Privacy Policy

Last modified: April 2026

1. Introduction

Email Intelligence Platform ("EIP", "we", "us", or "our") provides email tracking, campaign management, and sales intelligence services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at eip.at-work.biz.

This policy covers personal data processing in two contexts: (i) when users access our services, and (ii) when processing recipient data on behalf of users.

2. Data We Collect

2.1 User Account Data

When you create an account, we collect:

• Name and email address
• Password (stored as a bcrypt hash — we never store plain-text passwords)
• Google OAuth tokens (if you connect Gmail — encrypted with AES-256 before storage)
• Account preferences and notification settings

2.2 Email Tracking Data

When you send tracked emails, we process on your behalf:

• Email subject, body content, and recipient addresses
• Open events (timestamp, IP address, user agent)
• Click events (timestamp, link URL, IP address, user agent)
• Spike detection (multiple opens within a short period)
• Revival detection (reopens after 7+ days)

2.3 Automatically Collected Data

• Device information (browser type, operating system)
• Log data and usage patterns
• Cookies and similar technologies for authentication

3. How We Use Your Data

We process your data for the following purposes:

• To provide, maintain, and improve the Service
• To send email tracking notifications (opens, clicks, spikes, revivals)
• To generate daily and weekly activity reports (if enabled)
• To communicate service-related updates
• To ensure security and prevent abuse
• To comply with legal obligations

4. Legal Basis for Processing

• Contract performance: Processing necessary to provide the Service you signed up for
• Legitimate interest: Service improvement, security, and communications
• Consent: Where required (e.g., non-essential cookies, marketing communications)

5. Data Sharing

We do not sell your personal data. We share data only with:

• Service providers: Hosting (database, server infrastructure), email delivery
• Google: Via the Gmail API (only when you connect your Gmail account)
• Legal authorities: When required by law or to protect our rights

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon account deletion:

• Account data is deleted within 30 days
• Email tracking data is deleted within 30 days
• Backups are purged within 90 days

We may retain anonymized, aggregated data that does not identify you individually.

7. Data Security

• All data in transit is encrypted via TLS/HTTPS
• Passwords are hashed using bcrypt
• OAuth tokens are encrypted with AES-256 (Fernet/PBKDF2) before database storage
• Access to production systems is restricted and logged

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your data (right to erasure)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

9. Use of Google APIs

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We:

• Only request the minimum scopes necessary (Gmail send, Gmail read)
• Do not sell or share Google data with third parties
• Do not use Google data for advertising purposes
• Store OAuth tokens encrypted at rest
• Allow users to disconnect their Google account at any time

10. Recipient Opt-Out

Email recipients who wish to exercise their data protection rights should contact the sender (our user) directly. We provide a contact email below to assist recipients in reaching the relevant user.

11. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies. Analytics cookies are set only with your consent.

12. International Data Transfers

Data may be processed on servers outside your country of residence. We ensure appropriate safeguards are in place, including standard contractual clauses where required.

13. Children's Privacy

Our Service is not intended for individuals under 18 years of age.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website.