1. Who we are and what this policy covers
SendAxion is an email infrastructure service for transactional and marketing email. It is provided by Walexbiz Group Ltd ("SendAxion", "we", "us" or "our"), a company based in Abuja, Federal Capital Territory, Nigeria.
This Privacy Policy explains how we handle personal data when you:
- visit sendaxion.com (the "website");
- create or use a SendAxion account, including the dashboard and API at dashboard.sendaxion.com and SMTP submission through smtp.sendaxon.net (together with the website, the "Services");
- buy a plan or add-on; or
- contact us through the AI assistant, live chat, our help desk or by email.
It does not cover the personal data our customers process using SendAxion, such as their contact lists and the emails they send. We process that information on our customers’ behalf, as explained in Information we process for our customers.
Our Cookie Policy explains the cookies and browser storage we use, and our Data Processing Addendum sets out the terms on which we process personal data for customers.
2. Our role: controller and processor
Data protection laws distinguish between the organization that decides why and how personal data is used (the controller) and an organization that processes it on another’s instructions (the processor).
- Walexbiz Group Ltd is the controller of account, billing, support and website data: information about our customers and their team members, people who visit our website, and people who contact us.
- We act as a processor for customer content: contact lists, recipient addresses, message content, delivery and engagement events, tracking data and anything else a customer uploads to or sends through the Services. Our customers are the controllers of that information, and we process it only on their instructions, under our Data Processing Addendum.
3. Information we collect
Account information
When you sign up or are invited to a workspace, we collect your name, email address and phone number (a phone number is required at signup), your password, your workspace name and your role. We store passwords only as a salted hash, never in readable form. We also record when you sign in, the IP addresses you sign in from, and your two-factor authentication settings.
If you sign in with Google or GitHub, we receive your name, email address and the identifier of that account from the provider. We never receive your Google or GitHub password.
You need to give us your name, email address and phone number to create an account, and payment details to buy a paid plan. Without them, we cannot provide those services.
Payment information
Payments are processed by Flutterwave and Paystack. When you pay by card, we store the card brand, the last four digits, the expiry date and a token issued by the payment processor so that your plan can renew. We never receive or store your full card number or security code. We also keep a record of your payments: what you bought, the amount and currency, the date and whether the payment succeeded.
Service data
When you use the Services, we process the information needed to run them, including:
- message metadata and content, as needed to accept, deliver and report on your email, such as sender and recipient addresses, subject lines, headers, message IDs, timestamps and the responses of receiving mail servers;
- delivery events, such as deliveries, deferrals, bounces, rejections and spam complaints;
- opens and clicks, when open or click tracking is turned on. These events record the time, the recipient’s IP address and browser or email-client details, an approximate location derived from that IP address, and the link that was clicked;
- contacts, lists, segments, signup-form submissions, templates, campaigns and journeys;
- suppression lists, unsubscribes and preference choices;
- sending domains and their DNS records, DMARC and TLS reports that mailbox providers send about those domains, and blocklist (DNSBL) results for sending IPs;
- API keys and SMTP credentials (shown to you by name and scope), webhook endpoints and the record of webhook deliveries; and
- an activity log of actions taken in your workspace.
Most service data is customer content that we process as a processor (see Our role). We also use service data as described in How we use information to keep the Services secure and to protect the sending reputation that all our customers share.
Information you send us
- AI assistant. Messages you type into the SendAxion AI support assistant, on our website or in the dashboard, are sent to DeepSeek, which generates the answers. Please do not share passwords, API keys or other secrets in the chat.
- Live chat. Live chat runs on Tawk.to and starts only when you choose Connect to live agent. We then pass your recent conversation with the AI assistant to the live agent and, if you start the chat from the dashboard, your name and email address.
- Help desk and email. Tickets you open at our help desk, emails you send us, any files you attach, and our replies.
- Job enquiries. If you contact us about working with us, the information you choose to send, which we use only to consider you for roles.
Website information
When you visit the website, our servers and network providers receive standard technical information from your browser, such as your IP address, browser type and the pages you request. We use it to deliver the website and keep it secure. To show prices in your local currency, the pricing page may use the country your connection comes from or your browser’s language settings; this is not stored unless you choose a currency yourself, which is then remembered in a cookie.
Our website and dashboard load fonts from Google Fonts, so your browser connects to Google’s servers, which receive your IP address. We do not use analytics or advertising cookies. Our Cookie Policy lists the cookies and browser storage we use.
Information from other sources
- Sign-in providers. Google or GitHub, if you use them to sign in.
- Payment processors. Flutterwave and Paystack tell us whether a payment succeeded and give us the masked card details described above.
- Cloudflare. If you choose Connect Cloudflare, Cloudflare gives us an authorization to manage DNS records on the domains you select. We use it only to publish and check the records SendAxion needs.
- Mailbox providers. Receiving mail servers send us bounces, spam complaints (feedback-loop reports), DMARC and TLS reports, and any email sent to inbound addresses you set up.
4. How we use information and our legal bases
We use personal data only for the purposes below. Where the Nigeria Data Protection Act 2023 ("NDPA"), the EU GDPR or the UK GDPR applies, we rely on the legal bases shown.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the Services | Creating your account, signing you in, sending and receiving email, showing message activity, delivering webhooks | Performance of our contract with you |
| Billing and payments | Charging for plans and add-ons, renewals, receipts, keeping financial records | Contract; compliance with tax and accounting law |
| Security, abuse prevention and deliverability | Verifying new accounts, protecting sign-ins, detecting spam, phishing and fraud, monitoring bounce and complaint rates, enforcing the Acceptable Use Policy | Our legitimate interests, and those of recipients and other customers, in a safe and reputable email network; legal obligations |
| Support | Answering questions in the AI assistant, live chat, help desk and email; investigating delivery problems | Contract; our legitimate interest in helping people who use SendAxion |
| Service communications | Verification codes, security alerts, billing and renewal notices, incident and maintenance notices, changes to our terms | Contract; legitimate interests |
| Improving the Services | Understanding how features are used, using aggregated or de-identified information where possible | Legitimate interests |
| Legal compliance and disputes | Responding to lawful requests, keeping required records, establishing or defending legal claims | Legal obligation; legitimate interests |
| Product news and marketing | Telling customers about new features and offers | Consent, or our legitimate interest in contacting existing customers about similar services where the law allows it. Every message includes an unsubscribe link. |
Where we rely on legitimate interests, we have balanced them against your rights and freedoms, and you can object at any time (see Your rights). Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before.
We do not sell personal data, and we do not use customer content to train artificial intelligence models or for advertising.
Automated checks on sending
To protect recipients and the reputation of our network, we run automated checks on sending activity, such as hard-bounce rates, spam-complaint rates, rejections by mailbox providers, sending to suppressed addresses and sudden spikes in volume. If the results show a risk, sending from a workspace can be paused automatically. When that happens, we tell you why by email and in the dashboard, our team reviews the case, and you can ask for a person to review the decision from the notice in your dashboard or by contacting support.
6. Information we process for our customers
Our customers decide whose personal data they upload to SendAxion and what email they send. If you received an email sent through SendAxion, or your details are in a customer’s contact list, that customer is responsible for your information.
- To stop receiving a customer’s emails, use the unsubscribe link or preference page in their message. Campaign and journey emails sent with SendAxion include a signed one-click unsubscribe.
- To access, correct or delete your information, contact the sender directly. If you contact us instead, we will pass your request to the customer concerned where we can identify them, and help them respond.
- To report unwanted email sent through SendAxion, write to abuse@sendaxion.com.
7. International transfers
Walexbiz Group Ltd is based in Nigeria, and our service providers operate in several countries. Your personal data may therefore be processed outside the country where you live, including in countries whose laws may not protect it to the same standard.
When we transfer personal data internationally, we use the safeguards that the applicable law requires:
- From Nigeria: in line with Part VIII of the NDPA, relying on contractual safeguards that give the data adequate protection, or on another basis the Act permits.
- From the European Economic Area, the United Kingdom and Switzerland: the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum for UK data and the amendments Swiss law requires for Swiss data.
- From other countries, such as Kenya, South Africa and Ghana: the safeguards their data protection laws require, such as binding agreements that provide an adequate level of protection.
You can ask for more information about these safeguards at privacy@sendaxion.com.
8. How long we keep information
We keep personal data only for as long as we need it for the purposes in this policy:
- Account and service data is kept while your account is active, and afterwards for as long as needed to provide the Services, resolve disputes, prevent abuse, enforce our agreements and meet our legal obligations.
- Billing and payment records are kept for as long as tax and accounting laws require.
- Support conversations and tickets are kept for as long as needed to resolve your request and keep a record of the support we provided.
- Security and audit logs are kept for as long as needed to protect the Services and investigate incidents.
- Job enquiries are kept for as long as needed to consider you for roles, and deleted sooner if you ask.
We do not currently delete message logs or delivery events on a fixed automatic schedule; they remain available in your workspace while it is active. You can delete contacts and other content you have created, and owners and admins can request an export of the workspace’s data or the closure of the workspace, in Settings → Account → Data & privacy.
When a workspace is closed, sending stops and sign-in, API keys and SMTP credentials are disabled. Some records, such as payment records and audit logs, are kept where we need them. You can ask us to delete the remaining personal data by writing to privacy@sendaxion.com, and we will do so unless we need to keep it to comply with the law or to establish, exercise or defend legal claims.
9. How we protect information
We use technical and organizational measures designed to protect personal data, including:
- encryption in transit with TLS;
- passwords stored only as salted hashes;
- two-factor authentication available to every account, using an authenticator app or an email code, and required for SendAxion staff;
- encryption of stored secrets, such as credentials and access tokens;
- role-based access for our staff, with an audit log of their actions;
- API keys with limited scopes, and signed webhooks so you can check that events came from us; and
- support access to a workspace only through least-privilege support sessions that are time-limited and logged.
No system is completely secure. Please turn on two-factor authentication, keep API keys and SMTP passwords secret, and replace them if you think they have been exposed. If you believe you have found a security vulnerability in SendAxion, tell us at support@sendaxion.com. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted;
- restrict or object to how we use your data, including objecting to direct marketing at any time;
- receive your data in a portable format, or have it sent to another organization;
- withdraw consent where we rely on it;
- not be subject to decisions based solely on automated processing that significantly affect you, and ask for a person to review them; and
- complain to a data protection authority.
How to exercise your rights. You can update most account details in the dashboard. Owners and admins can request an export of their workspace’s data, or the closure of the workspace, in Settings → Account → Data & privacy. For anything else, email privacy@sendaxion.com, ideally from the email address on your account.
We may need to verify your identity before acting on a request. We will respond within the time limits set by the applicable law, and we will not treat you differently for exercising your rights. If your request is about information a SendAxion customer holds about you, see Information we process for our customers.
11. Additional information for your region
Nigeria
We process personal data in line with the Nigeria Data Protection Act 2023. You have the rights set out in the Act, including those described in Your rights. If you are not satisfied with how we have handled your personal data or your request, you can complain to the Nigeria Data Protection Commission.
European Economic Area, United Kingdom and Switzerland
The legal bases we rely on are set out in How we use information, and our transfer safeguards in International transfers. You can complain to the data protection supervisory authority in the country where you live or work, or where you believe a breach of data protection law took place. In the United Kingdom, this is the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.
California
If the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), applies to our handling of your personal information:
- Categories we collect. In the past 12 months we have collected identifiers (such as name, email address, phone number, IP address and account identifiers); customer records and commercial information (such as plans purchased, payment history and masked card details); internet or other network activity (such as sign-in records, use of the website and the Services, and email engagement events); approximate location derived from IP addresses; and the contents of messages you send us.
- Sources, purposes and disclosures. We collect this information from the sources, and use it for the purposes, described in this policy, and we disclose it for business purposes to the service providers listed in How we share information.
- Sensitive personal information. The only sensitive personal information we collect is your account login with its password, which we use only to provide the Services and keep them secure.
- No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.
- Your rights. You have the right to know what personal information we collect, use and disclose; to request its deletion; to have inaccurate information corrected; and not to be discriminated against for exercising these rights. You can make a request at privacy@sendaxion.com, or through an authorized agent, in which case we may ask for proof of the agent’s authority and verify your identity.
- Retention. See How long we keep information.
Kenya, South Africa, Ghana and other African countries
Where Kenya’s Data Protection Act 2019, South Africa’s Protection of Personal Information Act 2013 (POPIA), Ghana’s Data Protection Act 2012 (Act 843) or another data protection law applies, you have the rights that law gives you, which generally include access, correction, deletion and objection. You can exercise them by contacting privacy@sendaxion.com, and you can complain to the relevant authority, such as Kenya’s Office of the Data Protection Commissioner, South Africa’s Information Regulator or Ghana’s Data Protection Commission.
12. Children
SendAxion is a service for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@sendaxion.com and we will delete it.
13. Third-party services
The website and the Services link to and work with services operated by others, such as Google and GitHub sign-in, the checkout pages of our payment processors, Cloudflare and Tawk.to. Those services have their own privacy policies, which we encourage you to read.
14. Changes to this policy
We may update this policy from time to time. We will publish the updated version on this page and change the date at the top. If we make material changes, we will tell customers by email or in the dashboard before they take effect.
15. Contact us
If you have questions about this policy or how we handle personal data, contact us at privacy@sendaxion.com.
Walexbiz Group Ltd, Abuja, Federal Capital Territory, Nigeria.
- Privacy and data-protection requests: privacy@sendaxion.com
- Support: support@sendaxion.com or our help desk
- Abuse reports: abuse@sendaxion.com
- Legal notices: legal@sendaxion.com