# Privacy Policy > What personal information Broadcast collects on sendbroadcast.net, why, who we share it with, how long we keep it, and your rights under the GDPR and PIPEDA. Source: https://sendbroadcast.net/privacy **Last updated:** October 6, 2026 This policy explains what personal information Furvur Inc collects when you visit sendbroadcast.net, buy or use Broadcast, join our mailing list or take part in our partner program, and what we do with it. Broadcast is self-hosted software. **The subscribers, emails and campaigns in your own Broadcast installation live on your server, not ours.** We don't see or process them, and this policy doesn't cover them. For that data, you are the controller, and your own privacy policy applies. ## Who we are Furvur Inc ("we", "us") is a corporation incorporated in Ontario, Canada. We are responsible for the personal information described in this policy (the "controller" under the EU and UK GDPR). Furvur Inc 6D - 7398 Yonge St Unit # 363 Thornhill, ON L4J 8J2, Canada Privacy questions and requests: [simon@sendbroadcast.net](mailto:simon@sendbroadcast.net) ## What we collect and why ### When you visit our website - **Server logs.** Our servers and Cloudflare, which sits in front of them, record your IP address, browser, the pages you request and the time. We use this to run and secure the site, and to stop abuse. Cloudflare also tells us the country and approximate location of the request. - **Analytics.** We use Plausible, which we host ourselves and which sets no cookies, to count visits and see which pages are read. We also use Google Analytics and Google Tag Manager, which set cookies and send data about your visit to Google. If you're in the EEA, the UK or Switzerland, we load them only after you accept cookies. See [Cookies](#cookies) below. - **Referral links.** If you arrive through a partner's link (a link with `?ref=`), we store which partner referred you, so we can credit them if you buy within 90 days. If you're in the EEA, the UK or Switzerland, we store this only after you accept cookies. See [Cookies](#cookies) below. ### When you buy Broadcast - **Purchase details.** Stripe processes your payment. We receive your name, email address, billing address, any tax ID you enter, what you bought and what you paid. We never see or store your full card number. - **Invoice details.** If you add a company name, address or VAT number for your invoice, we store it and print it on the invoice. - **Your account and license.** We create a dashboard account with your email address and a password you choose (stored only as a secure hash), and issue your license key. We use these to deliver the software and updates, and to support you. We use this information to perform our contract with you, to keep accounting and tax records as the law requires, and to prevent fraud. ### When you start a checkout and do not finish it Stripe's checkout page has a box that says "Keep me updated with news and personalized offers". If you tick it, enter your email address and then leave without paying, Stripe sends us that address when the checkout expires. We send you one email with a link back to your checkout, and nothing more. We keep a record that we sent it, and we send at most one such email to an address in any 30 days. We do not add you to a mailing list. If you do not tick the box, we do not receive your address. ### When you run Broadcast Your installation contacts us to check your license and for new versions. It sends your license key and the domain name it runs on, and we see its IP address. If you turn on health monitoring, it also reports the health of that server. We use this to validate licenses, enforce the number of servers your license covers, tell you about problems, and ship updates. If your installation reports an error to us, the report contains the error message, technical details and the page it happened on. We use it to fix bugs. ### When you use our tools and setup features - **Server setup assistant.** If you let us create a server for you, you give us an access token for your cloud provider (such as DigitalOcean, Hetzner, Linode or Vultr) and an SSH public key. The token is encrypted, used only to create that server in your account, and deleted as soon as the server is created. We keep the server's IP address and domain name to finish setup and support you. - **Test email inbox.** Emails your installation sends to your test inbox address are stored so you can view them, and deleted after 7 days. For these emails, error reports from your installation and health monitoring, we process data on your behalf, as your processor. We can sign a data processing agreement with you on request. - **Free tools.** The spam checker, DMARC tester and similar tools process what you submit to show you the result. We don't keep it. If you give your email address to export from the email template builder, we keep the address and a one-way hash of your IP address (not the IP itself), and add you to our mailing list. ### When you join our mailing list We send our newsletter and product emails with Broadcast, running on our own server. We keep your email address, name if you give it, how you joined, and tags that describe your relationship with us (for example, that you are a customer or a partner). Our emails may track opens and link clicks so we can see what's useful. Every email has an unsubscribe link, and you can also ask us to remove you. When you buy Broadcast, we add you to our customer list so we can tell you about updates and changes to the product. You can unsubscribe at any time without affecting your license. ### When you take part in our partner program To run the program and pay commissions, we collect: - Your application: name, email address, country, optional company, and the eligibility declarations you make - Your payout details: PayPal email address, billing address, optional phone number and VAT/GST number - Your referrals: clicks on your links and codes, and the sales credited to you. You don't receive personal information about the people you refer. - A compliance record of each application, change to payout details, and invoice acceptance: the date and time, your IP address, the approximate location of your device, your browser, and the exact wording you agreed to We keep these records to meet our tax, accounting and sanctions obligations, as described in section 6.3 of the [Referral Program Terms](https://sendbroadcast.net/referral-terms). ### When you contact us If you email us, we keep the conversation and your contact details to answer you and to handle the same question better next time. ## Cookies A cookie is a small file a website stores in your browser. If you're in the European Economic Area, the United Kingdom or Switzerland, we ask before setting any cookie that isn't strictly necessary, and you can change your answer at any time with the **Cookie settings** link at the bottom of every page. We use these cookies and similar technologies on sendbroadcast.net: | Name | Set by | Purpose | Kept for | |---|---|---|---| | Session cookie | Us | Keeps you signed in to your dashboard | Until you sign out or close your browser | | `cookie_consent` | Us | Remembers whether you accepted or rejected optional cookies | 12 months | | `referral_code`, `visitor_id` | Us | Remembers which partner referred you, so they get credit for a purchase (optional) | 90 days and 1 year | | `_ga`, `_ga_*` | Google Analytics | Counts visits and measures how the site is used (optional) | Up to 2 years | | Browser local storage | Us | Remembers which sections of the documentation menu you opened | Until you clear it | Plausible sets no cookies. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud. You can also block or delete cookies in your browser settings. The site works without the optional cookies. If you block the referral cookie, a partner can still be credited if you enter their code at checkout. ## Who we share it with We don't sell your personal information, and we don't share it for others' advertising. We share it only with service providers who process it for us under contract, and when the law requires it: - **Stripe** (payments), in the United States and elsewhere - **PayPal** (partner payouts) - **Postmark** (sending account, receipt and partner emails), in the United States - **Cloudflare** (content delivery and security, and running our own service that turns invoices into PDF files), worldwide - **Google** (Google Analytics and Tag Manager), in the United States, only if you accept cookies where we ask - **Our hosting provider**, which runs the servers for sendbroadcast.net and our mailing list - **Your cloud provider**, only when you use the server setup assistant, and only with the token you give us We may disclose information if required by law, to protect our rights or others' safety, or as part of a sale or merger of our business, in which case this policy continues to apply to it. ## International transfers We are based in Canada. The European Commission recognizes Canada as providing adequate protection for personal information handled by commercial organizations. When our service providers process information in the United States or elsewhere, we rely on the EU-U.S. Data Privacy Framework where the provider takes part in it, or on standard contractual clauses approved by the European Commission. ## Legal bases (EU and UK) If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: - **Contract:** to sell you Broadcast, deliver licenses and updates, and support you; to run the partner program and pay you - **Legal obligation:** to keep tax, accounting and sanctions records - **Legitimate interests:** to secure and improve our site and product, prevent fraud, count visits with Plausible, and email existing customers about Broadcast. You can object at any time. - **Consent:** for newsletters you sign up to, and for cookies that aren't strictly necessary. You can withdraw consent at any time. ## How long we keep it - Purchase, invoice and partner payout records: at least 6 years after the year they relate to, as Canadian tax law requires, or longer if another law requires it - Your account and license: for as long as you have them, then as long as we need the purchase records above - Mailing list data: until you unsubscribe, after which we keep only what we need to respect your choice - Test inbox emails: 7 days - Error reports and server logs: only as long as we need them to fix problems and keep the site secure - Support emails: as long as they help us support you ## Your rights Wherever you live, you can ask us to tell you what personal information we hold about you, to give you a copy, and to correct it. Depending on the law that applies to you, you may also have the right to ask us to delete it, to limit or object to how we use it, to receive it in a portable format, and to withdraw consent. To make a request, email [simon@sendbroadcast.net](mailto:simon@sendbroadcast.net). We may ask you to confirm your identity. We'll answer within 30 days. We won't treat you differently for exercising your rights. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, if you are in the EU or UK, to the data protection authority where you live or work. ## Security We protect your information with encryption in transit, access controls, and by keeping only what we need. Passwords are stored as secure hashes. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires. ## Children Our website and products are for businesses and adults. We don't knowingly collect personal information from children under 16. ## Changes to this policy We'll update this page when our practices change and change the "Last updated" date above. If a change is significant, we'll also tell customers and partners by email. ## Contact us Furvur Inc, 6D - 7398 Yonge St Unit # 363, Thornhill, ON L4J 8J2, Canada [simon@sendbroadcast.net](mailto:simon@sendbroadcast.net)