Privacy policy

Emerald Send (“we”, “us”) provides a cold email platform at emeraldsend.com: sending domains and inboxes, warmup, a lead database, email sequences and a shared reply inbox. This policy covers our website, the app, our API and our MCP server for AI assistants.

For the leads, contacts and email content you bring into a workspace, you (the customer) decide what is processed and why, and we process it on your behalf. For your own account details, we are responsible for that data.

• Account details: your name, email address and sign-in method, and the workspaces and roles you belong to.
• Billing details: plan, invoices and payment status. Card numbers are collected and stored by Stripe; we only see the brand and last four digits.
• Workspace content: leads and contacts you import or reveal, lists, campaigns, sequences, templates, settings, and the physical address that appears in your email footers.
• Mailbox data: for inboxes you buy or connect, the credentials or access tokens needed to send and receive, and the emails those inboxes send and receive through the platform (see the Google and Microsoft section below).
• Engagement data: opens, clicks, replies, bounces and unsubscribes for campaign emails, when tracking is on.
• Usage and device data: pages and features used, IP address, browser and device type, and logs we need to run and secure the service.

When you connect a Google account with “Connect Google”, you grant Emerald Send access to Gmail with these permissions, and we use each one only for the purpose listed:

• Basic profile and email address (openid, email, profile): to identify which mailbox you connected.
• Send email (gmail.send): to send the campaign emails, replies and warmup emails you schedule or approve, from that mailbox.
• Read and organize email (gmail.modify): to find replies and bounces to your campaigns and show them in your Unibox; to recognize warmup emails, move them out of spam, mark them read or important and file them under a warmup label; and to keep conversations threaded.

Microsoft mailboxes connected with “Connect Microsoft” are used the same way, through Microsoft Graph mail permissions.

How we handle this data:

• Access and refresh tokens are encrypted at rest (AES-256-GCM) and used only by our servers to provide the features above.
• We store the content of replies and other messages relevant to your campaigns so they appear in your Unibox. We do not copy your whole mailbox.
• Reply content may be sent to Anthropic to label interest (for example “Interested”) and to draft a suggested reply when you ask for one. It is not used to train AI models.
• We do not sell Google or Microsoft user data, use it for advertising, or use it to build or train generalized AI or machine-learning models.
• Our staff do not read your email, except when you ask us to (for example in a support request), when needed for security or abuse investigations, or when required by law.

Emerald Send’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a mailbox at any time from Email Accounts, which deletes its stored tokens. You can also remove Emerald Send’s access from your Google account at myaccount.google.com/permissions.

• To provide the service: set up domains and inboxes, run warmup, send your campaigns, show replies, find and verify leads, and report results.
• To protect deliverability and prevent abuse: verify emails before sending, watch bounce and complaint rates, and pause sending that could harm you, other customers or recipients.
• To bill you, provide support, and send account and service emails.
• To understand how the product is used and improve it, using usage data rather than your email content.
• To meet legal obligations and enforce our Terms of Service.

Interest labels, suggested replies and AI-written sequences are produced by Anthropic’s models from the content needed for that task. Anthropic processes it to return a result and does not use it to train its models.

If you connect an AI assistant (such as Claude, ChatGPT or Cursor) through our MCP server, that assistant can read and act on your workspace with your permissions. What the assistant’s provider does with data it receives is governed by that provider’s own privacy policy. You can disconnect an assistant at any time in Settings → AI assistants.

We do not sell personal information or share it for cross-context behavioral advertising. We share it only with:

These providers process data only to provide their services to us. We may also share information if required by law, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Our customers send their own emails to their own contacts, and each customer is responsible for having a lawful basis to contact you. Every campaign email includes an unsubscribe link and one-click unsubscribe headers; using them stops that sender from emailing you again.

Lead Finder contains business contact information (such as name, job title, company and work email) licensed from data providers. To ask us to remove your information from Lead Finder or to report unwanted email, contact support@emeraldsend.com.

• Account and workspace data is kept while your account is active.
• Disconnecting a mailbox deletes its stored credentials or tokens right away.
• A canceled inbox you bought stays restorable for 24 hours, then the Google user is deleted.
• If your plan ends, sending and warmup pause and your inboxes are kept for 30 days.
• When a workspace is deleted, its data is permanently deleted after 30 days. Copies in backups are overwritten on a rolling basis after that.
• We keep billing records and some logs longer when the law requires it.

Data is encrypted in transit with TLS. Mailbox passwords and access tokens are encrypted at rest. Access inside a workspace follows roles (owner, admin, editor, inbox manager, viewer), sensitive actions are recorded in an audit log, and staff access is limited to what support and operations need. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as the law requires.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict some processing. Email support@emeraldsend.com and we will respond within 30 days. If your request concerns data a customer controls (for example you are a lead in someone’s workspace), we will pass it to that customer or help them respond.

You can opt out of marketing emails with the link in each one. Service emails about your account continue while it is active.

We are based in the United States and our providers store and process data mainly in the United States. By using the service, your information is transferred there.

Emerald Send is a business service and is not meant for anyone under 16. We do not knowingly collect information from children.

We will post changes here and update the date at the top. If a change is significant, we will tell account owners by email before it takes effect.

Questions or requests about privacy: support@emeraldsend.com.