Privacy Policy

Overview

SendGoal is a KPI tracking service. We collect only what we need to run the product. We don't sell your data, we don't show you ads, and we don't share your information with third parties for marketing purposes.

What we collect

• Account information — your email address and display name, used for authentication and sending emails.
• KPI data — the KPIs you create (names, values, descriptions, targets, tags) and the data points you log.
• Email interactions — when you reply to a KPI reminder email, we process the reply to extract the reported value.
• API keys — if you generate API keys, we store a hashed version. We never store or log the full key after creation.
• Usage analytics — with your consent, we collect anonymous usage data (sign-ins, KPI creation, feature usage) to improve SendGoal. This includes anonymized session replays. Analytics cookies are only activated after you accept them via the cookie consent banner.

How we use your data

• Provide the service — store and display your KPIs, generate charts and insights, track progress toward targets.
• Send emails — magic link sign-in, KPI reminders (at the frequency you set), weekly dashboard digest, and KPI report emails when values are updated.
• Process API and MCP requests — when you use the REST API or MCP endpoint, we authenticate your API key and process your KPI data.
• Improve the product — understand usage patterns via analytics to make SendGoal better.

Third-party services

We use trusted third-party service providers to operate SendGoal, including for:

• Cloud database and authentication
• Web hosting and content delivery
• Transactional email delivery
• Product analytics and session replay

These providers process data on our behalf and are contractually obligated to protect it. We select providers that offer strong data protection practices and comply with applicable regulations.

Cookies & local storage

• Session cookie (sg-session) — used for authentication. Essential for the service to work.
• Theme preference — stored in local storage to remember your dark/light mode choice.
• Analytics cookies — used to understand product usage. These are only loaded after you accept via the cookie consent banner. You can decline, and SendGoal will work without them.

API & MCP access

When you connect SendGoal to an AI platform or external tool via our API or MCP endpoint:

• Authentication is via API keys you generate. Keys are hashed before storage — we cannot retrieve your full key.
• API requests are logged for rate limiting and abuse prevention (timestamp, key ID, endpoint). Request bodies are not logged.
• The AI platform you connect may process your KPI data according to its own privacy policy. We recommend reviewing it before connecting.

Data retention

• Account data — kept as long as your account is active.
• KPI data — kept as long as the KPI exists. Deleting a KPI removes all its data points.
• Revoked API keys — the hashed key and metadata are kept for audit purposes. They cannot be used to authenticate.
• Email threads — stored for reference and debugging. Deleted when the associated KPI is deleted.

Data security

• All connections are encrypted with TLS.
• Database hosted on secure cloud infrastructure with row-level security policies.
• API keys are hashed with SHA-256 before storage.
• Magic link tokens are single-use and expire after 10 minutes.

Your rights

You can:

• Access your data — view all your KPIs and data points in the dashboard, or export via the API.
• Delete your data — delete individual KPIs from the UI, or permanently delete your entire account and all associated data from Account Settings.
• Revoke API access — revoke any API key instantly from Settings.
• Request a full export — email us for a complete export of your data.

Most of these actions are self-serve. For data export requests or questions, email support@sendgoal.com.

International transfers

Our infrastructure providers may process data in the United States and other regions. By using SendGoal, you consent to your data being transferred to and processed in these locations.

Children

SendGoal is not intended for use by anyone under the age of 16. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via email. Continued use of SendGoal after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Email support@sendgoal.com.