Privacy policy

Last updated: September 25, 2026

Who we are

EmailShift is operated by Kyuzo Corporation, a New York corporation doing business as Senders, 223 Bedford Ave PMB 1035, Brooklyn, NY 11211, United States ("we", "us"). For any privacy question or request, contact [email protected].

What EmailShift processes

• Account data: the name, email address, role and settings of people using the EmailShift application, and security data such as sign-in times and two-factor settings.
• Delivery events from email platforms you connect: for example delivered, bounced, deferred or complained, the receiving mailbox provider, the provider's response, the sending domain and campaign identifiers. We do not receive the content of your messages.
• Recipient addresses only as one-way hashes, used to recognise repeat and new recipients. The recipient's domain (for example gmail.com) is kept to group results by mailbox provider. Batches received from email platforms are encrypted at rest; as soon as a batch has been processed (normally within seconds), every email address in it is replaced by a one-way placeholder, and the batch is deleted after 7 days. EmailShift does not keep readable recipient addresses.
• DMARC aggregate reports that mailbox providers send for your domains, containing sending IP addresses and authentication results.
• Google Postmaster Tools data for domains verified in both Google Postmaster Tools and EmailShift, accessed read-only with your permission.
• Billing data: payments are handled by Stripe. We do not see or store card numbers.

Why we process it

To provide the monitoring service you signed up for (performance of our contract with you), to send the alerts and reports you configure, to keep the service secure and prevent abuse (our legitimate interest), and to meet legal and accounting obligations.

Who we share it with

We do not sell personal data and do not use it for advertising. We use these service providers to run EmailShift:

• our hosting provider, for servers and databases;
• Cloudflare, for network security and DNS;
• Amazon Web Services, for sending account and alert emails;
• Stripe, for payments;
• only if AI assistance is enabled: the AI provider selected by the administrator, which receives case evidence and aggregated metrics, never recipient addresses or message content.

Some of these providers process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

Detailed delivery events are kept for the period included in your plan; aggregated metrics are kept longer so trends remain visible. When an organization is deleted, its data is deleted. Account data is kept while your account exists.

Security

Connections to email platforms are read-only. Credentials and API keys are encrypted and never shown again after saving. Access inside EmailShift is limited by role, and sensitive actions are recorded in an audit log.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to complain to a data protection authority. To exercise any of these rights, email [email protected]. If you use EmailShift on behalf of a company, some requests are best made by your organization's owner.

Google user data

Data obtained through Google APIs is used only to show deliverability information for your own verified domains inside EmailShift. It is not shared with third parties except as needed to provide the service, is not used for advertising, and is not used to train AI models. EmailShift's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes

If we make material changes to this policy, we will notify account owners by email before they take effect.