Privacy Policy

Last updated July 2026

We are District5 Ltd, a company registered with Companies House in England and Wales under number 09960097, whose registered office is at Clifton House, Four Elms Road, Cardiff, S. Wales, United Kingdom, CF24 1LE ("District5"/"we"/"us"/"our").

We provide Sendhit, a desktop and web-based API testing and request management tool ("Service") that can be accessed through our website and applications ("Platform").

Because you use the Sendhit Platform, we process your personal information in accordance with this Privacy Policy (the "Policy"). This is part of the contractual framework you enter into while registering for and using the Service. It specifies the legal basis upon which we process your personal information as data controller.

We are committed to protecting and respecting your privacy and your data rights. If you have any questions or comments about this Privacy Policy, you can contact our data protection officer (DPO) at [email protected].

This Policy explains:

• what information we may collect about you;
• what we may do with the information we collect about you;
• whether we share your information with anyone else;
• the cookies and bot-protection services we use and how you can control these;
• where we store your information;
• how we keep your information secure; and
• the rights you have regarding the personal information you have provided to us.

THIS IS WHAT WE DO WITH THE INFORMATION WE COLLECT ABOUT YOU

1. The information we collect to correspond with you

If you contact us (by email, through the Platform, or any other support channel) as part of our contractual relationship, we may collect and store several pieces of information about you (such as your name, company name, and email address).

We use the data you provide solely to correspond with you and we keep it in case we need to contact you in the future in relation to the issue for which you contacted us.

We may retain this information for one year after our last contact with you. If you report a problem with the Platform, we may keep that information for the same duration.

This information is intended for our use only and will not, under any circumstances, be sold or leased to third parties. This data may, however, be communicated to third-party technical service providers solely for the purpose of delivering our support services.

2. The information we collect to provide you the Service when you use Sendhit

When you register for and use Sendhit, we collect account and usage information from you, which may include:

• your name and email address (used to create and manage your account);
• a hashed password (we never store plaintext passwords);
• profile information you choose to provide (such as a profile picture);
• the API requests, collections, folders, and environments you save within the Service;
• team membership and role information where you use Sendhit as part of a team;
• device information (such as your operating system, browser version, and device type);
• session information (such as login timestamps and session duration);
• connection type and approximate location (city and country, derived from your IP address);
• IP address;
• locale information (such as country, time zone, and language).

We collect this personal information to:

• create and manage your account and provide access to the Service;
• ensure that you are a real person and not a bot;
• enable team collaboration features; and
• help us identify errors in the Platform and improve your experience.

We may retain this information for one year after our last contact with you or after your account is closed, whichever is later.

This information is for our use only and will not be sold or rented to any third party. This data may, however, be communicated to third-party technical service providers solely for the purpose of providing the Service.

3. Cookies, analytics, and bot protection

We do not serve in-app advertisements or sell your data to third parties. Sendhit is funded through subscriptions, not advertising. We do run our own advertising campaigns on LinkedIn and Meta (Facebook and Instagram) to promote Sendhit, and we use the LinkedIn Insight Tag and the Meta Pixel on our marketing pages to measure how effective those campaigns are. This is described in more detail in the Advertisers section below.

We use cookies and similar local-storage technologies only for the following purposes:

• Strictly necessary cookies and tokens - to keep you signed in (session/JWT tokens stored locally in your browser), to remember your cookie consent choice, and to remember in-progress sign-up state.
• Bot protection (Cloudflare Turnstile) - when you visit our sign-up, sign-in, or password reset pages, we use Cloudflare Turnstile to verify that you are a real person and not an automated bot. Turnstile is a privacy-preserving alternative to traditional CAPTCHAs and may set its own cookies on the challenges.cloudflare.com domain to perform this check. Turnstile does not, by design, track you across sites or build an advertising profile.
• Product analytics - to understand how the Service is used in aggregate so we can fix bugs and improve the product. Analytics may collect information such as the pages and features visited within the Platform, time spent on different areas, browser type, operating system, device type, approximate geographic location (country or city level), and referral source. Analytics data is collected in an aggregated or pseudonymous form wherever possible and is never used to display advertising to you.
• Advertising measurement (LinkedIn Insight Tag) - to measure conversions from our LinkedIn advertising campaigns and understand which campaigns lead visitors to sign up for Sendhit. The LinkedIn Insight Tag may set cookies on the linkedin.com domain and collect data such as your IP address, device and browser properties, and page URL. LinkedIn may use this data to show you relevant LinkedIn ads and to provide us with aggregate conversion reports. This technology is only active on our public marketing pages, not inside the authenticated Platform.
• Advertising measurement (Meta Pixel and Conversions API) - to measure conversions from our Meta advertising campaigns (Facebook and Instagram) and understand which campaigns lead visitors to sign up for Sendhit. The Meta Pixel may set cookies on the facebook.com domain and collect data such as your IP address, device and browser properties, and page URL. In addition, we use Meta's Conversions API to send corresponding conversion events to Meta server-to-server; where these events include identifiers such as your email address or IP address, they are hashed before transmission. Meta may use this data to show you relevant ads and to provide us with aggregate conversion reports. This technology is only active on our public marketing pages, not inside the authenticated Platform.

The Turnstile script, analytics scripts, the LinkedIn Insight Tag, and the Meta Pixel are only loaded after you accept cookies via our consent banner. If you decline, you will not be able to sign up, sign in, or reset your password (because we cannot verify you are not a bot), but you can still browse our public website.

The third parties involved in cookies, analytics, and bot protection are:

You can withdraw your cookie consent at any time by clearing your browser's site data for Sendhit. The next time you visit, you will be asked again.

ADVERTISERS

We advertise Sendhit on third-party platforms to promote our Service. To measure how effective our campaigns are - and to understand which ads lead visitors to sign up - we load tracking tags on our public marketing pages. These tags may collect data such as your IP address, device and browser properties, and page URL, and may set cookies that enable conversion tracking and retargeting. Tracking tags are only loaded after you accept cookies via our consent banner.

For some platforms we also use server-to-server conversion measurement (for example, Meta's Conversions API), where we send corresponding conversion events to the advertiser from our servers rather than only from your browser. Where these events include identifiers such as your email address or IP address, they are hashed before transmission. We only do this after you have accepted cookies via our consent banner.

Each advertiser we work with acts as an independent data controller for data it collects through its own tag, and their use of that data is governed by their own privacy policy. We receive only aggregate or anonymised reports - we never see individual-level data about you from these platforms.

The legal basis for loading each advertiser's tag is your consent. You may withdraw consent at any time by clearing your browser's site data for Sendhit, or by using the opt-out link provided for each advertiser below.

We currently use the following advertising platforms:

THIS IS WHO ELSE WE SHARE YOUR INFORMATION WITH

We may disclose your personal information to third parties, but only in the ways that are described in this policy:

• if we are under a duty to disclose or share your personal information in order to comply with any legal or regulatory obligation or request;
• to enforce or apply our terms of use and other agreements, or to investigate potential breaches;
• to protect the rights, property, or safety of our Services or our users;
• if we are involved in a merger, acquisition, or sale of assets - if such an event occurs, we will either notify you directly or place a notice on this privacy policy notifying you of such; or
• to our personnel, contractors, members of our group, our holding company, and any subsidiaries of such parties, as defined in section 1159 of the Companies Act 2006.

THIS IS WHERE WE STORE YOUR INFORMATION

All information you provide to us is stored within the European Union. We use Google Cloud Platform and MongoDB Atlas (hosted within Google Cloud Platform), with all storage and processing regions configured to EU data centres (specifically, The Netherlands). Traffic to and from our Platform is routed through Cloudflare, which provides DDoS protection, bot mitigation, and TLS termination; Cloudflare may process limited request metadata (such as IP addresses) at its global edge network in order to deliver these services.

Where any data is processed by a third party outside the European Economic Area (EEA) - for example, at Cloudflare's edge - we ensure that an adequate level of protection is in place through mechanisms such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an equivalent safeguard.

We suggest that you refer to the privacy policies of those third parties listed above.

If you'd like to find out more about the safeguards we have in place, please email [email protected].

HERE ARE YOUR RIGHTS

You have the following rights over how we process your personal data. We endeavour to respond to any request within 1 calendar month. To issue a formal request, please email [email protected] with your account email address.

You have:

• The right to decline non-essential cookies (you can do this from the cookie consent banner)
• The right to request a copy of your data
• The right to correct your data
• The right to delete your data and close your account
• The right to obtain a portable, machine-readable copy of your data
• The right to make a complaint to a supervisory authority

THE RIGHT TO REQUEST A COPY OF YOUR DATA

You have the right, under the UK GDPR and EU GDPR, to request a copy of the personal data we hold about you (often called a "subject access request" or SAR). This is free of charge.

To make a request, email [email protected] from the email address associated with your Sendhit account. If you cannot send the request from that address, we may ask you for additional information so that we can verify your identity before releasing any data - this is to protect your account from impersonation.

What we will provide:

• your account profile information (name, email address, profile picture);
• the API requests, collections, folders, and environments you have saved;
• your team membership and role information;
• session and device metadata associated with your account (such as login timestamps, IP addresses, and approximate locations); and
• any support correspondence we hold that relates to you.

The data will be provided in a structured, commonly used, machine-readable format (typically JSON) so that you can also use it to exercise your right to data portability. Where the data includes information about other people (for example, members of a shared team), we may redact or omit that information to protect their privacy.

We will respond to your request within one calendar month of receiving it. In rare cases - for example, where a request is particularly complex or where you have made a number of requests - we may extend this period by up to a further two months and will let you know within the first month if we need to do so.

If you believe a request has been refused, ignored, or handled improperly, you have the right to complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/ or to your local EU supervisory authority.

THIRD PARTY SERVICES ACCESSED FROM THE PLATFORM

The Platform may contain links to external services owned and operated by third parties. If you follow a link to any of these services, please note that they have their own privacy policies which govern use of any personal data they process, and for which we cannot be held responsible.

Please note that Sendhit is a tool for storing and organising API requests. When you use Sendhit to interact with third-party APIs, any data you send to those APIs is governed by the privacy policies of those third-party services.

NO MARKETING TO CHILDREN

Sendhit is intended for use by individuals aged 16 and over. We do not knowingly collect personal information from children under the age of 16.

In the unlikely event that we have (or you believe we have) collected information from a child, please contact us by emailing [email protected], where we will take all necessary steps to purge the data from our systems.

INFORMATION SECURITY

We take security seriously. As such, we take all reasonable measures and precautions to ensure any data we hold is safe. These steps include:

• reducing the amount of personal data collected to a strict minimum;
• hashing all account passwords before storage;
• using bearer token authentication with expiring JWT tokens;
• limiting data access to specific authorised personnel; and
• encrypting data in transit and at rest.

Despite all of the precautions and preventive measures we take, no security system or precaution can be 100% secure. In the event of a data breach that affects your rights and freedoms, we will notify you in accordance with applicable law.

3rd Party Subprocessors

Sendhit uses 3rd party subprocessors to help us deliver our products to you. The processors we use are:

CHANGES TO OUR POLICY

Any changes we may make to this Policy in the future will be posted on this page. Where changes are material, we will notify you in an appropriate manner, such as via email or an in-app notification when you next use the Platform.

CONTACTING US IS EASY

We welcome any questions, comments, and requests you may have regarding this Policy. You can contact us by emailing [email protected].

We will respond to you in a timely manner but advise that it might take up to a week for a response, and up to 1 calendar month to process any data-related requests.