Privacy Policy

This policy describes what data EmailWarmer.io ("we", "us") collects, why, and how it is protected. The short version: we collect what is needed to run warmup and deliverability monitoring for your mailboxes, we encrypt credentials, and we do not sell data.

1. Account data

When you register we store your name, email address, password (as a bcrypt hash — we cannot read it), timezone, and workspace settings. Payments are handled by our merchant-of-record payment provider; we never see or store full card numbers.

2. Connected mailboxes — the part that matters

To warm up a mailbox we need to send and read email on its behalf. Depending on how you connect:

• SMTP/IMAP (app passwords): your credentials are encrypted at rest with AES-256-GCM and used only to send warmup emails and to read warmup-related messages (identified by our tracking header) in your inbox and spam folder.
• Google / Microsoft OAuth: we store encrypted access and refresh tokens scoped to mail send/read. You can revoke access at any time from your Google or Microsoft security settings, or by removing the mailbox.

Our warmup engine touches only warmup traffic: it locates messages exchanged within the warmup network. We do not read, analyze, index, or store your personal or business correspondence.

3. Warmup data

We store metadata about warmup activity — send/receive timestamps, placement (inbox vs spam), engagement events, and reputation scores — to power your dashboard and reporting. Warmup email content is machine-generated by us.

4. Data we do NOT collect

• The content of your regular (non-warmup) email
• Your contact lists or recipient data
• Third-party advertising trackers on the dashboard

5. Retention & deletion

Removing a mailbox stops all warmup activity and deletes its stored credentials. Deleting your workspace removes your account data from the production database; encrypted backups roll off within 30 days. You can request full deletion at any time via [email protected].

6. Third parties

We use a small set of processors to run the service: cloud infrastructure hosting, our payment provider (merchant of record for billing), and an AI inference provider that generates warmup email content (it receives no personal data beyond a sender first name and the industry tags you configure). We do not sell or share personal data for advertising.

7. Your rights

You may access, correct, export, or delete your personal data at any time. Email [email protected] and we will action requests within 30 days. EU/UK users: you may also lodge a complaint with your supervisory authority.

8. Contact

Privacy questions: [email protected]. Security reports: [email protected].