Privacy Policy

Last updated 28 October 2026

1. Who we are

Izzy (izzysend.com) is operated by Joshua Nahason Wijaya, an individual based in Surabaya, Indonesia. For data about your account and our website, we are the controller. Contact: support@izzysend.com.

For data about the people you email with Izzy (your leads and their replies), you are the controller and we are your processor. We handle that data only on your instructions, to provide the service.

2. What we collect and why

• When you email us (for early access or support): your email address, name, and what you write. We use it to reply and, if you asked for early access, to tell you when Izzy opens.
• Your account: name, email address, business name, website and country, to run your account and review it before sending is switched on. If you tick the separate, optional box, we may also email you about other services; you can opt out at any time.
• Billing: Lemon Squeezy processes your payment. We receive your name, email, country, plan and payment status. We never see your full card number.
• Mailbox connections: your mailbox address and app password, to send email and read replies. App passwords are encrypted, with the encryption key kept apart from the database.
• Email data: to detect replies and bounces, Izzy reads your mailbox over IMAP. We store message headers and the short part of the text needed to match replies. Replies to your campaigns are stored so you can read them in Izzy.
• Leads you upload: the fields in your files, such as names, email addresses, companies and custom fields, to send your sequences.
• Security logs: IP address, browser and time of requests, to keep the service secure and fix problems.

Our legal bases under GDPR are performing our contract with you (account, billing, sending), our legitimate interest in running a secure service and answering messages, legal obligations (tax records), and your consent where we ask for it (optional marketing emails).

3. This website

izzysend.com doesn't use analytics or advertising cookies or trackers. Our hosting provider, Cloudflare, processes your IP address to deliver the site and protect it from attacks. If we ever add analytics or advertising tags, we'll update this page first and ask for your consent where the law requires it.

4. How long we keep it

• App passwords: deleted immediately when you remove a mailbox. We'll remind you to revoke the app password in your Google account too.
• Replies: 90 days.
• Leads, email content and other workspace data: deleted within 30 days after you cancel or close your account.
• Account details: while your account is open, and up to 30 days after you close it.
• Security logs: up to 30 days.
• Billing records: as long as tax law requires.
• Early access and support emails: until you ask us to delete them, or 24 months after our last conversation.

5. Who processes data for us

We use these providers to run Izzy. Each only gets the data it needs for its job.

• Lemon Squeezy (United States): payments, invoices and tax, as merchant of record.
• Hetzner Online (European Union): the servers that run Izzy and store its database.
• Cloudflare (global): website hosting, DNS, forwarding of support@izzysend.com, and storage for encrypted backups.
• Resend (United States): login links and account notifications.
• Google: our support inbox, and your own Google Workspace mailboxes through the connection you make.
• Telegram: internal alerts to the operator, which may include a workspace name or mailbox address.

We don't sell personal data, and we don't use your leads or email content for anything other than running your account.

6. International transfers

Izzy is operated from Indonesia, our servers are in the European Union, and some providers are in the United States. Where data leaves the EU or UK, we rely on our providers' safeguards, such as the European Commission's Standard Contractual Clauses.

7. Security

Data travels over encrypted connections (TLS). App passwords are encrypted at rest with a key stored separately from the database, and backups are encrypted. If a breach affects your data, we'll tell you without undue delay and explain what to do, such as replacing your app passwords.

8. Your rights

You can ask us to access, correct, export or delete your personal data, to restrict or object to how we use it, or to withdraw consent. Email support@izzysend.com and we'll answer within 30 days. If you're in the EU or UK, you can also complain to your local data protection authority. These rights also apply under Indonesia's Personal Data Protection Law.

9. If you received an email sent with Izzy

That email was sent by one of our customers from their own mailbox. They decided to contact you and they control your data. Use the unsubscribe link or reply to ask them to stop. You can also email us: we'll add you to that sender's suppression list and pass your request on to them.

10. Children

Izzy is a business service and isn't meant for anyone under 18.

11. Changes

We'll update this page when our practices change and change the date at the top. For significant changes, we'll email active customers before they take effect.