Privacy Policy

What we store

When you connect your account to us we need to store some information so we can communicate with your storage provider.

They do not give us your password — just a token which we can use to access your storage when you send emails in.

We keep your name on file to improve your experience on this site.

We store any preferences you set for your account.

When you sign up we note where you came to us from (for example the name of a search engine, or a link with ?ref= in it), using a small cookie on emailitin.com. We use it only to see which places bring us new users; it is never shared.

We keep a log of the attachments you send in (the file name and the time it arrived) so you can see your deliveries, and for statistical purposes.

What we don't store

We never keep the contents of your emails. While an email is being delivered, its attachments are written to a private temporary folder on our server so they can be uploaded to your storage provider. They are deleted as soon as the delivery is finished.

We don't store any information about who sent the attachments in.

Where we are

We are based in Canada. Our servers are hosted by Amazon Web Services in its US East (Ohio) region. Your storage provider is likely also located in the USA.

Data sharing and disclosure

When you connect a storage provider, we transmit your files and the OAuth access token for your account directly to that provider's servers. The third-party services we integrate with include:

• Google Drive (Google LLC)
• Microsoft OneDrive and SharePoint (Microsoft Corporation)
• Dropbox (Dropbox, Inc.)
• Box (Box, Inc.)
• Egnyte (Egnyte, Inc.)

If you connect Zapier (Zapier, Inc.) with an API key from your settings, we send Zapier the details of each file we file for you: its name, folder, size, when it was filed, the storage service, and the subject, sender and address of the email it came with. Never the file itself or your storage access token. Zapier handles them under its own privacy policy. We keep only a fingerprint (hash) of your API key, not the key. Deleting the key in your settings stops it at once.

We do not sell, rent, or share your personal information or Google user data with any other third parties, advertisers, or analytics services.

We may disclose data if required to do so by law or in response to valid legal process.

Email It In's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data protection

We take the following measures to protect your data:

• All data transmitted between your browser, our servers, and your storage provider is encrypted using HTTPS / TLS.
• OAuth tokens stored in our database are kept in an access-controlled environment. Direct database access is restricted to authorised server processes only.
• We do not log or persist the contents of your emails or attachments on our infrastructure.
• You can revoke our access to your Google account at any time via your Google Account security settings.

Data retention and deletion

We retain your account data (name, OAuth tokens, and preferences) for as long as your account remains active.

If you wish to delete your data, you may:

• Contact us at privacy@emailitin.com to request deletion of your account and all associated data.
• Revoke our OAuth access directly from your storage provider's security settings (e.g. Google Account permissions). Revoking access removes our ability to store files to your account; contact us to also remove your stored profile information.

Upon a verified deletion request we will remove your personal information from our active systems within 30 days.