Legal

Privacy Policy

Last updated: 19 October 2026

In short

For your own account, sign-in and billing, we decide what is done with your data: we are its controller. For the prospects and conversations you keep in Opusend, you decide, and we only process them for you.
We collect what the product needs to work: your account, the leads and messages you save, the pages you ask the extension to read, and how you use the product. Nothing from other websites you visit.
We never sell personal data, never show one customer's CRM to another, never use it for advertising, and neither we nor our AI provider train AI models on it.
A few providers help us run Opusend, each with one job. Our server and some of the providers are in the United States, under the safeguards the law requires.
You can export or delete your data at any time. A closed account is erased after 30 days.
Analytics cookies are set on our website only if you accept them. The app sets only what it needs to keep you signed in and safe.

This box is a summary. The full policy below is what applies.

Who we are

Opusend ("we", "us") provides a B2B sales tool: a Chrome extension and a web app at app.opusend.com that help you research prospects on LinkedIn, draft personalised messages with AI, send them when you decide, and keep a CRM of the conversations. This policy explains what personal data we process, why, and what you can do about it.

The data controller is Xhuljo Cullhaj Person Fizik (M11422030U), Rruga Abedin Nepravishta, 1060, Tirane, Albania, which runs Opusend. Reach us about anything in this policy at [email protected].

Our two roles

We are the controller of the data about you as our customer or user: your account and sign-in, your workspace and team, billing, your support requests, how you use the product, visits to our website, and the cache of email lookups described below.
We are your processor for the data you bring into Opusend or ask it to collect: your prospects, their companies, your notes, and the messages you exchange with them. Your business is their controller. We process that data only on your instructions, under our Data Processing Agreement, and never for our own purposes. If you were contacted by one of our customers, see If an Opusend customer contacted you.

What we collect

Account data: your name, email address and password (stored only as a one-way hash), your workspace, your role and the seats in it, your settings and your company profile (what you sell, your value proposition, the customer stories and materials you save, your signature).
Sign in with Google: if you choose it, Google tells us your name, email address, whether the address is verified, and your profile picture. See Google user data.
Google accounts you connect: if you press Connect Google, the account's email address and Google's id for it, the permissions you gave, a refresh token that we keep encrypted, and, for Calendar, which calendars count as busy and the meeting length you chose. See Google user data.
CRM data you create: the prospects, companies, notes, stages, tags and campaigns you save, and the professional profile information (name, headline, job title, company, location, profile addresses) you choose to capture from the LinkedIn or Sales Navigator pages you visit.
Conversations: the messages you send to prospects and the replies they send back, read from LinkedIn messaging, from your Gmail inbox in your browser if you connect Gmail, or from a mailbox you add with its password. See Google user data and Mailboxes connected by password.
Company research: the text of public company websites you ask us to read, which our server fetches. When there is no company page to read, our AI provider may search the web for public information about the company.
Work email lookups: only when you press “Find emails”, our server asks email finders one after another until one returns a verified work email address. First Anymail Finder, which receives the prospect's full name, employer name, company domain and LinkedIn profile URL; then Icypeas, which receives the prospect's first and last name with the company domain or employer name; and, if neither has found a verified address, Dropleads, which receives the prospect's first and last name with the company domain or employer name. When Anymail Finder or Icypeas returns an address it has not yet verified, that finder is asked to verify it, which sends it the address. Only a verified work email address is kept and shown to you. We never request a personal email address or a phone number. If you never use “Find emails”, no prospect data is sent to any of them.
Billing data: your plan, seats, add-ons, credit balance and billing status, and the payment events Lemon Squeezy sends us (order and subscription ids, amounts, dates). Lemon Squeezy handles the payment itself; we never see or store full card numbers.
Product activity: what happened in your account, so that your counts, history and notifications survive a reinstall: a connection request or message sent, a reply detected, a profile or company read, a stage change, a queued step skipped and why.
Which fields the extension found: after the extension reads a page, it sends which fields it found and which it did not (for example website found, phone not shown), the kind of page, the extension version and the read map version. It never sends a value, and never which person or company was read. The counts are kept without your account, so they cannot be traced to you. The extension also downloads from our server a list of where each field sits on LinkedIn pages, values only, which the extension checks, and the copy built into the extension is used whenever the downloaded one fails a check.
Sign-in sessions: for each session, the IP address and browser it came from, for the security of your account.
Free trials: a browser id and a network: so that signing up again with another address does not start another free trial's AI drafting, the extension makes a random install id once for each browser profile (a random number; nothing is read from your device to make it) and sends it with its AI requests: drafting, the AI helpers and company research. While a workspace is on a free trial and uses AI, our server keeps, with that workspace and the dates, a one-way salted hash of the install id and a one-way salted hash of the network part of your IP address (the first three numbers of an IPv4 address, a /24, or the first three groups of an IPv6 address, a /48). The install id and the network themselves are not stored for this. The web app sends no install id. The hashes are stored in our database, on our server, with the rest of your workspace's data, and are shared with no one. If, in the last 30 days, the same browser has already used AI in another workspace's free trial, or three other free trials have used AI from the same network, the new trial gets no AI drafting: it still signs up and everything else works, and a paid plan is never checked. If you think a trial was refused by mistake, write to [email protected].
Support and contact: what you write to us, and what you send through the contact form on our website (name, email, company, message, and the IP address it came from, to stop abuse).
Website visits: on www.opusend.com, Google Analytics data if you accept it (see Cookies).
Operational logs: request times, status codes and errors that our servers record to run and secure the service.

Why we use it, and on what legal basis

Purpose	Data	Legal basis (GDPR)
Providing the service you signed up for: your account and workspace, syncing your CRM, drafting with AI, sending what you approve or schedule, detecting replies, looking up a work email when you ask	Account data, CRM data, conversations, company research, lookups, product activity	Performance of our contract with you, Art. 6(1)(b). For your prospects' data, your instructions as controller, under the DPA
Keeping accounts and the service secure: sign-in sessions, rate limits, abuse and fraud prevention, staff access controls	Sign-in sessions, operational logs, contact form IP addresses	Our legitimate interest in a secure service, Art. 6(1)(f)
Stopping repeat free trials: a new free trial gets no AI drafting when the same browser or network has already used it in other workspaces' free trials. Nothing else in the trial changes	A one-way hash of the browser's install id and of the network part of the IP address	Our legitimate interest in stopping repeat free trials, Art. 6(1)(f), balanced by keeping only hashes, only for a free trial that uses AI, for 90 days, and by withholding nothing but AI drafting
Account emails: confirming your address, password resets, sign-in notices, account closure notices	Name, email address	Performance of the contract, Art. 6(1)(b)
Billing, invoices and accounting	Billing data	Performance of the contract, Art. 6(1)(b), and our legal obligations on accounting and tax, Art. 6(1)(c)
Answering support requests and messages sent through our website	Support and contact data	Steps you asked for before or under a contract, Art. 6(1)(b), or our legitimate interest in answering, Art. 6(1)(f)
Measuring visits to our website	Google Analytics data	Your consent, Art. 6(1)(a), which you can withdraw at any time
Keeping a cache of work email lookups, so that the same person is not looked up and paid for twice	LinkedIn profile URL, name, work email address, job title, company	Our legitimate interest in running the lookup economically, Art. 6(1)(f), balanced in the prospect's favour by the limits described under If an Opusend customer contacted you
Improving the product with statistics that identify no person and no customer	Product activity, operational logs	Our legitimate interest in a better product, Art. 6(1)(f)
Meeting legal obligations and establishing or defending legal claims	Any of the above, as needed	Legal obligation, Art. 6(1)(c), and our legitimate interest, Art. 6(1)(f)

Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds that override your interests. We do not use your data for advertising, and we do not send you marketing emails unless you have agreed to receive them.

Google user data

Sign in with Google. If you sign in to app.opusend.com with Google, Opusend asks for the openid, email and profile scopes. Google tells us your name, email address, whether it is verified, and your profile picture. Our server stores them in your account and uses them only to create your account and sign you in. It does not keep the tokens Google returns, and it calls no other Google API. Connecting Gmail or Calendar is a separate choice, described below.

Connect Google, to send email. If you press Connect Google in Settings, Sending, Mailboxes on app.opusend.com and leave “Send email from this account” ticked, Opusend asks Google for openid, your email address (userinfo.email) and the gmail.send scope. We use them only to send the emails you compose and approve, or schedule, from your own Gmail account, and to show which account is connected. You sign in and allow it in Google's own window. Google then gives our server a refresh token for that account. Our server stores it encrypted (AES-256-GCM) with a key kept in a file outside the database, and uses it only to ask Google for short-lived access tokens, which it keeps in memory and never writes to the database or to a log. A copy of our database or of a backup holds the token only as ciphertext. We keep the token until you disconnect the account in Settings, Sending, Mailboxes, which revokes it at Google and deletes it. Closing your Opusend account does the same for every Google account you connected: Opusend revokes each token at Google when you close it, tries again before the erasure if Google could not be reached, and deletes whatever is left when the account is erased, 30 days later. You can also remove Opusend at any time at myaccount.google.com/permissions: the stored token then stops working and the account shows as needing to be reconnected. Our server hands each email to Gmail when it is sent and keeps no copy of it; it keeps a count of the emails sent from each mailbox per day, for your daily limits. We keep a record of the emails you send from Opusend (recipient, subject, body, time) in your own CRM, because that is the product.

We do not read, store, or transmit the contents of your mailbox via the Gmail API. Connect Google requests no scope to read, list, change or delete your mail.

Google Calendar, if you connect it. Meeting booking is optional. When you tick “Use its calendar for meetings” in Connect Google, or turn Calendar on in Settings, Sending, Calendar, Opusend asks Google for three scopes, added to what the account has already allowed (Google's incremental authorization):

calendar.calendarlist.readonly lets you choose which of your calendars count as busy. It reads each calendar's id and name and nothing in them. Only the calendars you tick are remembered, with your Calendar connection.

calendar.freebusy reads only when you are busy on those calendars, never an event's title, guests, description or location, so a prospect is offered only free times. Our server reads busy times for each request and does not store them. The free times you offer in a reply are part of that reply.

calendar.events.owned creates the meeting you book with a prospect, or that Autopilot books when a prospect picks one of the times you offered, on your primary calendar with a Google Meet link and the prospect invited. Google sends the invitation from your own account. It also lists your events from the last 7 and the next 30 days, to find your meetings with people saved in your CRM, so you see them and the prospect moves to Meeting. Our server does this about every 30 minutes while Calendar is on, and when you press Check now. Opusend uses your primary calendar only, reads the guests' addresses, start and end only, compares the guests' addresses with the addresses of your saved leads and drops the rest, and never changes or deletes an event. A meeting it finds is kept on our server for 30 days as its time and event key, with no title, guests or description, so that your CRM can pick it up. A meeting's time, and for a meeting booked in Opusend its Google Meet link, are saved on that prospect's record.

The Calendar connection is the same Google account connection described above, held on our server in the same way. Nothing else from your calendar is stored. Turning Calendar off in Opusend's settings deletes the Calendar connection and any meeting found that your CRM has not picked up yet, and withdraws Opusend's access in your Google account if nothing else uses it; disconnecting the Google account ends both. You can revoke Opusend at any time at myaccount.google.com/permissions.

What the extension reads in Gmail, in your browser. Separately from the Gmail API, once you connect Gmail the extension works on mail.google.com in your own browser. When you open an email thread, it reads the sender, the subject and the visible messages to tell whether the sender is one of your leads. If the sender is a lead, the thread's messages between you and them are added to that lead's history in your CRM; if not, nothing from the thread is kept. While your Gmail inbox is open in a tab, it also looks at the sender addresses of unread emails every few minutes and matches them, in your browser, against your leads' addresses, so a lead who replied stops being followed up. Addresses that are not your leads are dropped and never leave your browser. If you ask for a reply draft, the text of that conversation is sent to our AI provider to write it.

Limited Use. Opusend's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs, including the Gmail scope, will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. In particular:

we use Google user data only to provide the features described above, which you can see and use in Opusend: signing in, sending the emails you approve, showing the connected account and, if you turn it on, meeting booking;
we transfer it to others only as needed to provide those features, to comply with the law, or for security, and never to advertising platforms, data brokers or information resellers;
we do not sell it, and we do not use it to serve ads, including retargeting and personalised or interest-based ads, or to determine creditworthiness or for lending;
no person reads it, unless you have asked us to for specific data, it is needed for security (such as investigating abuse), it is needed to comply with the law, or it has been aggregated and anonymised for our internal operations;
we do not use it, or transfer it to anyone, to create, train or improve any artificial intelligence or machine learning model.

The Chrome extension

The extension runs only on the LinkedIn and Sales Navigator pages it works with, on Opusend's own pages, and, if you connect Gmail, on mail.google.com. It reads page content to capture the prospect data you choose to save, to read a conversation you open (so it can recognise the prospect and detect replies), and to carry out actions you start or schedule, such as a connection request, a message or a follow-up. It does not read or collect data from any other website you visit. It reads the addresses of your open tabs only to find Opusend's own tabs, and never stores or sends them.

What the extension collects, as declared in the Chrome Web Store:

Category	Collected	What, and why
Personally identifiable information	Yes	Your name and email; for each prospect you save, their name, job title, company, location, profile addresses, and a work email if you enter or look one up; a random install id the extension makes once for each browser profile and sends with its AI requests, which our server keeps only as a one-way hash, to stop repeat free trials
Health information	No
Financial and payment information	No	Payment happens on Lemon Squeezy's own checkout page; the extension never sees card details
Authentication information	Yes	Your Opusend sign-in token; for a Google account you connect on app.opusend.com, a refresh token, stored encrypted on our server; in older versions of the extension, a Google access token kept in your browser; the password of a mailbox you add by password, stored encrypted on our server so it can send for you
Personal communications	Yes	The messages you send to prospects and the replies that come back, read from LinkedIn messaging and, if connected, your inbox
Location	Yes	The IP address our server keeps with each sign-in session, for account security; and, for a free trial that uses AI, a one-way hash of the network part of the IP address (a /24 of an IPv4 address, a /48 of an IPv6 address), to stop repeat free trials; nothing else
Web history	No	Tab addresses are read only to find Opusend's own tabs, never stored or sent
User activity	Yes	In-product events logged to your own account: a request or message sent, a reply detected, a profile or company read, a stage change, a queued step skipped and why
Website content	Yes	The text of the LinkedIn pages you ask Opusend to read

The data the extension collects is not sold to third parties, is not used or transferred for purposes unrelated to its single purpose (helping you research, write to and follow up with B2B prospects), and is not used or transferred to determine creditworthiness or for lending. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The extension keeps a short log of its own last steps in your browser, with LinkedIn, Sales Navigator and email addresses removed. It never sends it automatically; it leaves your machine only if you copy it for a support request. It also keeps one random install id in the browser's extension storage and sends it with its AI requests, as described under What we collect.

Mailboxes connected with a password (SMTP)

If you add a mailbox by entering its SMTP server, username and password (usually an app password from your provider), Opusend's server stores that password encrypted (AES-256-GCM) in our database, with the encryption key kept in a separate file on the server, outside the database and its backups. The password is never shown back to you or anyone else, never sent to your browser, and never written to our logs.

Our server uses the password only to log in to the mail server you named: once to check it when you add the mailbox, then to send the emails you compose and approve, or schedule, from that address and within its daily limit. The emails go out through your own provider, as if you had sent them from your mail app. The provider is one you chose, so it is not one of our sub-processors.

Removing the mailbox in Settings, Sending, Mailboxes, or deleting your account, deletes the stored password, and the replies and bounces read from that mailbox, at once. Database backups that still contain the encrypted password roll off within 30 days.

If you also give the mailbox's IMAP server, our server uses the same password to check that inbox for new mail every few minutes, to catch replies and bounces from your leads, so Autopilot stops following up with someone who has answered. It opens the inbox read-only: nothing is marked as read, moved or deleted. It reads the sender, subject and threading headers of new mail. For an email from one of your leads it keeps the first 8 KB of the reply's text, which is added to that lead in your CRM; for a delivery failure it records that your email bounced. Nothing from any other email is kept, and detections are deleted from our server after 30 days. Without an IMAP server, that mailbox is not read at all, and Stop reading replies in Settings, Sending, Mailboxes removes the IMAP server and keeps the mailbox for sending.

AI processing

Opusend drafts messages and reply suggestions, summarises companies, scores how well a prospect fits your offer and answers questions about your pipeline with AI models provided by Anthropic. Our server sends Anthropic what each task needs: the prospect and company text a draft is grounded in, the part of your own profile a message is written from (what you sell, your value proposition, the customer stories and materials you have saved, and your signature block), the conversation a reply draft answers, and the question you ask about your pipeline. The extension never contacts the AI provider directly.

Anthropic acts as our processor and, under its commercial terms, may not train models on the content we send. We do not train models on your data either.

Opusend makes no decision about anyone that produces legal effects or similarly significantly affects them (Article 22 GDPR). Fit scores, reply readings and suggestions are aids for your decisions. Automatic steps, such as Autopilot skipping a prospect below the fit score you chose, stopping when someone replies, or moving a lead who asks not to be contacted to Blacklisted, follow rules you set or protect the people you contact, and you can review and change each outcome.

Who receives data

We do not sell personal data, and we never show one customer's CRM to another. Sub-processors, which process personal data for us so that Opusend can work, each with one job (their locations and transfer safeguards are on the Subprocessors page):

Anthropic: AI generation of your drafts, reply suggestions, company summaries and the other AI features above. Not used to train models.
Anymail Finder: finds and verifies a prospect's work email address, only when you press “Find emails”, with the data described above. Asked first.
Icypeas: finds and verifies a prospect's work email address, only when you press “Find emails” and Anymail Finder has not found a verified one, with the data described above.
Dropleads: finds and verifies a prospect's work email address, only when you press “Find emails” and neither of the two above has found a verified one, with the data described above. Under its data processing agreement it does not add what it receives to its own database, sell it or use it to train models, and it deletes live-search results within 30 days.
Cloudflare: the network in front of our websites and the app. It protects them from abuse and measures traffic without cookies. It sees your IP address, your browser and the pages you load, and passes your requests to our servers; it never stores your CRM.
Google Analytics: on our marketing site (www.opusend.com) only, and only as described under Cookies. It never runs inside the app.
Our hosting provider: Hostinger International Ltd runs the server and the database that hold the Opusend service and its data, in the United States (Boston).
Backblaze, Inc. (B2 Cloud Storage, EU Central region): a copy of our database backups, encrypted at rest, kept for 30 days.
Emailit: our transactional email provider, which delivers account emails such as address confirmations, password resets and sign-in notices. It receives your email address and the contents of that message.
Lemon Squeezy: our merchant of record for subscriptions, payments and invoices. It receives your email address and your Opusend account and workspace ids so the purchase can be matched to your account, and handles your payment details itself as an independent controller under its own privacy policy.

Other recipients:

The people in your workspace see the shared CRM, as your team's settings allow.
Google, when you choose to sign in with Google or connect Gmail or Google Calendar, under Google's own privacy policy.
Your own mailbox provider, when we send or read mail for a mailbox you added by password.
LinkedIn: the actions you take or schedule with Opusend happen on LinkedIn, in your own browser and account, under LinkedIn's privacy policy. We do not send LinkedIn your Opusend data.
DuckDuckGo and Google: to show a company's logo, the dashboard asks DuckDuckGo's icon service for it, and Google's when DuckDuckGo has none; each receives the company's website domain and your IP address.
Advisers and authorities: our professional advisers under a duty of confidence, and a court, regulator or police authority when the law requires it.
A successor: if the business that runs Opusend is moved into a company or sold, the data passes to the new owner under this policy, and we will tell you first.

International transfers

The business that runs Opusend is established in Albania, and the server that holds the service and its data is in the United States. Some of our providers also process personal data outside the European Economic Area, mainly in the United States. Where the GDPR or the UK GDPR requires it, each transfer is covered by a safeguard: Hostinger, our hosting provider, by the European Commission's Standard Contractual Clauses (and the UK Addendum) in its data processing addendum; Anthropic, by the European Commission's Standard Contractual Clauses in its data processing terms; Anymail Finder, a company in the United Kingdom that hosts data in the United States and Germany, by the Standard Contractual Clauses (and the UK Addendum) in its data processing agreement; Cloudflare and Google, by their certification under the EU-U.S. Data Privacy Framework (and its UK extension) and by Standard Contractual Clauses; Dropleads (Gofindra Product Tech LLP), a company in India whose own providers (Render, Amazon Web Services and Vercel) are in the United States, by the Standard Contractual Clauses (Modules 2 and 3) in its data processing agreement; Lemon Squeezy, by Standard Contractual Clauses. Emailit processes data in the European Union. Icypeas is established and hosts its service in France. When you, as our customer, give us personal data to process for you from the EEA, the UK or Switzerland, our Data Processing Agreement includes the Standard Contractual Clauses where the law requires them. You can ask for a copy of the safeguards at [email protected].

What we keep, and for how long

What	How long
A closed account	30 days, then erased
Cached profile research	Until it is older than your freshness setting
Daily activity counters	30 days
A free trial's browser and network hashes	90 days after the last AI call they backed, then erased
A contact's email address we looked up	12 months from the last lookup
Database backups	30 days, on our server and in an encrypted Backblaze bucket in the EU
Invoices and payment records	7 years, kept by our payment provider

Everything else in your account, such as your leads, messages, notes and settings, stays until you delete it or close your account. In more detail:

A closed account is held for 30 days, so you can ask for it back, then erased; the database backups that still hold it roll off within 30 more days, so it is gone everywhere within 60 days. Ask us and we erase it at once instead.
A lead you delete leaves the live product at once, and our database backups within 30 days.
Sign-in sessions, with their IP address and browser, are kept with your account and erased with it.
Replies and bounces our server reads from a mailbox you added by password: 30 days.
A Google account you connect: until you disconnect it or close your account, when the token is revoked at Google, and at the latest until the account is erased 30 days after closing; database backups that still hold the encrypted token roll off within 30 days.
Meetings found in your calendar: 30 days (a time and an event key, no title or guests).
Notifications in the app: 7 days.
The browser and network hashes kept to stop repeat free trials: 90 days after the last AI call they backed, then erased, and erased with the workspace if that is erased sooner; database backups that still hold them roll off within 30 days.
Billing events Lemon Squeezy sends us stay after your account is erased, as the record behind your invoices, until accounting and tax law no longer requires them.
Our staff's audit trail of support actions on accounts, and the record that an account was erased (without its email address), are kept so that we can show what we did.
Messages sent to us, by email or through the contact form, are kept as long as we need them to answer and follow up, and you can ask us to delete them.
Website analytics: Google Analytics cookies last up to 2 years in your browser, and Google keeps the detailed data no longer than 14 months.
Data in the extension stays in your browser until you clear it in Settings, Data, or remove the extension. One thing stays when you clear it or close your account: the random install id, kept in the browser's extension storage, so that clearing your data is not a way to start another free trial. Removing the extension removes it.

Your rights

Under the GDPR, and similar laws where you live, you have the right to access your personal data, to have it corrected, to have it erased, to restrict how it is used, to receive it in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time, without affecting what was done before.

Most of this you can do yourself in Settings, Data: export everything as a file, correct your details, clear your CRM, or close your account. For anything else, write to [email protected]. We answer within one month, which the law lets us extend by two more months for complex requests, and we may ask you to confirm your identity first. It is free, unless a request is clearly unfounded or excessive.

You also have the right to complain to a supervisory authority: the data protection authority where you live, work or where you believe an infringement happened, or the controller's own, Albania's Information and Data Protection Commissioner (idp.al). We would appreciate the chance to put things right first.

If an Opusend customer contacted you

Our customers use Opusend to find and write to business contacts. If one of them saved your profile or wrote to you, that customer decides why and how your data is used, and is its controller; we process it for them. The data usually comes from your public LinkedIn or Sales Navigator profile as the customer viewed it, from your company's website, from a web search about your company, and, if the customer asked for it, from an email finder: Anymail Finder, Icypeas or Dropleads (your work email address). To exercise your rights, write to the customer who contacted you. If you write to us instead at [email protected], we will pass your request on and help them answer it.

We are the controller of one thing about you: the cache of work email lookups. When a customer looks up your work email, we keep your LinkedIn profile URL with what the email finder returned (your verified work email address) for 12 months from the last lookup, so that the next customer who looks you up is not charged for it again. We keep no personal email address and no phone number, we use the cache for nothing else, and we never sell it. You can object to it or ask us to delete your entry at [email protected]; give us your LinkedIn profile address so we can find it.

Cookies

In the app (app.opusend.com) we set only the strictly necessary cookies our sign-in needs: the session cookie that keeps you signed in, and, during a Google sign-in, a short-lived cookie that protects it. Cloudflare, which protects the app and our website, may set its own strictly necessary security cookies to tell people from bots.

On our marketing site (www.opusend.com), Google Analytics is not loaded until you press Accept on the banner: before you answer, and if you decline, your browser sends nothing to Google and no analytics cookie is written. Accepting loads Google Analytics, which sets its own cookies to count visits and pages. Your answer is remembered in your browser.

The tour video on our home and Features pages is served by YouTube, and only when you press play: until then your browser sends nothing to YouTube. When you press play, the video loads from youtube-nocookie.com, YouTube's privacy-enhanced address, and YouTube (Google) sees your IP address and may set its own cookies or similar storage under its own policy.

You can change your mind at any time: the Cookie choices link in the footer of every page on www.opusend.com brings the banner back so you can accept or decline again. We do not use advertising or cross-site tracking cookies anywhere. Every cookie and similar storage we use is listed in our Cookie Policy.

Security

We protect your data with encryption in transit everywhere (TLS, with HSTS on the app), session cookies that page scripts cannot read, password hashing, encryption of stored mailbox passwords and Google tokens with a key kept outside the database, a strict content security policy on the app, rate limits on sign-in and on public forms, a second factor for our staff's admin access, and nightly database backups that are test-restored on every deploy. Each workspace's data is scoped to that workspace. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires. More detail is on our Security page; report a vulnerability to [email protected].

Children

Opusend is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly collect data about children.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell you by email or in the product before it takes effect.

Not affiliated with LinkedIn or Google

Opusend is an independent product. It is not endorsed by, affiliated with, or sponsored by LinkedIn Corporation or Google LLC. "LinkedIn" and "Gmail" are trademarks of their respective owners.

Contact

Questions or requests: [email protected]. See also our Terms of Service, the Data Processing Agreement, the Subprocessors list and the Cookie Policy.