Privacy policy

Two roles

Our customers (people with an emitemail account): we decide how your information is used, so we are responsible for it. Our customers' recipients (people who receive an email sent through emitemail): the customer decides why they are emailed, and we only process their information on the customer's behalf to send, log and troubleshoot the mail. If an emitemail customer emailed you and you have a question about that, ask them first; you can also write to us.

What we collect from customers

• Account: name, email address, and a hash of your password (we never store the password itself).
• Sending set-up: the domains you add, hashes of your API keys, webhook URLs and settings.
• Billing: your plan and subscription status. Card details go straight to Stripe; we do not see or store them.
• Usage and security: how many emails you send, sign-in sessions, and IP addresses used for rate limiting and abuse prevention.

What we process for recipients

• Recipient email addresses, the sender address, subject, tags, and send and delivery status (sent, bounced, complained).
• The content of the email (HTML and text), kept so you can see what was sent from the dashboard. Attachments are relayed and not stored by emitemail.
• A suppression list of addresses that bounced or reported spam, so they are not mailed again.

Please do not put information in emails that you do not need to send. emitemail is not designed for highly sensitive data such as health records or card numbers.

Why we use it

• To provide the service: authenticate you, send and log mail, and show you its status.
• To keep it safe: stop abuse, fraud and spam, and protect the reputation of the mail servers all customers share.
• To bill you and respond to you. To email you about your account: confirmation and password-reset messages, usage alerts and important notices.
• To meet legal obligations.

We do not sell personal information. We do not use customer or recipient email content for advertising, and we do not use it to train AI models.

Who else handles it

• Hosting: our servers run at OVHcloud in Canada (Quebec).
• Payments: Stripe processes subscriptions and card details.
• Receiving mail systems: when we send an email, it goes to the recipient's mail provider, such as Gmail or Outlook, as email always does.
• Your webhooks: if you set up webhooks, we send event details to the URL you give us.
• Authorities, where the law requires it. We may also share what is needed to investigate abuse.

Where it is kept

emitemail's servers are in Canada. Information may pass through other countries when an email is delivered to a recipient's mail provider, or when you use Stripe.

How long we keep it

Account information is kept while your account is open. Your send log and delivery history are kept for 30 days on the Free plan and 90 days on paid plans. The content of your messages is kept for 7 days on the Free plan and 30 days on paid plans. After that period we delete them automatically. Your suppression list is kept until you remove entries from it. When you close your account we delete or anonymise its information, except what we must keep for legal, tax or security reasons (for example, billing records). You can ask us to delete specific logs earlier.

Cookies

We use one essential cookie that keeps you signed in to the dashboard. We do not use advertising or tracking cookies on this site.

Your rights

You can ask to see, correct, export or delete your personal information, to withdraw consent where we rely on it, and to complain if you think we have mishandled it. Write to hello@emitemail.com. We will answer within 30 days. In Canada you can also contact the Office of the Privacy Commissioner of Canada or your provincial regulator, and if you are in Europe, your data protection authority.

Security

Connections to emitemail use TLS. Passwords and API keys are stored only as hashes, SMTP credentials are encrypted, and webhook payloads are signed. No system is perfectly secure; if a breach affects your information in a way that creates a real risk of serious harm, we will tell you and the regulator as the law requires.

Changes

If we change this policy in a way that matters, we will tell customers by email or in the dashboard before it takes effect.

Contact

Xenkloud, privacy contact: hello@emitemail.com.