Privacy Policy

Last updated: 15 October 2026

This notice explains how we process the personal data of visitors to www.connectsender.com, people who use the contact form and users of the ConnectSender panel (app.connectsender.com). It serves as the privacy notice under the EU General Data Protection Regulation (GDPR) and as the information notice under Turkey's Personal Data Protection Law No. 6698 (KVKK).

1. Who is responsible

For people and customers in Turkey: İkipixel Bilgi Teknolojileri Tic. A.Ş., Workinton, Emniyet Evleri Mh., Eski Büyükdere Cd., Sapphire AVM No: 1 Kat: B04, 34415 4. Levent / Istanbul, Türkiye
For people and customers in every other country: Ikipixel LLC, Boca Raton, FL, USA

Together they are called "ConnectSender" or "we" in this notice. Contact: hello@connectsender.com

2. What we process

Website visitors

The site uses no cookies, advertising or visitor analytics. Cloudflare, which hosts the site, processes technical connection data such as your IP address and browser details to deliver the pages and prevent abuse.

Contact form

Your name, email address, organisation (optional), your message and the page language. To limit abuse we keep a one-way summary (hash) of your IP address, which is deleted after 24 hours. The form is checked for bots with Cloudflare Turnstile.

Panel users

Email address, name, language, the customer account you belong to and your role; sign-in codes (valid for 10 minutes); your device's public key if you use a passkey; session records (including browser details); a record of significant actions in the account (for example credit movements and setting changes).

Our customers' recipient data

Contacts our customers upload (email, first and last name, company, phone, language, subscription status, source, consent date, extra fields), send records, open and click events (a hash of the IP address, browser details, time), unsubscribes, bounces and complaints, and the best send hour learned from opens. Our customer is the controller of this data; we process it only on their instructions, as a processor (see section 9).

3. Purposes and legal bases

Purpose	Legal basis
Answering your contact-form request, preparing offers and contracts	Steps prior to a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c), legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)
Providing the panel, managing accounts and sessions, sending system emails (sign-in codes, notices)	Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)
Keeping credit, invoice and accounting records	Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç)
Security of the site and panel, preventing abuse and spam	Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)
Sending and reporting campaigns for our customers	The customer's instructions; the legal basis is the customer's

4. Cookies, local storage and email measurement

This site uses no cookies.
The panel uses only a strictly necessary session cookie to keep you signed in, and stores your theme choice in your browser.
Cloudflare Turnstile runs for security once you start filling in the contact form.
As there are no marketing or analytics cookies, no cookie consent is requested.
Emails our customers send may use an invisible image and redirecting links to measure opens and clicks. Customers can turn these off per campaign.

Cloudflare, Inc. (USA): hosting, database, file storage, bot protection.
Resend (USA): system emails and contact-form notifications.
The sending service a customer chooses (Amazon SES, Mailgun, SendGrid, Purelymail or an SMTP provider): campaign emails go out from the customer's own account under the customer's own contract with that provider.
İkipixel Bilgi Teknolojileri Tic. A.Ş. and Ikipixel LLC: who run the service together.
Public authorities: only where the law requires it.

International transfers: Cloudflare and Resend may process data outside your country, including in the USA. These transfers rely on the safeguards provided for in Chapter V of the GDPR and Article 9 of the KVKK (such as standard contractual clauses).

6. How long we keep data

Contact-form messages: 2 years, then deleted automatically. The IP hash is deleted after 24 hours.
Sign-in codes: 10 minutes. Sessions end when they expire or when you sign out.
Panel accounts and customer data: for the term of the contract. When it ends, the data is returned or deleted as the customer asks, subject to legal retention duties.
Credit, invoice and accounting records: for the period the law requires (10 years in Turkey).

7. Security

All connections are encrypted with HTTPS. The panel has no passwords: you sign in with a one-time code or a passkey. Only a hash of each session token is stored. Sending-service keys are stored encrypted. Access depends on roles, and the site and panel use security headers.

8. Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to complain to the supervisory authority in your country. Under the KVKK you may also ask whether your data is processed, for what purpose and to whom it is transferred, ask for corrections, deletion and notice of these to recipients, object to a result produced solely by automated analysis, and claim compensation for unlawful processing.

Write to hello@connectsender.com. We answer within 30 days at the latest.

9. If you received an email from one of our customers

The newsletter was sent by an organisation that uses ConnectSender. Please contact that organisation first about your data. You can unsubscribe at once with the link at the bottom of every email; after that, that organisation's list will not email you again. If your request reaches us, we pass it on to the customer concerned.

10. Artificial intelligence

We do not use personal data to train artificial intelligence models, and we do not give it to others for that purpose.

11. Changes

We update this notice when needed; the current version is always on this page. We tell panel users about significant changes separately.