Privacy Policy

This policy explains what data Mailpro ("the Service") handles and why. The Service is operated by Instant Catalog ("we", "us") at theinstantcatalog.com and is used to send email campaigns from the operator's own Google Workspace mailboxes.

1. Data we handle

• Google account data (mailbox owners). When a mailbox is connected through "Sign in with Google", we receive the mailbox's email address and basic profile, and an OAuth token that lets the Service send email from that mailbox. We request two Gmail permissions: send email (https://www.googleapis.com/auth/gmail.send) and read email (https://www.googleapis.com/auth/gmail.readonly), plus email and profile. The read permission is used only to find replies and delivery-failure notices to the emails the Service sent (see section 3).
• Replies and bounces. For each reply, automatic reply or delivery-failure notice we find, we store the sender's address, the subject, a short text snippet supplied by Gmail, the time, and which email it answers. We do not store the full message.
• Contact lists (email recipients). Email addresses, names and any other columns the operator uploads, and whether each contact is active or has unsubscribed.
• Campaign activity. The emails sent, when they were sent, and whether and when they were opened. Opens are detected with a tiny image in the email; we store only the time of the first open and the number of opens, not your IP address or device.
• Operator sign-in. The operator's username and a one-way hash of the password. The IP address of failed sign-in attempts is kept for at most 24 hours to block password guessing.
• Hosting logs. Our hosting provider may keep standard web-server logs (such as IP address and pages requested) for security and operations.

2. How we use it

• To send the campaigns the mailbox owner has set up, at the pace and daily limits they choose.
• To show delivery, open and unsubscribe reports to the operator.
• To honour unsubscribe requests and keep unsubscribed addresses from being emailed again.
• To keep the Service secure. We do not use data for advertising, profiling or selling.

3. Google user data and Limited Use

Mailpro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• The Service uses the Gmail "send" permission only to send the emails the mailbox owner has set up in it.
• The Service uses the Gmail "read" permission only to look, in the connected mailbox, for replies and delivery-failure notices to the emails the Service itself sent. It searches for message identifiers, opens (headers and a short snippet only) just the messages that belong to conversations the Service started, and reads delivery-failure notices from the mail system to learn which address failed. It does not read, copy or store any other email, and it does not modify or delete email in the mailbox.
• Google user data is used only to provide the user-facing sending features described above.
• We do not sell Google user data, do not transfer it to others except as needed to provide the Service or as required by law, do not use it for advertising, and do not use it to develop, improve or train AI or machine learning models.
• The operator can see, inside the Service, the sender, subject and short snippet of replies to their own campaigns. No other person reads the contents of a mailbox.
• The OAuth token is stored encrypted (AES-256-GCM). You can revoke the Service's access at any time at myaccount.google.com/permissions; the stored token then stops working. We will also delete it on request.

4. Who we share data with

We do not sell personal data. Data is processed only by service providers needed to run the Service: Google (to send the emails) and our web hosting provider (to store the data). We may disclose information if the law requires it.

5. Cookies

The Service uses a single strictly necessary session cookie for the operator's sign-in and form security. There are no advertising or analytics cookies.

6. Security

Traffic uses HTTPS, access tokens are encrypted at rest, passwords are stored only as hashes, sign-in attempts are rate limited, and administration is restricted to the operator. No system is perfectly secure, but we work to protect the data we hold.

7. Retention and deletion

We keep contact lists and campaign records until the operator deletes them, and Google tokens until access is revoked or removed. To have your data deleted, use the unsubscribe link in any email or contact us (below).

8. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its use, and to complain to your local data-protection authority. If you received an email sent through Mailpro, you can stop further emails with its unsubscribe link at any time, or contact us to exercise these rights.

9. Children

The Service is not directed to children, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy; the date at the top shows the latest version.

11. Contact

Instant Catalog
Email: amit@instantcatalog.app