Privacy Policy

1. Who we are

Envoi is an email and SMS marketing service at envoi.email, operated by ZVN DEV ("Envoi", "we", "us"). This policy explains what personal information we handle when you visit our website or use the Envoi app, API or MCP server (together, "the Service"), what we do with it, and the choices you have.

2. Our two roles

We handle two kinds of personal information, and our role is different for each.

• Account data: information about you and your teammates as Envoi users, such as names, email addresses and billing details. Envoi is the controller of this data.
• Customer data: the contacts, messages and activity you bring into Envoi or collect through it to run your own marketing. You, our customer, are the controller of this data and Envoi is your processor. We process it only to provide the Service to you and on your instructions. We do not sell it or use it to market our own products.

3. If you receive messages from a business that uses Envoi

The business that sent you the message decides what information it holds about you and how it is used. Please read its privacy policy and contact it first with any request about your data. If you contact us instead, we will pass your request to that business or help it respond.

You can stop marketing email at any time with the unsubscribe or preferences link at the bottom of every marketing email. You can stop texts by replying STOP, which stops texts from that business’s brand and does not unsubscribe you from its email.

4. Account data we collect

We collect the account data we need to run the Service:

• Account details: your name, email address, password (stored only as a one-way hash), the workspaces you belong to, and your role in each.
• Sign-in details: if you sign in with an emailed link, we send a single-use link to your address. If you sign in through a third-party identity provider where we offer one, such as Google, Microsoft, GitHub or your company’s single sign-on, we receive your name, email address and, if the provider shares it, your profile picture.
• Security settings: if you turn on two-factor authentication, your authenticator secret (stored encrypted) and your one-time recovery codes (stored as hashes).
• Billing details: your plan, billing status and the billing email for your workspace. You enter payment card details on Stripe’s checkout page, and Stripe holds them. Envoi never receives or stores full card numbers.
• SMS registration details: if you register to send SMS in the United States, the business details carriers require, such as your legal business name, tax ID (EIN), address, website, contact email and phone number.
• API activity: when you or your tools call the Envoi API with an API key, we log the request, including the IP address and browser or client details, so you can review it in your workspace.
• Technical data: our servers and hosting providers process your IP address and browser details to deliver the Service, apply rate limits and protect against abuse. We do not keep a sign-in history of your IP addresses.
• Messages to us: what you send when you email support@envoi.email or privacy@envoi.email.

5. Customer data we process for you

Depending on the features you use, the customer data in your workspace includes:

• Contacts and audiences: email addresses, phone numbers, names, custom fields, tags, lists, segments, and subscription and consent status.
• SMS consent records: for each phone number and each brand you text as, whether the person opted in or out, when, how (for example a signup form, your Shopify store, a contact import or migration, a STOP or START reply, or a teammate recording it by hand, with who confirmed the person consented), the consent wording they agreed to, and a history of every change.
• Messages: the email and SMS content you create, schedule and send, and the templates, automations and journeys behind them.
• Delivery and engagement: when each message was sent, delivered, opened or clicked, and bounces, spam complaints and unsubscribes (see section 7).
• Website activity: page views, events and identification details sent by the Envoi tracking snippet if you install it on your site (see section 8).
• Form submissions: the details people enter in Envoi signup forms, with the page address, the linking page and the browser’s user agent. We do not store the submitter’s IP address. As evidence of consent, each submission also records the checkboxes the form showed, their wording at that moment, and whether each one was ticked.
• Store and integration data: customers, orders and other events from services you connect, such as Shopify. A contact created this way is not subscribed to your marketing unless the source records that they opted in.
• Replies: SMS replies sent to your Envoi numbers, and email replies Envoi receives for your workspace, with their headers. When a reply comes from someone who is not yet a contact, Envoi adds them to your contacts without subscribing them to your marketing.
• Competitor inbox email: the newsletters and other email that brands send to the watch addresses you create. We store the full content of each email, but not the sender’s address or headers. These emails can contain personal information about the people who wrote them or appear in them, and they are visible only in the workspace that created the watch address.
• Media: the images, videos, documents and fonts you upload.

6. How we use information

We use account data for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each is in brackets.

• To provide the Service: create and run your account and workspaces, send your messages and show your reports (performance of our contract with you).
• To keep your account secure: send sign-in links, email verification, password resets and workspace invitations, and run two-factor authentication (contract, and our legitimate interest in security).
• To bill you through Stripe (contract, and our legal obligations for tax and accounting).
• To protect the Service, recipients and carriers: detect abuse, enforce limits and investigate problems (legitimate interests).
• To support you and improve the Service (legitimate interests).
• To meet legal obligations, such as responding to lawful requests (legal obligation).

7. Email open and click tracking

Envoi measures email performance with open and click tracking. Both are on by default, and a workspace can turn either one off in its settings.

• Opens: each email carries a small invisible image. When a recipient’s email app loads it, we record the time, the device type, the email app and the country. We do not store the IP address for opens.
• Clicks: links in your emails pass through Envoi first. Each tracked link carries a signature, so it cannot be altered to send someone elsewhere. For each click we record the time, the link, the IP address, the browser and device, and the country, then send the recipient on to the destination.
• Countries come from our hosting provider, which derives them from the IP address. We do not use a separate location service.
• Unsubscribe and preference links are never recorded as clicks.
• Links in SMS campaigns are shortened and tracked too. For an SMS click we record only the time.

8. Website tracking snippet

If you add the Envoi tracking snippet (envoi.js) to your own website, it sets a first-party cookie called _envoi_vid on your site. The cookie holds a random visitor ID and lasts 365 days (about one year) unless the visitor clears it. It is not shared with other websites.

The snippet sends the following to Envoi so you can see site activity on your contacts and use it in segments and automations:

• Page views: the address of the page, the page that linked to it, and the page title.
• Events your site sends, such as a signup or a purchase: the event name, the details your site attaches, the page address, the linking page, and the time.
• Identification: when your site identifies a visitor, the email address (or a signed Envoi identity token from an Envoi email link or form, which names the contact and expires within an hour) and any details your site passes. When the identification is verified, earlier activity from the same browser is then linked to that contact. When it is not, a new address can still be saved as a contact, but the visitor’s activity stays unlinked and an address that is already a contact is kept only as an unverified claim.

9. Signup forms and the Shopify storefront

Envoi signup forms embedded on your site set the same _envoi_vid cookie. They also store in the visitor’s browser when each form was last shown and how many pages the visitor has seen, so a form does not appear too often.

If you connect a Shopify store, Envoi’s storefront extension records page, product, collection and search views and add-to-cart events. When a shopper is signed in to your store, it identifies them to Envoi by email address, name and Shopify customer ID.

Envoi does not store the IP address or browser details that come with snippet requests.

10. Your responsibilities as a customer

You are responsible for having a lawful basis, and consent where the law requires it, to collect your contacts’ information and to send them email and SMS.

If you install the tracking snippet, you decide what your site sends through it. You are responsible for telling visitors to your site about this tracking, for any cookie or consent notice your local law requires, and for only loading the snippet after consent where that is required. The snippet and embedded forms set their cookie as soon as they load and have no built-in consent switch, so where consent must come first, load them only after the visitor agrees.

You are also responsible for telling your recipients about open and click tracking where the law requires it.

11. Cookies and browser storage on Envoi

The Envoi website and app use a small number of cookies and browser storage entries. Each one is needed to run the app or to remember your own settings. We do not use advertising cookies.

We use Little Friend for privacy-friendly analytics. It sets no cookies and does not store IP addresses. To connect the pages you view in one visit, it keeps a random id in your browser tab’s session storage. The visit ends after 30 minutes of inactivity, and the id is gone when you close the tab. If your browser sends Global Privacy Control, your visit is only counted, never connected.

Some visits are recorded as a copy of the pages you view. We chose to show the text on our pages in these recordings. What you type or choose in forms is never recorded, email addresses and phone and card numbers stay masked, and recordings are deleted within 7 days.

• Sign-in session (next-auth.session-token): keeps you signed in. It lasts up to 7 days.
• Sign-in protection (next-auth.csrf-token and next-auth.callback-url): protect the sign-in form and return you to the right page afterwards. They last until you close your browser.
• Third-party sign-in (next-auth.state, next-auth.pkce.code_verifier and next-auth.nonce): set only while you sign in through another provider, for up to 15 minutes or until you close your browser.
• envoi_onboarded: remembers on this device that you have finished onboarding. It lasts 365 days.
• shopify_oauth_state: set for 10 minutes while you connect a Shopify store, to protect the connection.
• Local storage: your theme, layout and editor preferences, recently used colours, your active workspace’s name, and a sign-in entry that keeps your open tabs signed in or out together.
• Session storage, cleared when you close the tab: an unsaved new campaign draft, the address a verification email was just sent to, and a few screen settings.

12. Browser notifications

If you turn on browser notifications in Settings, we store your browser’s push subscription: the address of your browser’s push service, its encryption keys, and your browser’s user agent. Notifications are delivered through the push service your browser maker runs, such as Google, Mozilla or Apple, which receives the notification’s content.

13. AI processing

Some Envoi features use AI, such as drafting and editing emails with the Pierre assistant in the editor and generating signup forms. These features are in beta. When you or a teammate uses one, the content needed for that request is sent to Anthropic, the company that provides the AI model, to generate a response. That can include your prompt, the email or template you are working on, brand guidelines you have saved, and the subject, preview text and style of any competitor email you choose as an influence.

If Envoi receives email replies for your workspace, it sends each one to Anthropic automatically, with the sender’s name and address and any customer details you hold for them. Anthropic sorts the reply and, unless it is spam, a newsletter or an automated message, drafts a suggested answer using your brand guidelines. Drafts wait for you to review them and are never sent automatically. Apart from replies, AI processing happens only when someone in your workspace uses an AI feature.

We keep a log of AI requests in your workspace with email addresses and phone numbers removed, and we keep your Pierre conversations with the draft they belong to. We do not use your content or your contacts’ data to train AI models.

14. Subprocessors

We share data only with the providers below, and only what each one needs to do its job. Our current subprocessors are:

• Vercel: hosts the Envoi website, app and API. Every request to Envoi, and the data in it, passes through Vercel.
• Fly.io: runs the background worker that sends your email and SMS and runs scheduled jobs.
• Neon: the managed PostgreSQL database where account data and customer data are stored.
• Resend: sends every email Envoi delivers, including sign-in and password emails, and reports deliveries, bounces and spam complaints back to us. It receives each recipient’s address and the message content. It also receives inbound email for watch addresses and replies.
• Telnyx and Twilio: send and receive SMS and provide phone numbers. They receive recipient phone numbers and message content. Telnyx also receives the business details you submit for US carrier (A2P 10DLC) registration, which it passes to the carriers’ registration system.
• Backblaze: stores the images, videos, documents and fonts you upload. Uploaded files are served from public links so they can appear in your emails, so anyone with a file’s link can view it.
• Stripe: subscription billing and payment processing. It receives your workspace name, the workspace owner’s email address, and the payment details you enter on its checkout page.
• Sentry: error monitoring. When something fails, a report of the error is sent to Sentry, with email addresses and phone numbers masked before it leaves Envoi.
• Anthropic: the AI model behind Envoi’s AI features and reply sorting (see section 13).
• WorkOS: single sign-on, for workspaces that sign in through their company’s identity provider. It receives the sign-in details that provider shares, such as your name and email address.
• Little Friend: privacy-friendly analytics for the Envoi website and app (see section 11). It receives the pages you view and the actions you take on them, and an opaque account id when you are signed in, never your name or email address.

15. Stock photos and fonts

The stock photo picker searches Pexels. The words you search for are sent to Pexels. Photos you add from Pexels stay on Pexels’ servers, so when anyone views them, including your email recipients, their email app or browser loads the photo from Pexels, and Pexels receives their IP address and browser details.

The Brand page previews any Google fonts you choose by loading them from Google’s servers, so Google receives your IP address and browser details when you open it.

16. Services you connect

When you connect another service to Envoi, you direct us to exchange data with it. These services are not our subprocessors: you choose them, and your agreement with each one governs how it handles data. They include Shopify, WooCommerce, BigCommerce, Wix, Squarespace, Webflow, Recharge, your own Stripe account, HubSpot, Segment, Zapier, Make, custom webhooks you configure, and contact imports from Klaviyo and Mailchimp.

The credentials you give us for these services are encrypted at rest.

17. Other sharing

We do not sell personal information, and we do not share it for targeted advertising. We never share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing (see section 24).

Apart from the providers above, we share information only:

• Within your workspace: people you invite can see workspace data according to their role.
• When the law requires it: to comply with a valid legal process, or to protect the rights, safety and property of our users, recipients or the public.
• In a business transfer: if the Envoi business is sold or merged, the information may pass to the new owner, who must keep protecting it as this policy describes.

18. Security

No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you as the law requires. These are the measures we use to protect data:

• Data travels to and from Envoi over encrypted HTTPS connections.
• Passwords are stored as bcrypt hashes, never in readable form.
• Two-factor authentication is available for every account. Authenticator secrets are encrypted with AES-256-GCM, and recovery codes are stored as hashes.
• Integration credentials, such as store access tokens and API keys you give us, and the webhook signing secrets we generate for your integrations, are encrypted at rest with AES-256-GCM.
• Envoi API keys are stored only as hashes. The full key is shown once, when you create it.
• Role-based access: each workspace member is an owner, admin, marketer, developer or viewer, and every request is checked against the member’s workspace and role.
• Click-tracking links are signed, so they cannot be altered to redirect your recipients.
• Sessions expire after 7 days, and you can sign out of every device at once from your security settings. Changing or resetting your password also signs out every device.
• Sign-up, sign-in, password reset requests, two-factor codes, and the public tracking and form endpoints are rate limited.
• Our logs and error reports mask email addresses and phone numbers.

19. Retention and deletion

We keep account data and customer data for as long as your account and workspace exist. Envoi does not currently delete data automatically after a fixed period.

• Deleting your account: you can delete your account yourself in Settings. This permanently deletes your user account and every workspace you own, including its contacts, campaigns, send history and reports. If a workspace you own has a paid subscription, it is cancelled first. You cannot delete your account while a workspace you own has other members: transfer ownership or remove them first.
• Deleting your account or a workspace also removes its uploaded files, browser notification subscriptions and queued background jobs. Files you uploaded to a workspace that someone else owns stay with that workspace.
• Deleting a contact: this removes the contact, its list, tag and segment memberships, and its activity events. Records of messages already sent to that address (including opens and clicks), replies from them, and their website and form activity stay in your workspace until the workspace is deleted. Contact us if you need those removed too.
• Opt-outs: when someone unsubscribes, hard-bounces or marks a message as spam, we add their address to your workspace’s suppression list so they are not emailed again. When someone texts STOP, we record an SMS opt-out for that number and brand (or, where the number texted belongs to no brand, add the number to the suppression list). We keep these even if you delete the contact, because they are how we honour the opt-out.
• SMS consent records: we keep each number’s SMS opt-ins and opt-outs, and their history, as evidence of consent even after the contact is deleted, until the workspace is deleted. When a Shopify store asks us to erase one of its customers, we delete that customer’s SMS opt-in records and their history, and keep only their opt-outs, with the consent wording, the evidence and the link to the contact removed, so that the number is never texted again.
• Billing records: Stripe keeps its own records of payments and invoices, which it may be required by law to retain.
• Deleted data may remain in our providers’ backups for a limited time before it is overwritten.

20. Exporting your data

You can export your contacts (CSV or JSON), segments, form submissions and your workspace activity log (CSV) from the app. For anything else, email privacy@envoi.email.

21. Your rights

Depending on where you live, including under the GDPR, the UK GDPR and California law (CCPA), you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. You also have the right not to be treated differently for using these rights.

You can do much of this yourself in the app. For anything else, email privacy@envoi.email. We may need to verify your identity, and we will respond within the time the law requires. You can use an authorised agent where the law allows it. If you are in the EEA or the UK, you can also complain to your local data protection authority.

If your data is in Envoi because a business that uses Envoi collected it, please contact that business first, as described in section 3.

22. International transfers

Envoi’s database (Neon), background worker (Fly.io) and media storage (Backblaze) are hosted in the eastern United States, and Vercel serves the website and app through its global network. Our other providers process data in the United States and other countries where they operate. The data protection laws there may differ from the laws where you live.

23. Children

Envoi is a service for businesses and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, email privacy@envoi.email and we will delete it.

24. Texts from Envoi

If you sign up for texts from ZVN DEV (Envoi) at envoi.email/sms-opt-in, we collect your mobile number, your email address and a record of your consent: the wording you agreed to, whether you ticked the box, and when. We use them only to send you the account notifications and product news you agreed to, and to act on STOP and HELP replies.

Message frequency varies. Message and data rates may apply. Reply STOP to stop the texts at any time, or HELP for help. You can also email support@envoi.email.

We never share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. Text messaging opt-in data and consent are excluded from all of the sharing described in this policy, except with the SMS provider that delivers the texts.

25. Changes to this policy

We may update this policy as the Service changes. When we make a material change, we will update the "Last updated" date above and, where appropriate, notify you by email or in the app.

26. Contact

For privacy requests or questions about this policy, contact privacy@envoi.email. For anything else, contact support@envoi.email.