1. Who this policy covers
Sellbird is a DBA of Voyage Studios LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. Contact [email protected] for privacy questions or requests. This policy covers our marketing website and hosted outreach service.
We manage account, billing, security and website information for our own service operations. For contacts, messages and other outreach data a customer places in a workspace, that customer generally determines the purposes of processing and we process the data on its behalf. If an organisation manages your workspace, its own privacy notices and administrator settings also apply.
If you receive outreach from a Sellbird customer, the sender is responsible for explaining why it contacted you and handling your privacy rights. You may use the message’s opt-out or contact the sender directly; contact us if you need help identifying or reaching the responsible customer.
2. Our privacy commitment
Your workspace data is private to your account and the users and integrations you authorise. We do not sell or rent customer data, share it for targeted advertising, train AI models on it, or use it to build prospect lists for other customers.
We use customer content only to provide the service you request, protect it, support you and meet legal obligations. Providing the service necessarily involves processing by our infrastructure providers, connected email services and any AI tools or other integrations you choose. Those limited disclosures are described below; "private" does not mean data never leaves your browser or that authorised providers cannot process it.
3. Information we collect
Account information: your name, email address, authentication identifier, organisation, workspace memberships, roles and settings. If you sign in through Google or GitHub, we receive the identity information authorised by that provider, such as your account identifier, email and profile information. Provider sign-in does not by itself authorise access to your mailbox or source-code repositories.
Workspace content: contacts, business details, email addresses, research evidence, buying signals, imports, campaigns, message drafts, sent messages, replies, conversation history, suppression entries and outreach outcomes you or your agents supply.
Connected-service information: authorised tokens or credentials, mailbox and domain identifiers, configuration and DNS status, sending and reply metadata, bounce and unsubscribe events, and the message content needed to provide the features you enable. We do not ask you to put provider passwords into an agent conversation.
Billing and support information: your chosen plan, billing contact, invoices, payment status, authorised purchases and support correspondence. Payment providers process payment details under their own policies; we do not need your full card number to operate outreach.
Technical information: IP address, browser or device information, timestamps, request and authentication events, security and error logs, and operational usage needed for security, reliability, rate limits and billing. Do not put passwords, health records, financial account numbers, government identifiers or other unnecessary sensitive information in contacts, messages or support requests.
4. Where information comes from
We receive information directly from account users, their workspace administrators, connected agents and integrations, email providers, payment services and people who correspond with them. Customers and their agents may supply information from public business websites or other sources they choose. Hosted Sellbird does not make the customer’s sourcing lawful merely by storing it.
Sending and reply processing may receive information about people who do not hold a Sellbird account, including a message sender, recipient, subject, body, timestamps and unsubscribe preference. We handle that information to provide the customer’s communications workflow and honour recipient choices.
5. How we use information
We use information to authenticate users, control workspace access, store and organise contacts, prepare and deliver authorised communications, collect and display replies, enforce suppressions, operate integrations, process agreed payments and respond to support requests.
We also use limited account and technical information to prevent fraud and abuse, investigate incidents, enforce service limits, diagnose errors and meet legal obligations. We do not use message bodies, contact lists or customer research as a training dataset or for unrelated advertising or product profiling.
Where a legal basis is required for processing we control, we rely on performing our agreement, legitimate interests in securely operating the service and preventing abuse, compliance with law, or consent where appropriate. Customers are responsible for the legal basis and required notices for outreach data they control. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.
6. Email permissions and Google user data
Connecting Google Workspace or Microsoft 365 for outreach is separate from signing in. The permissions requested during mailbox setup allow the specified sending, reply collection and administration features. Review the provider’s consent or administrator delegation screen for the precise access you grant.
We use email data to provide the user-facing email features you enable, including sending, displaying and organising messages, replies and recipient preferences. We do not use Google user data for advertising, sell it to data brokers, or use it to train general-purpose AI models.
When you connect a Google mailbox for outreach, Sellbird requests: gmail.send, to send the emails you approve from your mailbox; gmail.readonly, to find replies to those emails so Sellbird can show them to you, stop follow-ups to anyone who replied, and record bounces and unsubscribe requests; and, only if you turn on warmup for that inbox, gmail.modify, so our warmup provider can open warmup emails, move them out of spam and label them, which is how a new inbox builds a sending reputation. Sellbird does not delete your email, change your settings, or use your messages for any purpose unrelated to your outreach and warmup.
If you turn on warmup for an inbox, Sellbird shares short-lived access to that mailbox with TrulyInbox, our warmup provider, solely to send, receive and manage warmup emails for that inbox. That access is an access token that expires within about an hour; TrulyInbox never receives your password or a long-lived refresh token. Turning warmup off stops that access.
Sellbird’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models. Human access to Google user data is limited to circumstances allowed by that policy, such as your specific consent for support, necessary security investigations or legal requirements. We do not permit routine human reading of your mail for unrelated purposes.
You can disconnect a service in Sellbird where available and revoke permissions with the provider. Disconnecting prevents future authorised access but does not automatically erase data previously stored in your workspace. Request deletion separately if you also want stored data removed.
7. Your AI agent and other integrations
When you connect an AI agent through MCP, it may read contacts, research, drafts and conversations within the permissions of the signed-in user. The tool results sent to that agent may be processed by its AI provider. The provider’s terms, retention settings and training choices are separate from Sellbird’s; choose and configure your provider accordingly.
We do not operate a built-in model that trains on workspace content. Connecting your own agent is your instruction to disclose the requested tool results to that client. Revoking the connection stops future access through it but does not delete data the client or provider already received.
Webhooks and other destinations you configure receive the events and information associated with those integrations. Verify the recipient and scope before enabling them. Workspace administrators can control access; private account data may be visible to other authorised users in the same account.
8. When we disclose information
We disclose information to providers that host and secure the service, store data, deliver service emails, process payments or support features you request. These providers receive only the information needed for their role and must handle it subject to appropriate confidentiality and processing obligations. Our infrastructure includes Vercel and Supabase, and TrulyInbox provides warmup for inboxes where you turn it on; your connected email and AI providers also process the data needed for their respective features.
Information is disclosed to recipients when you send them messages and to your authorised team members, client workspaces, agents and integrations as directed by your settings. We may access limited information to resolve a support issue you raise or to investigate a security or abuse incident, with access restricted to that purpose.
We may disclose information when required by law, valid legal process or to protect the rights and safety of users and others. Where legally permitted and appropriate, we will notify the affected customer. If the business is reorganised or transferred, information may transfer with it subject to these privacy commitments and appropriate safeguards.
9. Cookies, website requests and preferences
The marketing website does not use advertising trackers, analytics cookies or third-party behavioural analytics. It counts visits with Vercel Web Analytics, which records the page viewed, the referring site, and the country, browser and device type, without cookies and without identifying you or following you across other sites. The application uses necessary cookies or similar storage for sign-in, security and session operation. Blocking those technologies can prevent authentication or other essential functions.
The website requests the public repository’s star count from GitHub. GitHub receives ordinary request information, including your IP address, when that request occurs. Following an external link or using Google or GitHub sign-in takes you to a service with its own privacy policy.
We do not sell or share personal information for cross-context behavioural advertising, so we do not use a browser opt-out signal to permit those activities. If we introduce optional analytics or other non-essential technologies, we will update disclosures and obtain consent where required before using them.
10. Retention, account closure and deletion
We retain workspace content while your account remains active and it is needed to provide the service you request. Cancel a subscription to stop future renewals; request account deletion separately to remove stored content. Export anything you need before asking us to delete it.
After verifying an authorised account-deletion request, we delete the affected customer content from active systems within 30 days. Backup copies expire within 90 days of the verified request. Backups are restricted to recovery purposes; if a backup is restored, deletion requests must be reapplied.
We may retain the minimum records needed for tax and accounting requirements, payment disputes, fraud and security investigations, legal claims or a legal hold for the applicable required period. We may also retain limited suppression information needed to honour opt-outs. Those exceptions do not permit reusing retained content for marketing or model training.
Deletion from Sellbird does not erase messages already delivered to recipients, data exported by your users, or copies held by independently controlled email or AI providers. Contact those parties for their deletion procedures. We will help with requests involving providers acting on our behalf where applicable.
11. Security and international processing
We use technical and organisational measures intended to protect information, including authenticated access, workspace access controls and restricted service credentials. No network or storage system can be guaranteed completely secure. Protect your accounts, review connected agents and notify [email protected] promptly if you suspect unauthorised access.
Sellbird is operated from the United States. Information may be processed in the United States and other locations used by our service providers or integrations you select, where privacy laws may differ. Where legally required, international transfers must be covered by an applicable adequacy decision, contractual safeguards or another valid mechanism. Contact us about a required data-processing agreement or transfer arrangement before using the service for that processing.
12. Your privacy rights
Depending on your location and the applicable law, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, or appeal a decision about a request. We do not penalise you for exercising applicable privacy rights.
Send requests to [email protected]. We may ask for information reasonably necessary to verify your identity and authority before disclosing or deleting data. Authorised representatives may submit requests subject to verification. We respond within the period required by applicable law and explain any lawful exception.
For workspace content controlled by a customer, contact that customer first. We assist the customer with its obligations rather than independently changing another organisation’s records without authority. Recipients can opt out through the mechanism in a message or ask the sender to stop contacting them.
You may raise concerns with the competent privacy regulator or supervisory authority where you live, work or believe an infringement occurred. Contact us if you wish to appeal our response; this does not limit any right to complain to a regulator.
13. Children
Sellbird is a business service for adults and is not directed to children under 18. Do not use it to collect children’s personal information or target them with outreach. If you believe a child’s information was submitted improperly, contact us so we can investigate and remove it as appropriate.
14. Policy changes and contact
We will update this policy when our practices change and show the revision date. For material changes, we will provide notice through the service or by email where appropriate. We will obtain new consent when required before using information in a materially different way.
Privacy and support: [email protected]. Postal address: Voyage Studios LLC d/b/a Sellbird, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States.
Related information
Contact support or submit a privacy request
Terms of Service · Security · Google API Services User Data Policy