GDPR and data residency

Who you are contracting with

SendHeron is operated by Kohi Solutions Ltd, a company registered in Bulgaria, an EU member state.

• str. Filip Simidov 1, entr. B, floor 3, apt. 11, Veliko Tarnovo 5000, Bulgaria
• EU VAT number: 206220247

Under the GDPR, you are the controller of your contacts' personal data and Kohi Solutions Ltd is your processor. We process contact data only to provide the service, on your instructions.

Where your data lives

Your contact records, the events you track against them, and your sending history are stored and processed in the European Union.

What we deliberately do not claim: SendHeron is not "sovereign", not "CLOUD-Act-proof", and not "Schrems-II-proof". Those phrases get used loosely in this market and none of them are things a small EU company can honestly promise. What we can say is that the company is European, the data sits in the EU, and the sub-processor list is public.

Sub-processors

We are finalising the sub-processor list ahead of the public beta and will publish it here in full, as a table naming every third party, what it does, and where it processes data. If you need it before then, email [email protected] and we will send you the current list rather than ask you to wait.

Data processing agreement

A GDPR-compliant DPA is available to every customer at no cost. Email [email protected] and we will send it over. A self-serve PDF is coming; for now a human sends it, which also means you can raise redlines in the same thread.

Export, deletion, and your contacts' rights

Your contacts have rights under the GDPR, and because you are the controller, requests normally reach you first. We support you in answering them:

• Export. Every contact, tag, event, and send record is readable over the REST API, so you can pull a full export yourself at any time without asking us.
• Deletion. Deleting a contact through the API or the dashboard removes the record and its associated events. Backups age out on their own retention cycle.
• Account closure. Ask us to close your account and we delete your workspace data.
• Unsubscribes. Every marketing email carries one-click unsubscribe, and an unsubscribe is honoured across your whole workspace rather than per sequence.

Contacting us about data protection

Write to [email protected]. A person reads it. We are a small company, which is the reason you get a human rather than a ticket number.