Privacy Policy

Last updated:

Sections 2, 5 and 8 were revised on to describe reply detection more fully; under section 10 the revised sections take effect on .

Sections 2 and 8 were revised on to say that we keep account data while a payment dispute on the account is open; under section 10 the revised sections take effect on .

This policy describes what personal data SEMAOS (operated by DevilDog Lab) collects, why we collect it, and the controls you have over it. We treat the data you trust us with as a liability, not an asset — we collect only what we need to run the product.

Note: Full legal review is in progress. The substance below describes our current practices accurately; the formal language will be tightened with counsel before general availability. If anything here is unclear, write to privacy@semaos.io and we'll get back to you within five business days.

1. Who we are

SEMAOS is a product of DevilDog Lab, a US-based company. We're the data controller for account-holder data, and a data processor for the contact records our customers upload to the service.

2. Data we collect

From you (the account holder)

  • Name, email address, and password hash (used for login).
  • Business name + physical mailing address (required by CAN-SPAM for outgoing email footers — see our Terms of Service).
  • Billing information processed by Stripe — we never see or store your card number directly.
  • Optional: WebAuthn passkeys, custom sending domain, time zone.
  • Product usage: the pages you visit and the buttons you click on semaos.io, with your browser, device, screen size, time zone, approximate location (from your IP address) and the site or campaign that brought you, collected by our analytics provider HeyCatch (see section 4).
  • We also count page views with Vercel Web Analytics: the page address, the site that referred you, and your browser, operating system, device type and country. It sets no cookies and does not identify you.

About your contacts (the recipients of your campaigns)

  • Email addresses, names, and company affiliations you upload or sync.
  • Engagement events — opens, clicks, replies, bounces, unsubscribes.
  • Replies to emails sent while reply detection is on. With reply detection turned on, sequence emails that SEMAOS sends through its own sending service (rather than from a connected mailbox) carry a reply address on a SEMAOS domain. Every message that arrives at that domain is stored in full, including its headers, body and attachments, in Amazon S3, and deleted after 30 days. SEMAOS ignores automatic replies, such as out-of-office messages, and messages without a valid SEMAOS reply address, though they are stored like any other. For a reply to one of your sequence emails, SEMAOS records when it was processed, the sender's address and the message's ID, stops the sequence for that contact, and, when the reply comes from the contact's own address, is 10 MB or smaller, and is one of the first three forwarded for that enrollment, forwards the whole message, attachments included, to your account: to your configured reply-to address, or else to your default From address if it is on your own verified domain, or else to your account admin's email address. SEMAOS does not forward a reply that Amazon SES marks as containing a virus or as failing the sender's DMARC check. When a reply is not forwarded, SEMAOS may send the address a forward would have gone to a short notice with the sender's email address and the reason, at most once per reason for each enrollment and never for a deleted contact, without any of the message's content.
  • Suppression status — unsubscribes and hard bounces are retained for the life of your account to prevent accidental re-sending, then deleted along with your other data when your account is purged (30 days after closure), except while a payment dispute on the account is open, when we keep it until the dispute is resolved.

3. How we use the data

  • To send the emails you ask us to send, and to give you the metrics about those sends.
  • To enforce plan limits (send caps, contact caps) and CAN-SPAM compliance.
  • To improve the product, using analytics on how SEMAOS is used (see HeyCatch in section 4). We do not train models on your contact data.
  • To meet legal requirements (subpoenas, retention orders, etc.) — only when required by law.

4. Sharing & subprocessors

We share data only with the subprocessors required to operate the product:

  • AWS — hosts our Lambda functions, Postgres database, Amazon SES email-sending infrastructure, and S3 file storage.
  • Stripe — payment processing.
  • Vercel — hosts the marketing and application web layer, and provides Vercel Web Analytics, which receives page views as described in section 2. We apply the same removals as for HeyCatch: no page-address searches, password-reset or invitation links.
  • Anthropic (AI drafting) — the text a user types into the draft form, processed to generate a suggested email; not used to train models.
  • HeyCatch (product analytics) — the usage data described in section 2, and for signed-in users their name, email address, plan and role, used to understand how the product is used. Inside the app we remove what was clicked (its text, labels and links) and anything typed into a page address, such as a search, before it is sent, and we never send password-reset or invitation links, so the contact records you keep in SEMAOS are not shared.

We do not sell personal data, and we do not share it with third parties for their own marketing.

5. OAuth and connected accounts

SEMAOS can connect to your Gmail or Outlook account (via Google and Microsoft OAuth) so that sales emails send from your own address and replies reach your own inbox. Connecting is optional and per-user — you choose to connect on your settings page, and you can disconnect at any time.

If you connect an account, we request only these permissions:

  • Sign-in identity (Google openid and email / Microsoft User.Read, openid, email and offline_access): when you connect, SEMAOS reads your account profile once to learn which email address you connected, and keeps only that address. Microsoft's offline_access lets SEMAOS stay connected without asking you to sign in again; Google gives the same through its standard offline access.
  • Send email (Google gmail.send / Microsoft Mail.Send) — used solely to send the sequence and one-off emails you compose in SEMAOS, on your behalf, from your connected address.
  • Read mail (Microsoft Mail.Read, Outlook only): used only to detect when a contact replies to an email SEMAOS sent for you, so the sequence stops for that contact and a one-off email is marked as replied. Microsoft grants this permission as read access to your whole mailbox, but SEMAOS reads only what is described here. It checks every working Outlook mailbox you connect, whether or not reply detection is turned on in your settings (that setting covers replies to emails SEMAOS sends through its own sending service, described in section 2). About every 15 minutes it lists the messages that have arrived in your Outlook inbox since its last check and reads the headers of every one, including the subject line, along with its sender, time received, message ID and conversation ID. It never reads message bodies or attachments. When a message's conversation is not already known to contain an email SEMAOS sent, which is true of most of your mail, it also reads the headers of up to 50 messages in that conversation, in any folder (including Sent Items and Deleted Items), looking for the ID SEMAOS adds to every email it sends. A message counts as a reply when it is in the same conversation as an email SEMAOS sent or, failing that, when its sender is a contact you emailed through SEMAOS. Automatic replies, such as out-of-office messages, are skipped. For a reply, SEMAOS stores when it was found and the sender's address, plus the reply's message ID for a one-off email, and it saves the conversation's ID on the SEMAOS emails in that conversation. Apart from a timestamp recording how far it has read, it saves nothing from any other message, though our service logs can record a message's ID when reply detection skips one as an email SEMAOS sent or fails to process it. Gmail connections do not request this permission: SEMAOS requests no read access from Google, so reply detection is not available for Gmail.
  • Calendar access (Microsoft Calendars.ReadWrite, Outlook only): SEMAOS requests this permission, so Microsoft lists it when you connect, but SEMAOS never reads or changes your calendar. Google connections do not request any calendar permission.

OAuth tokens are stored encrypted at rest, scoped to your individual user within your tenant, and never shared with any third party. Disconnecting your account in SEMAOS deletes the stored tokens immediately; you can also revoke SEMAOS's access from your Google or Microsoft account security settings, which invalidates the tokens on the provider side. Data obtained through these permissions is retained only as long as needed to provide the features above and is deleted with your account.

SEMAOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies

We use a small number of first-party cookies for session continuity and theme preference. We also use HeyCatch for product analytics: it keeps a visitor ID in a cookie and in your browser's local storage so it can count pages and clicks across visits. The ID is anonymous until you sign in, when it is linked to your account. We do not use advertising cookies, and we do not sell this data. The cookie notice you see on first visit reflects this; click Got it to dismiss. Vercel Web Analytics uses no cookies or local storage.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export the personal data we hold about you. To exercise any of these, write to privacy@semaos.io. We respond within 30 days and never charge a fee for routine requests.

8. Data retention

Account data: kept while your account is active and for 30 days after deletion, then purged, except while a payment dispute on the account is open, when we keep it until the dispute is resolved. Messages received at SEMAOS's reply domain (section 2) are stored in full and deleted 30 days after they arrive. Suppression records (bounces + unsubscribes) are kept for the life of your account to support anti-spam compliance and then treated like the rest of your account data: purged 30 days after closure, except while a payment dispute on the account is open, when we keep it until the dispute is resolved.

9. Security

Data in transit is encrypted with TLS 1.2+ — including internal connections between our application services and the database, which verify the database server's certificate on every connection. Data at rest is encrypted via AWS-managed keys. Tenant data is isolated via row-level security at the database layer — see our public architecture docs for the technical detail.

10. Changes to this policy

Material changes are announced via in-product banner + email to account holders at least 14 days before they take effect. Non-material updates (typos, clarifications) are dated at the top of this page.

11. Contact

Questions, requests, or disputes about how we handle data: privacy@semaos.io. Postal mail to the DevilDog Lab mailing address listed on our About page.