1. Information We Collect
We collect information you provide directly to us, such as when you create an account, subscribe to our services, or contact us for support. We also collect information automatically through analytics and cookies.
- Account information (email address, display name, password or OAuth provider)
- Authentication method (email/password or Google Sign-In)
- OAuth data (if you sign in with Google: email address, name, profile picture provided by Google)
- Profile customization (profile image, display name, profile color)
- Payment information (processed securely through Stripe)
- Email campaign reports and metrics you create or import
- ROI and lead data you import or sync from connected e-commerce and lead generation platforms (e.g., Shopify, Typeform, etc.)
- Third-party API credentials you provide (email marketing, ROI, lead platform API keys, OpenAI API keys) - stored encrypted
- Scheduled report preferences (email recipients, frequency, timing)
- Usage data and analytics (e.g., page views, feature usage, device/browser info)
- Communication preferences and feedback
- AI chat history and interactions (when using AI Assistant feature)
- Workspace data — workspace names, settings, and configuration
- Team membership data — roles and access levels of team members within your workspaces
- Invitation data — email addresses of users you invite to join your workspaces
Authentication and data storage are provided by Supabase. When you sign in with Google, authentication is handled through Google OAuth, and we receive your email address, name, and profile picture from Google. Payment processing is handled by Stripe. AI features use OpenAI's API with your provided API key. We may use analytics services to understand usage and improve our service.
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process transactions and send related information
- Connect to third-party email marketing, ROI, and lead generation platforms using your API credentials
- Import and process ROI and lead data for reporting and analysis
- Send scheduled email reports at your requested times
- Enable AI-powered analysis of your email campaigns using OpenAI's API
- Generate and export reports in various formats (PDF, Word, PowerPoint, etc.)
- Manage workspace memberships, team access, and invitations
- Send technical notices, updates, and support messages
- Respond to your comments, questions, and feedback
- Monitor and analyze trends and usage to improve the platform
3. Information Sharing and Third-Party Services
We do not sell, trade, or otherwise transfer your personal information to third parties except as described in this policy:
- With your consent or at your direction
- To comply with legal obligations
- To protect our rights and safety
- With service providers who assist in our operations (Supabase for authentication and database, Stripe for payments, Google for OAuth authentication)
- With email marketing, ROI, and lead generation platforms you connect via API integrations (e.g., Mailchimp, Shopify, Typeform, etc.)
- With OpenAI when you use the AI Assistant feature - your API key and chat messages are sent to OpenAI's servers
Important: When you sign in with Google, connect third-party email marketing platforms, or use the AI Assistant, data may be transmitted to those services. We recommend reviewing their privacy policies:
- Google Privacy Policy: https://policies.google.com/privacy
- OpenAI Privacy Policy: https://openai.com/privacy
- Supabase Privacy Policy: https://supabase.com/privacy
- Stripe Privacy Policy: https://stripe.com/privacy
4. Data Security
We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes:
- Encrypted storage of sensitive data including API keys
- Secure authentication through Supabase
- HTTPS encryption for all data transmission
- Regular security audits and updates
- Limited employee access to personal information
While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
5. API Keys and Third-Party Integrations
Our service allows you to connect third-party Email, ROI, Lead, and AI services using your own API keys:
- Email Platform APIs: You can connect platforms like Mailchimp, Klaviyo, Campaign Monitor, and others. Your API credentials are stored encrypted in our database and used only to fetch campaign data on your behalf.
- ROI Platform APIs: You can connect supported ROI sources (such as Shopify) to import order/revenue signals for attribution and ROI reporting.
- Lead Platform APIs: You can connect supported lead platforms (such as Typeform) to import form submissions and lead data.
- OpenAI API: For the AI Assistant feature, you provide your own OpenAI API key. This key is stored encrypted and used to send your questions and campaign data to OpenAI for analysis.
- Your Responsibility: You are responsible for the security of your API keys and for reviewing the privacy policies and terms of service of third-party platforms you connect.
- Data Access: We only access data from third-party platforms that you explicitly authorize through API connections.
You can disconnect any third-party integration at any time from your Settings page. Disconnecting will remove the stored API credentials from our systems.
6. Recipient-Level Data and Deep Dive Feature (GDPR Compliance)
Our Data Deep Dive feature (paid plans) allows you to view recipient-level engagement data from your email campaigns, including:
- Recipient email addresses
- Delivery status (sent, delivered, bounced)
- Engagement behavior (opened, clicked)
- Timestamp of last activity
- Individual link click data
Important Legal Information:
- Data Controller Role: When you use this feature, YOU are the data controller and we act as a data processor. You are responsible for ensuring you have a lawful basis under GDPR/UK GDPR to process your recipients' personal data.
- Your Legal Obligations: You must ensure you have appropriate consent or legitimate interest to collect, analyze, and process recipient engagement data. Your recipients should be informed through your own privacy policy that their email engagement may be tracked and analyzed.
- Purpose Limitation: Recipient data should only be accessed for legitimate email marketing analysis purposes and campaign performance optimization.
- Data Processing: We fetch recipient data from your connected email marketing platform (e.g., Mailchimp) in real-time and display it to you. We do not permanently store individual recipient engagement data in our database.
- No Data Retention: Recipient-level data is retrieved on-demand from your email service provider and is not retained by Email Calculator after you close the Deep Dive modal.
- Security: All recipient data transmission occurs over encrypted HTTPS connections.
⚠️ GDPR Compliance Notice:You must have a valid legal basis (consent, legitimate interest, contract, etc.) to process your email recipients' personal data under GDPR Article 6. Ensure your privacy policy discloses that recipient email engagement is tracked and analyzed. Email Calculator is not responsible for your compliance with data protection laws.
7. Scheduled Reports and Email Communications
If you use our Scheduled Reports feature (paid plans), we will:
- Store the email addresses you provide as recipients
- Send automated email reports at your specified schedule (one-time or recurring)
- Include your campaign report data in the emails we send
- Process email delivery through our email service provider
Recipients of scheduled reports are governed by your relationship with them. We recommend only sending reports to individuals who have consented to receive them.
8. Workspaces, Teams, and Invited Users
When you use workspace and team features (Growth and Scale plans), the following applies:
- Workspace owners control who can access their workspace data. When you invite a team member, their email address is stored and used only for the purpose of granting workspace access.
- Invited users can view and interact with reports within the workspaces they are members of. Their activity within those workspaces is associated with their account.
- Workspace owners can create multiple workspaces and manage separate client environments according to their plan limits. Reports and data within each workspace are logically separated.
- Removing a team member revokes their access to the workspace. Data they created within the workspace remains in the workspace.
9. Data Protection and Processing
Email Calculator acts as both a data controller and data processor depending on the context:
- As Data Controller: For your account information, preferences, and usage data
- As Data Processor: When processing campaign data and metrics on your behalf
For detailed information about how we process data as a processor, including our obligations, security measures, and sub-processors, please review our Data Processing Agreement.
10. International Data Transfers
Your data may be transferred to, stored, or processed in locations outside your country of residence, including outside the UK and European Economic Area (EEA).
When we transfer data internationally, we ensure appropriate safeguards are in place:
- Our infrastructure providers (Supabase, hosting services) maintain security standards compliant with GDPR
- We use Standard Contractual Clauses (SCCs) where applicable
- Data transfers to the US rely on adequacy decisions or approved transfer mechanisms
- All data transmission uses encrypted connections (HTTPS/TLS)
For more details on international transfers and safeguards, see our Data Processing Agreement.
11. Data Breach Notification
In the unlikely event of a data breach that affects your personal information:
- We will notify you without undue delay, and where feasible within 72 hours of becoming aware of the breach
- The notification will include the nature of the breach, categories of data affected, and likely consequences
- We will describe the measures we have taken or propose to take to address the breach
- We will provide contact details for further information
- Where required by law, we will also notify relevant supervisory authorities
We maintain appropriate technical and organizational measures to prevent breaches and minimize their impact.
12. Your Rights
You have the right to:
- Access your personal information and campaign data
- Correct inaccurate information
- Request deletion of your information and all associated data
- Export your data in common formats (PDF, Word, PowerPoint, etc.)
- Disconnect third-party API integrations at any time
- Cancel or modify scheduled reports
- Opt out of marketing communications
- Delete your account and all associated data
To exercise these rights, please contact us at contact@emailcalculator.com or manage your preferences in your account settings.
13. Data Retention
We retain your information for as long as your account is active or as needed to provide you services. Specifically:
- Account data is retained until you delete your account
- Campaign reports and metrics are retained as long as you maintain them
- API credentials are deleted when you disconnect integrations
- AI chat history is stored in your Supabase database and can be cleared by you at any time using the "Clear" button in the AI chat interface
- Payment records are retained as required by law and for accounting purposes
- Workspace data is retained while the workspace exists and the owner account is active
- Team invitation records are retained for audit purposes and removed upon account deletion
14. Cookies and Tracking
We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content. You can manage your cookie preferences at any time using our cookie consent banner.
15. Changes to This Policy
We may update this privacy policy from time to time. We will always post the updated policy on this page and update the effective date and version above.
For material changes that affect how we collect, use, or share personal data, we may also notify account holders through email, in-app notice, or dashboard notice before or when the changes take effect.