Privacy policy

This policy explains how EterMail ("EterMail", "we", "us"), 3911 Concord Pike, Wilmington, DE 19803, USA, handles personal data. It covers two different situations, because we play a different role in each:

• Our customers' accounts. When you sign up and use EterMail, we decide how your account data is used. We are the controller of that data.
• Our customers' contacts. When you import or sync your subscribers, customers or prospects into EterMail and email them, you decide how that data is used. We process it only on your instructions, as your processor.

If you are someone who received an email sent through EterMail, the sender is responsible for that email. Contact them, or use the unsubscribe link in the email. You can also write to us at [email protected] and we will forward your request.

1. Data we collect about our customers

• Account data: name, email address, sign-in method (Google or one-time email code), workspace and team membership.
• Billing data: plan, invoices and order numbers. Card payments are handled by Stripe; we do not see or store full card numbers.
• Usage data: actions in the app (for example creating, approving and sending campaigns), recorded in an audit log, and technical logs such as IP address, browser and error reports.
• Content you create: campaigns, templates, flows, sequences, brand profiles and replies you write.
• Connected services: if you connect a Shopify store or an outreach mailbox, we store the credentials needed to access it, encrypted.

2. Data we process for our customers

Depending on what you connect, this can include contacts' email addresses, names, locale and time zone, subscription status and consent records (source, time and evidence), order and product data from your store, events your product sends through our API, and the content of emails sent and replies received.

3. How we use data

• to provide the service: syncing data, building segments, sending email, reading replies, billing;
• to keep the service safe: preventing abuse and spam, enforcing our anti-spam policy, securing accounts, and investigating problems;
• to communicate with you about your account, service changes and, if you agree, product news;
• to comply with legal obligations.

We do not sell personal data. We do not use our customers' contact lists for our own marketing, and we do not use them to train AI models.

4. AI features

When you use AI features such as drafting a campaign, personalising an outreach opener or drafting a reply, the relevant content, for example your brand profile, the prospect's company information or the conversation, is sent to an AI model provider for the sole purpose of producing the result. AI output is always a draft for a person to review; nothing is sent without approval.

5. Service providers

We use carefully chosen providers to run EterMail, including cloud hosting and database providers, email delivery providers, Stripe for payments, AI model providers, error monitoring, Google Analytics to understand how visitors use our public website, and Google and Microsoft when you choose to sign in with them or connect a mailbox. They process data only to provide their service to us, under contracts that require appropriate protection. The full list, with what each provider does and which data it may process, is on our subprocessors page.

6. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. Retention

• Account data is kept while your account is active and for a limited period afterwards for legal, tax and security purposes.
• Plain-text bodies of cold emails are deleted automatically after 90 days; delivery records are kept so that unsubscribes and suppressions keep working.
• Unsubscribe and suppression records are kept for as long as needed to make sure people who opted out are not emailed again.
• You can delete contacts at any time, and erase an individual contact's personal data from their contact page.

8. Security

Credentials for connected services are encrypted. Access is limited by role within each workspace, sensitive admin actions are recorded in an audit log, and we use encrypted connections throughout. No system is perfectly secure, but we work to protect your data and will notify you of a breach affecting it as the law requires.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. Account holders can exercise most of these rights in the app or by emailing [email protected]. Requests about data a customer holds in EterMail should go to that customer; we will help them respond.

10. Cookies

We use cookies that are needed to keep you signed in and to remember your language. On our public website (not inside the app), we use Google Analytics to count visits and see which pages are useful; it may set analytics cookies. Visitors in the European Economic Area, the United Kingdom and Switzerland get no analytics cookies: Google receives only cookieless, aggregated signals. We do not use advertising cookies, and analytics data is not used for advertising.

When you arrive on our public website from a campaign link (with utm parameters) or from another website, we store that first visit's source, the page you landed on and the referring page in a first-party cookie (etm_attr, kept for 90 days). If you then create an account, it is saved with your workspace so we can tell which channels bring sign-ups. It is never shared with others or used for advertising, and, like analytics cookies, it is not set for visitors in the European Economic Area, the United Kingdom and Switzerland.

11. Children

EterMail is a business service and is not intended for anyone under 16.

12. Changes

We may update this policy. If the changes are significant, we will notify account holders in advance by email or in the app.

13. Contact

Questions about privacy: [email protected].