Your data is your data.
We just route it.

The short version.

If you don't want to read every section, here's what you need to know:

• We don't sell your data. Not to advertisers, not to data brokers, not to anyone. Ever.
• Your customer list is yours. Contact data you upload, replies your customers send, and the content of your campaigns stay inside your workspace.
• We process only what we needto run the product — sending mail, classifying replies, signing with your DKIM key, billing your account.
• You can export or delete your data at any time. Delete cascades through every system within 30 days.
• We tell you 30 days in advance before adding a new sub-processor that touches your data.

Scope of this policy.

This policy describes how Email Digit Inc. ("Email Digit," "we," "us") handles personal data when you:

• Visit any page on emaildigit.com or its subdomains.
• Sign up for the product, including the free tier and any private-beta access.
• Use one of our free public tools (deliverability lookup, DMARC analyzer, spam-score checker, render preview).
• Receive an email sent throughEmail Digit by one of our customers (you are a "message recipient" in that case).

If you're a message recipient, the customer who sent you the message is the "controller" under GDPR / UK GDPR. We're a "processor" acting on their instructions. Requests about the content of those messages should go to the sender; requests about the technical processing can come to us at privacy@emaildigit.com.

Data, grouped by why we have it.

Purposes are limited and explicit.

We process the data above only for the purposes listed here. If a use case isn't on this list, we don't do it.

• Run the product— send your mail, poll your mailboxes, classify your replies, sign with your DKIM key, deliver webhooks to your endpoints.
• Bill you— invoice, take payment, and meet tax-reporting obligations.
• Secure the platform— detect abuse, enforce rate limits, investigate incidents, comply with our Acceptable Use Policy.
• Improve the product— aggregate, anonymized telemetry on which features get used and where errors happen. Never on the content of your messages or contact data.
• Communicate with you— transactional emails (receipts, security alerts, sub-processor updates), occasional product announcements you can opt out of.
• Comply with law— respond to valid legal process. We push back on overbroad requests and publish a transparency report annually starting year two.

What we will never do

• Sell your data to anyone.
• Share your contact data with advertisers or data brokers.
• Train external AI models on the content of your messages.
• Read your replies for marketing purposes.
• Use cookies to track you across other sites.

Why processing is lawful, by purpose.

Under GDPR and UK GDPR, every processing activity needs a lawful basis. Ours, by purpose:

• Contract— running the product you signed up for. Covers sending, mailbox sync, reply classification, billing, support.
• Legitimate interest— security, abuse prevention, fraud detection, telemetry for reliability. We balance these against your rights and document the assessment.
• Legal obligation— tax records, responding to lawful requests, retaining audit logs as required by applicable law.
• Consent— optional product emails you can withdraw at any time. Consent isn't the basis for the product itself; you don't need to consent to marketing to use Email Digit.

Sub-processors, listed and notified.

We use a small set of vendors to run the platform. Every one is listed publicly on the Security page with purpose, region, and the categories of data they touch. We notify customers 30 days in advance before material additions to that list.

Beyond sub-processors we may share data with:

• Receiving mail servers— obvious but worth saying. When you send an email through Email Digit, it goes to the recipient's mail server. Their privacy policy applies once it arrives.
• Law enforcement— only with a valid legal process. We require proper jurisdiction, push back on overbreadth, and notify customers unless legally prohibited.
• Acquirers— in the event of a merger, acquisition, or asset sale, your data may be transferred under equivalent privacy commitments. You'll be notified.

We do not share with advertisers, data brokers, analytics resellers, or any AI vendor for the purpose of training their models on your content.

Retention windows by data type.

What we do to protect this data.

The full posture is documented on the Security page. The headline: AES-256 at rest, TLS 1.3 in transit, Fernet envelopes for PII / OAuth tokens / DKIM keys, Postgres Row-Level Security for tenant isolation, encrypted backups with 30-day point-in-time recovery, append-only audit logs, and a published incident-response policy with 15-minute status-page commitments for Sev-1 events.

No system is invulnerable. If we discover a breach affecting your personal data, we notify the relevant supervisory authority within 72 hours and the affected customers without undue delay.

What you can ask us to do.

Depending on where you live, you have some or all of the following rights under GDPR, UK GDPR, CCPA / CPRA, the India DPDP Act, and other regional laws:

• Access— a copy of the personal data we hold about you.
• Correction— fix inaccurate or incomplete data.
• Deletion— remove your data, subject to legal-retention obligations.
• Portability— export your data in a structured, machine-readable format (CSV + JSON).
• Restriction— ask us to pause certain processing.
• Objection— object to processing based on legitimate interests.
• Withdraw consent— at any time, for any processing based on consent.
• Complain— to a supervisory authority. For the EU, that's the DPA where you live.

Most of these are self-serve from your dashboard. For anything you can't do from the UI, email privacy@emaildigit.com from the address on file. We respond within 30 days (extendable to 90 for complex requests, with notice).

California (CCPA / CPRA): we do not sell or share personal information as those terms are defined in California law. You have the right to know, the right to delete, the right to correct, and the right to non-discrimination for exercising any of them.

What we set and why.

We use a minimal set of first-party cookies and localStorage values. No third-party tracking, no advertising pixels, no session replay tools.

• Authentication— an HTTP-only session cookie + a JWT in localStorage so you stay logged in.
• Active workspace— we store the ID of your active workspace in localStorage so the dashboard remembers which one to load.
• CSRF token— short-lived, set on forms that mutate state.
• Operational telemetry— basic error rate + performance markers. Aggregated; no cross-site identifiers.

You can clear all of these from your browser at any time; you'll just be logged out and need to sign in again.

Where your data lives.

Today, customer data lives in the United States — us-west-2 for application hosting (Render) and us-east-2 for the database (Neon). EU residency in eu-west-1 and India residency in ap-south-1 are on the roadmap for Q4 2026.

For EU + UK customers, transfers outside the EEA / UK rely on the European Commission's Standard Contractual Clauses incorporated into our DPA, plus the UK Addendum where required. We conduct a transfer-impact assessment for each material sub-processor.

This is a business product.

Email Digit is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@emaildigit.com and we'll delete it.

How we notify you.

Material changes are emailed to account owners at least 30 days before they take effect. Non-material clarifications (typo fixes, structural cleanup) are published with an updated version number at the top of this page. Every revision is kept in our public changelog.

If you keep using the product after a material change takes effect, that constitutes acceptance. If you don't accept, you can export your data and close your account at any time.

Talk to a human.

Privacy questions, deletion requests, DPA requests, anything else — reach us at privacy@emaildigit.com. Security disclosures should go to security@emaildigit.com instead; the security page has the PGP key.

Controller of record: Email Digit Inc., operating from the United States. Mailing address available on request for legal correspondence.