the permissions you grant, for example by sending email or changing or deleting audience data.

Once returned to the client, that data is processed by the provider of the AI assistant (for example Anthropic) under the provider's own terms and privacy policy. The provider is not our subprocessor, and MillionSend does not control that processing; whether the provider uses the data to train its models is governed by its terms and by your settings with it.

On the consent screen you also choose how long the client stays connected: until you disconnect it, or for 30 days, 90 days, or one year, after which it must ask you again. You can revoke access at any time in the dashboard under Settings → Connected apps; owners and admins can also revoke other members' grants. Access tokens are short-lived (one hour), so a revocation takes effect at the client's next token refresh, within an hour. Removing the connector in the AI client stops that client from using it. We log MCP tool calls the same way as API requests (Section 2) and keep those logs for the periods set out in Section 7.

11. Your rights under the GDPR

If you are in the EEA or UK, you may request access, rectification, erasure, restriction, portability, and object to processing, and you may lodge a complaint with your supervisory authority. For account data, contact us directly. For personal data in Customer Content, contact the sender who controls it; we will refer requests we receive to the responsible customer and assist them as processor.

12. Your rights under the LGPD

If you are in Brazil, Lei Geral de Proteção de Dados grants you the corresponding rights: confirmation of processing, access, correction, anonymization or deletion, portability, and information about sharing. Requests are honored through the same channels as Section 11, and you may petition the ANPD.

13. Data Processing Addendum

A DPA covering our processing of Customer Content — including the subprocessor list above, the Standard Contractual Clauses, and LGPD processing terms — is available to all customers. Request it at legal@millionsend.com.

14. If you received an email sent through MillionSend

The sender, not MillionSend, chose to email you and controls your data. Use the unsubscribe link in the message — marketing email sent through MillionSend supports one-click unsubscribe — or contact the sender directly. If you believe a sender is abusing the platform, report it to abuse@millionsend.com.

15. Cookies

The dashboard uses only cookies and local storage necessary to sign you in, keep unsaved editor drafts on your device, and remember preferences such as theme and language. We do not run third-party advertising or cross-site tracking cookies.

16. Children

The service is not directed to children under 16, and we do not knowingly collect their personal data.

17. Changes to this policy

We may update this policy; material changes will be announced by email or in the dashboard before they take effect. The current version always lives at this page.

18. Contact

CODARI GLOBAL, LLC, doing business as MillionSend. Notices: 7345 W Sand Lake Rd Ste 210, Office 4592, Orlando, FL 32819, USA · privacy@millionsend.com. EU/UK and Brazil data-protection inquiries reach our privacy team at the same address. For general support, write to support@millionsend.com.