Privacy Policy

1. Who is responsible

HCPCraft is the controller of the personal data described here. Contact us about privacy at [email protected]. For content you upload on behalf of your organization, your organization decides what to upload; we process it to provide the Service to you.

2. What we collect

Account information (Google Sign-In)

You sign in with Google. Google shares your name, email address and profile picture with us. We never receive or store your Google password, and we do not access your Gmail, contacts, Drive or any other Google data. We keep your account record: those details, when you joined and last signed in, your plan, and your monthly usage count.

Team information

If you own a team plan, we store the email addresses of the teammates you invite.

Content you provide and emails we generate

To build an email we process your campaign brief, the files you upload (mockups, PDFs, Word, Excel, HTML, text and image archives) and any image addresses they reference. We save each generated email in your account's history so you and your team can reopen and download it: the brief, the generated HTML, audit screenshots, previews of your mockups, the names of the uploaded files and any adjustment requests. Original uploaded files are processed in memory and are not kept after the email is generated, except for those previews.

Please do not upload patient data or protected health information (PHI). The Service is designed for marketing content, not patient records.

Billing information

Payments are handled by Paddle.com, our Merchant of Record. Paddle collects your payment details, billing address and tax information. We do not receive or store full card numbers; we receive identifiers for your Paddle customer and subscription, your plan, billing dates, and limited payment-method details (such as card brand, last four digits and expiry) so we can show them in your account.

Technical data

Our servers record basic logs (for example request times, errors and IP addresses) to keep the Service secure and working. We use only essential cookies: a cookie that keeps you signed in, and similar strictly necessary cookies. We do not use advertising or analytics cookies, and we do not sell personal data. To understand how the site is used, we count page views and clicks on our main buttons with a privacy-friendly analytics service that uses no cookies, doesn't identify you and doesn't follow you across sites.

3. How we use it

• to provide the Service: sign you in, generate and store your emails, enforce plan limits and team seats;
• to bill your subscription through Paddle and show your billing details;
• to keep the Service secure, prevent abuse and fix problems;
• to contact you about your account, billing and important changes to the Service or these policies.

We process this data to perform our contract with you, for our legitimate interests in running a secure service, and to meet legal obligations (for example tax and audit records).

4. AI processing

HCPCraft uses artificial intelligence to generate emails. When you generate or revise an email, the relevant content (your brief, the text and images extracted from your files, your mockups, and for revisions the current email and your adjustment request) is processed by our AI service provider to generate your email.

• Our AI service provider processes this content on our behalf, only to return the generated email to us.
• We use paid, enterprise-grade AI services whose terms prohibit using your content to train their models. The provider may keep content for a limited time to detect abuse and comply with law.
• We do not use your content to train any AI model.

5. Who we share data with

We share personal data only with service providers (subprocessors) that help us run the Service:

• Google LLC: Google Sign-In (authentication).
• AI service provider: generates email content (see section 4).
• Paddle.com: payments, invoices, taxes and refunds, as Merchant of Record under its own privacy policy.
• Cloud hosting provider: hosting of the application and its data.

A list of our subprocessors is available on request at [email protected].

Teammates on your plan can see the shared email history, including who created each email. We may disclose data when required by law or to protect our rights and users. If the business is sold or reorganized, data may transfer to the successor under this policy.

6. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.

7. How long we keep data

• Account and team information: while your account is active.
• Email history: while the account that owns it is active. The history is an audit log, so individual entries cannot be deleted; it is removed with the account.
• After you delete your account (effective at the end of any paid period), your account and history are kept for 90 days for compliance and audit purposes, then permanently deleted.
• Free email: each Google account can build one free email. To prevent repeated use, we keep a one-way, keyed hash of the email address of accounts that used it, even after the account is deleted. The hash can't be turned back into the address and isn't used for anything else.
• Billing records kept by Paddle and us as long as tax and accounting laws require.
• Server logs: for a limited period needed for security and troubleshooting.

8. Security

We use encrypted connections (HTTPS), signed session cookies, verified payment notifications, and access limited to the account and its team. No method of transmission or storage is completely secure, but we work to protect your data and will notify affected users of a breach as required by law.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a data-protection authority. You can delete your account from your account page at any time. For other requests, email [email protected]; we answer within 30 days.

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect children's data.

11. Changes

We may update this policy and will post the new version here with its effective date. For material changes we will notify account owners by email. See also our Terms of Service.