Loading...
Effective Date: 2026-10-18 Service: EmuInbox Website: https://crm.emuinbox.com Privacy Contact: [email protected]
This Privacy Policy explains how EmuInbox handles personal information when people use the EmuInbox websites, mobile application, APIs, and related business services (collectively, the "Service"). EmuInbox is the product and service name used by the developer identified as EmuInbox in the applicable app store listing and Service interface ("EmuInbox", "we", "us", or "our").
This is the common Privacy Policy for the EmuInbox web service and mobile application. It is intended to be read consistently with the Privacy Act 1988 (Cth), the Australian Privacy Principles, applicable laws in New South Wales, and any other mandatory privacy law that applies to a particular user or organization.
The Service is designed for organization-based business use. An organization administrator may control organization membership, permissions, and business data. The organization may separately be responsible for notices, lawful authority, access decisions, and instructions concerning the personal information it submits to the Service.
The information actually handled depends on the features, permissions, and integrations used by the organization.
We do not receive a user’s Apple or Google account password. If Apple provides a private relay email address, it may be stored as part of the Apple-linked identity.
Optional biometric quick unlock is performed by the device operating system. EmuInbox does not receive or store fingerprint or facial templates.
This information may include personal information about employees, customers, suppliers, recipients, signers, and other people whose information is submitted by an authorized organization user.
EmuInbox is not intended to replace the connected email provider as the authoritative mailbox. Some email information may be cached or stored as needed for assignment, search, audit, customer association, performance, and connected workflows. The duration depends on the feature, organization configuration, applicable retention requirements, and the deletion rules in this Policy.
Organization administrators may review reports made within their organization. EmuInbox may access the minimum report and related content necessary for support, safety, an administrator-conflict report, an appeal, legal compliance, or enforcement.
When an organization uses an AI- or OCR-assisted feature, EmuInbox may process the selected document, image, extracted text, prompt context, structured business fields, provider request identifiers, token-usage information, confidence information, and generated result. EmuInbox uses the OpenAI API for configured AI recognition, extraction, classification, and related business-assistance functions, and may use AWS document-processing services such as Textract or other configured OCR providers.
Only information reasonably necessary for the requested operation should be submitted. Users must avoid submitting unnecessary personal, sensitive, confidential, payment-card, identity-document, health, or unrelated third-party information and must review generated results before relying on them.
Payment-card details are entered into and processed by Stripe. EmuInbox does not intentionally store full card numbers or card security codes.
We handle information included in support requests, deletion requests, moderation appeals, security reports, emails, and other communications with EmuInbox.
The mobile application requests permissions only when needed for a selected function:
Users can decline or later change operating-system permissions. Some related features will not work without the applicable permission. The application does not request microphone permission for these functions.
We use information to:
We do not sell personal information and do not use the EmuInbox mobile application for third-party targeted advertising.
Organization business data is shared with authorized members according to roles, permissions, assignments, and feature design. Organization administrators may manage users and access organization content, audit information, and chat reports.
Deleting an ordinary member account does not automatically delete organization-owned records created or handled by that member. Those records may remain available to the organization with the former member de-identified, because they form part of shared customer, todo, communication, document, approval, and audit history.
We disclose only information reasonably necessary for a provider to perform the selected service. Depending on configuration and use, provider categories include:
Providers may process information in Australia or other countries where they operate. Their processing is also governed by applicable provider terms, data-processing commitments, security controls, retention settings, subprocessors, and legal obligations. We do not authorize providers to use EmuInbox information for their own advertising.
We may disclose information when required by law, to protect users or the Service, to investigate abuse or security incidents, in connection with a corporate transaction subject to appropriate safeguards, or with the direction or authorization of the relevant user or organization.
EmuInbox application and API servers are located in Australia. Service data and files may be stored, backed up, transmitted, or otherwise processed using Amazon Web Services (including Amazon S3), Microsoft Azure, and other configured infrastructure services. The storage service used can depend on the feature, organization configuration, migration history, backup design, and operational requirements.
Australian hosting does not mean that every processing operation occurs only in Australia. OpenAI, identity providers, email providers, notification services, monitoring providers, recipients, and other configured providers may process or make information accessible in other jurisdictions. Where required, EmuInbox uses reasonable contractual, organizational, and technical safeguards and takes reasonable steps concerning overseas recipients, consistently with applicable Australian privacy requirements.
A privacy policy is not itself a substitute for any separate consent, notice, contractual safeguard, or transfer mechanism required by applicable law. Users and organizations should not submit information that they are not authorized to process or transfer through the selected feature.
AI-assisted processing is initiated for configured features or an authorized user request. Depending on the feature, EmuInbox may send a document, image, extracted text, relevant prompt instructions, limited business context, and associated metadata to the OpenAI API or another disclosed configured provider. The returned output may be stored with the related organization record so that authorized users can review, correct, approve, reject, audit, or export it.
AI and OCR results can contain errors, omissions, duplicates, or misclassifications. EmuInbox expects authorized users to compare important results with the source material. The Service is not intended to make solely automated decisions that produce legal or similarly significant effects about an individual. Where applicable law grants a right concerning automated decision-making, a request may be submitted using the contact details below.
Provider-side processing, abuse monitoring, security review, retention, subprocessors, and legally required disclosure may be governed by the provider’s applicable API or enterprise terms and privacy commitments. EmuInbox applies available configuration and contractual controls appropriate to the Service, but does not control an independent provider’s legal obligations.
We retain information for no longer than reasonably necessary for the purposes described in this Policy, including while an account or organization is active and for applicable security, billing, tax, audit, dispute, backup, and legal periods afterward.
Operational caches, presence, typing state, verification challenges, and temporary files are retained for shorter technical periods. Organization business records are retained according to organization use and control. Security, deletion, billing, and audit records may be retained after account deletion where reasonably necessary to demonstrate compliance, prevent fraud, resolve disputes, or meet legal obligations.
Backups and distributed caches may take additional time to expire through the ordinary protected backup and lifecycle process. Retained information is not used as an active account after deletion.
An ordinary organization member can initiate account deletion through account settings. EmuInbox removes or de-identifies the member profile, authentication data, external sign-in bindings, access assignments, organization membership, sessions, and push registration. Organization-owned business records remain under organization control and may display a de-identified former user.
An organization owner can delete the entire organization only through the EmuInbox website after MFA confirmation. The process deletes the organization, users, organization business data, supported external accounts, exact known stored objects, active sessions, push registrations, and the Stripe customer relationship, subject to limited billing, tax, security, fraud-prevention, legal, and deletion-audit records.
Historical objects for which EmuInbox does not hold enough information to safely identify the storage location may remain until the applicable storage lifecycle or a verified deletion process can identify them.
The external deletion information and request pathway are available at https://crm.emuinbox.com/account-deletion. Assistance is available at [email protected].
We use measures appropriate to the nature of the Service, which may include TLS in transit, credential protection, MFA, role-based access controls, organization isolation, restricted provider access, logging, monitoring, backup controls, signed or time-limited file access, and deletion controls. No system can guarantee absolute security. Users and organizations must protect credentials, configure access appropriately, and notify us promptly of suspected misuse.
Where the Australian Notifiable Data Breaches scheme applies, EmuInbox will assess suspected eligible data breaches and provide notifications to affected individuals and the Office of the Australian Information Commissioner when required by law.
Subject to applicable law and the organization relationship, a person may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Some requests concerning organization-controlled business data may need to be directed to the relevant organization administrator.
Users may manage device permissions through operating-system settings, disable push notifications, disconnect supported integrations, or stop using the Service. Withdrawal does not affect processing already lawfully completed and may prevent the related feature from working.
Requests may be sent to [email protected]. We may need to verify identity and authority before acting. Privacy complaints will be reviewed and responded to within a reasonable period. If an Australian privacy complaint is not resolved, the person may be entitled to complain to the Office of the Australian Information Commissioner or another applicable regulator.
The Service is intended for business users and is not directed to children under 16. If we learn that a child’s information was submitted without required authority, contact [email protected] so that the matter can be reviewed.
We may update this Policy to reflect product, legal, security, provider, or operational changes. The effective date will be updated, and material changes may be communicated through the Service, website, or email where appropriate.
For privacy questions, rights requests, account deletion assistance, chat safety concerns, or moderation appeals:
Email: [email protected]
Website: https://crm.emuinbox.com
Account deletion: https://crm.emuinbox.com/account-deletion