Privacy Policy

Who we are

The Service is operated by:

Datgel Asia Pte. Ltd. (UEN 201132358H)
Registered office: 1 North Bridge Road, #08-08, High Street Centre, Singapore 179094
Data protection contact: [email protected]

For personal data collected through the Service, Datgel is the organisation responsible for that data (the data controller). Where you use the Service to process other people’s personal data that you control — for example your own customer or contact records — you are the controller of that data and we act as your processor.

Where your data is processed

Email Sprucer can run in several configurations. What we process depends on which you use.

Local — the default

In its base configuration Email Sprucer runs entirely on your own computer:

• Your filing rules, captions and any imported client or contact data are stored on your own computer under %LOCALAPPDATA%\EmailSprucer\. Local logs and run reports are written there too.
• The add-in reads message metadata — sender, recipients, subject line, and the email addresses and domains needed to match a rule — locally, decides the destination folder, and moves the message within your own mailbox.
• No email content, message body, attachment, rule or contact record is transmitted to Datgel in this configuration.

The only data that may leave your machine in this configuration is the optional telemetry described below, and anything you explicitly turn on under AI features.

Hosted Email Sprucer account — optional

If you use a hosted Email Sprucer account, your rules and client/contact data (which may include names, email addresses and domains used for matching) are stored in that account so they sync across your devices and can be managed through the account portal. We still do not receive your email content: filing continues to happen locally in your mailbox, and the hosted account holds the rules and matching data, not your mailbox or your messages.

Your own data source — optional

You can point Email Sprucer at a data source you control — a spreadsheet you import, or your organisation’s Microsoft Dynamics 365 — under credentials you supply. Email Sprucer reads matching data from it and uses that data locally to match and file email. We do not store your Dynamics records on our servers as part of that connector. Credentials you give us for such a source are stored encrypted on your own machine using Windows data protection.

The web add-in — optional

Where you use Email Sprucer in new Outlook, Outlook on the web or Outlook for Mac, the add-in runs in your browser or Outlook host and accesses your mailbox through Microsoft Graph using a token issued to you by Microsoft. Where a feature needs our hosted service to make a decision, the add-in is designed to send the least it can: for duplicate detection, for example, it computes a hash of the message body on your own device and sends only that hash, so the service can identify duplicates of mail it is never shown.

Personal data we collect

Depending on the features you use, we may collect the following categories of personal data.

• Account and licence data — the email address used to sign in, display name, the organisation whose licence pool your seat comes from, your seat and plan, and authentication data (secure session tokens; tokens are stored encrypted on your device).
• Device identifiers — when you sign in, an identifier for each device you use Email Sprucer on, together with the device’s name and basic details, so that you can see your signed-in devices, remove one you no longer use, and so we can apply the limit on how many devices your plan covers. These are not advertising identifiers: we do not collect an Advertising ID, and we never use any identifier to advertise to you or to track you across other apps or websites.
• Your rules and matching data — the filing rules, captions, folder destinations and client/contact records you create or import. Where you use only the local configuration, these stay on your machine and we never receive them.
• Email metadata processed locally — sender, recipients, subject line and message identifiers, read on your own machine to decide where a message belongs.
• Email content, only where you enable an AI feature — see AI features.
• Usage, device and diagnostic data — app version, operating system, feature-usage counts (such as that a filing run occurred and how many rules were evaluated), performance timings, and crash and error diagnostics. See Telemetry and diagnostics.
• Payment data — for paid plans, our payment provider processes your card or payment details. We receive only limited billing information such as your subscription status and a masked reference; we do not store full card numbers. Where you give them to us, we also keep the billing details needed to issue a valid receipt or tax invoice.
• Communications — the content of support requests, feedback and other correspondence you send us, including any log file you choose to attach.

A log file or run report can name the folders, senders and recipients your rules touched. They stay on your machine unless you send one to us; please have a look through one before you attach it to a support request.

We collect this data directly from you when you set up an account, configure the Service, use its features, subscribe, or contact us.

What we never do

To be explicit, we do not:

• sell, rent or share your personal data with third parties for their own marketing;
• use your data, or your customers’ data, to train machine-learning models, or permit our providers to do so;
• use anything you process inside the app for advertising, ad-targeting or building advertising audiences; or
• collect an advertising identifier, or track you across other apps and websites.

Specific to Email Sprucer, we do not:

• read, copy, transmit or store the body or content of your emails — except where you switch on an AI feature and it sends the emails you selected to the endpoint you chose, as described under AI features;
• send your attachments anywhere;
• upload your mailbox, your folder structure or your message history to Datgel; or
• in the local configuration, send your rules or contact data to Datgel at all.

AI features

Email Sprucer includes optional features that use a third-party AI service to read information out of your email — for example, reading a name, job title, company and phone number out of an email signature when you scan for contacts that are missing from your records. Because these features send email content off your machine, we want to be precise about them.

What is sent, and to whom

• What. The text of the emails selected by the scan you run — which includes the message body and signature block, and the sender and recipient addresses. It is sent only to produce the requested result.
• To whom. By default, Anthropic PBC (United States). You may instead point the feature at any endpoint you choose — for example a gateway or proxy run by your own organisation — in which case the content goes there instead of to Anthropic, and the operator of that endpoint, not Datgel, determines what happens to it. This is how an organisation keeps email bodies inside its own network.
• Not for training. Content sent for extraction is used solely to return the requested result. We do not permit our AI providers to use it to train their models. Where you configure your own endpoint, that commitment is between you and its operator.
• Not stored by us. Datgel does not receive or retain the email content sent to an AI provider — the request goes from your machine to the endpoint. What is saved locally is the extracted result (the contact details) and a count of the tokens used, so the app can show you what a run cost.

Your control

• The feature is off until you enable it and provide a key, which is stored encrypted on your own machine.
• Before a run, Email Sprucer tells you how many emails it will send and what that is estimated to cost, and asks you to confirm.
• You can cap how many emails a run may send, change the endpoint, or turn the feature off again at any time.

Results produced by an AI model may be wrong or incomplete. Review them before you rely on them — see our Disclaimer.

How and why we use personal data

We use personal data to provide and improve the Service:

• To provide the features you use — described under Where your data is processed.
• To operate your account and licence — signing you in, keeping you signed in across restarts, managing seats, organisations and devices, and syncing your configuration across your devices.
• To process payments — managing subscriptions, renewals and receipts for paid plans.
• To support you — responding to requests and sending service notices such as security, licence or account messages.
• To keep the Service safe and reliable — diagnosing problems, preventing abuse and securing accounts.
• To improve the Service — understanding which features are used, so we can make the product better. See Telemetry and diagnostics.

Where the PDPA requires consent, we rely on the consent you give when you set up and use the Service. You may withdraw consent as described below, though doing so may mean we can no longer provide parts of the Service.

Telemetry and diagnostics

To keep the product reliable, Email Sprucer can send usage and error telemetry to Azure Application Insights. It is designed to contain no email content and no contact data, and is limited to operational signals:

• application and build version, and feature-usage counts — for example that a filing run occurred, and how many rules were evaluated;
• performance timings; and
• error and crash diagnostics (exception type, message and stack trace) to help us fix defects.

We use telemetry only to operate, secure, debug and improve the product. We aim to keep diagnostic payloads free of personal data; if an error message could incidentally include personal data, we treat it as personal data under this Policy. We do not use telemetry for advertising, and we do not use it to train models.

Your choice. Where consent is required, telemetry is subject to it, and you can turn it off in the app’s Settings at any time. To ask us to delete telemetry we have already collected, email [email protected].

Separately, and only on this website, we use Cloudflare Web Analytics to count page visits. It is cookie-free, collects no personal data, and is unrelated to the app telemetry above — see Cookies, analytics and advertising.

Account, sign-in and billing

If you create an account or buy a subscription, we (and our identity and payment providers) process your account email, authentication data, organisation and seat information, the devices you sign in on, and billing details, in order to provide, licence and bill the Service. Where you give them to us, we also keep the billing details needed to issue a valid receipt or tax invoice. We do not store full card numbers; those are handled by our payment provider.

Sign-in and licensing are handled by our identity and licensing provider. When you sign in, a seat is drawn from your organisation’s licence pool and your device is recorded against it, so that the seat can be released when you sign out and so you can see and remove the devices you have signed in on. If you hold licences in more than one organisation, we remember which one you chose so that the right seat is used next time.

Email Sprucer also checks for and downloads updates. A download request reaches our distribution host with your IP address and basic request details, as any web request does; this is used to serve the file and for security and operational logging.

Cookies, analytics and advertising

Cookies we set without asking

Our website uses the cookies and local storage strictly necessary for it to function and, where applicable, to keep you signed in to your account. We also use Cloudflare Web Analytics to count visits — it is cookieless and does not collect personal data or build a profile of you, so it needs no consent.

Cookies we ask about first

We would also like to use Google Analytics to understand how the website is used, and advertising cookies and measurement tags from Google (Google Ads) and Meta (Meta Ads) to see whether an advertisement brought you here, so we know which advertisements are worth paying for. These set cookies (such as _ga, _gcl_au and _fbp) and are optional: we ask you first, and they stay switched off — setting no cookie and sending no data that identifies you — unless you accept. The website works exactly the same either way.

Where you accept, we may use this to measure conversions and to build and use advertising audiences on those platforms, including showing you our advertisements on other sites and apps those platforms serve. We never use anything you process inside the app for advertising. Google LLC and Meta Platforms, Inc. act as our service providers for this and may process the data outside Singapore (see International transfers).

Remembering where you came from

If you accept analytics, we also keep the campaign tags from the web address you arrived on (for example, which advertisement or post linked you here) for the rest of your browsing session, so that if you email us we can tell which campaign brought you. It is stored only in your browser, only for that session, and is discarded when you close the tab. If you do not accept, nothing is stored. When you click an email link on the site, those campaign tags are added as visible text at the bottom of the draft email — you can read them and delete them before you send. They describe the campaign, not you.

Changing your mind

Select Cookie preferences in the site footer to accept or decline at any time. Declining also deletes any analytics or advertising cookies already set. Most browsers additionally let you block or delete cookies through their own settings.

Legal bases (GDPR/UK GDPR)

Where the EU or UK GDPR applies, we rely on:

• Performance of a contract — to provide the Service, your account and support;
• Legitimate interests — to secure, debug and improve the product, balanced against your rights;
• Consent — for optional AI features, optional telemetry, and non-essential analytics and advertising cookies; and
• Legal obligation — to meet accounting, tax and legal requirements.

Under the PDPA we collect, use and disclose personal data for purposes a reasonable person would consider appropriate, with notification and, where required, consent, and we honour withdrawal of consent.

Service providers and disclosure

We do not sell personal data and we do not disclose it except as set out here. To run the Service, we share personal data with trusted service providers, only to the extent needed and under contracts that require them to protect it. Depending on the features you use, not all of them will apply to you. If we engage a new provider, we update this list — see Changes to this Policy.

• Microsoft (Microsoft Azure, Azure Application Insights, Microsoft Graph, Microsoft 365, and the Microsoft commercial marketplace) — hosting for the optional Email Sprucer account, diagnostics and telemetry, mailbox access for the web add-in, our business email and support correspondence, and marketplace distribution and billing where you buy through it.
• Cloudflare, Inc. — website hosting and delivery, and cookieless website analytics.
• Anthropic PBC — the optional AI extraction features, only where you turn them on, and only for the content described under AI features. Where you configure your own AI endpoint instead, that operator receives the content in place of Anthropic.
• 10Duke Ltd — identity, sign-in and licence-seat management.
• Google LLC (Google Analytics and Google Ads) and Meta Platforms, Inc. (Meta Ads) — website analytics and advertising measurement, only where you accept them; see Cookies, analytics and advertising.
• Twilio SendGrid — product, licence and release notification emails.
• Atlassian — our support-ticketing system, for handling the requests and correspondence you send us.
• The datgel.com store, operated by Datgel Asia Pte. Ltd., and its payment provider — selling and processing payment for Email Sprucer licences. Where you buy through a marketplace instead, that marketplace handles the payment.
• Xero — issuing receipts and tax invoices for paid plans, and our own accounting records. This receives the account holder’s billing details and what was bought; it never receives your rules, your contact data or anything from your mailbox.

We may also disclose personal data where required to comply with a law, regulation, court order or lawful request from an authority; to enforce our terms; to protect the rights, safety or property of Datgel, our users or others; or in connection with a merger, acquisition or sale of assets, in which case we will require the recipient to honour this Policy.

International transfers

Datgel is based in Singapore, and some of our service providers store or process data in other countries (including the United States, Australia and the European Union). Where we transfer personal data outside Singapore, we take the steps required by the PDPA to ensure the recipient is bound to provide a standard of protection comparable to the PDPA — for example, through contractual commitments with our providers. Where the EU or UK GDPR applies, we use appropriate safeguards such as Standard Contractual Clauses.

Retention

We keep personal data only for as long as needed to provide the Service to you and for the purposes described in this Policy, and then we delete or anonymise it. If you delete content or an account, we remove it from active systems; residual copies in encrypted backups are purged on our normal backup-rotation cycle. We may retain limited records where we are legally required to do so (for example, billing records), after which they are deleted.

• Data on your own machine — rules, matching data, logs and run reports stay on your machine until you delete them or uninstall. We do not control their retention, and we cannot delete them for you.
• Hosted account data — retained while your account is active. If a subscription ends and is not renewed, we keep it for three months so you can export it or resume, then delete or anonymise it; see Getting Your Content back in the Terms of Use.
• Telemetry and diagnostics — retained for a limited diagnostic period of up to 90 days, then deleted or aggregated.
• Billing and account records — retained as required by tax and accounting law.

Security and breach notification

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, encrypted storage of sensitive credentials on your device, access controls, and secure, reputable cloud infrastructure. No method of transmission or storage is completely secure, but we work to protect your information and to respond quickly if a problem arises.

If a data breach occurs that is likely to result in significant harm to affected individuals or is of a significant scale, we will notify the Personal Data Protection Commission (PDPC) and affected individuals as required by the PDPA, and the relevant supervisory authority where the GDPR applies.

Your rights and choices

Depending on where you live, you may:

• Access the personal data we hold about you and ask how it has been used;
• Correct inaccurate or incomplete personal data;
• Delete, restrict or object to our processing, and ask for data portability; and
• Withdraw consent, without affecting processing already carried out.

You can do much of this yourself inside the app — edit your configuration, remove data, or manage your devices. To make a formal access, correction, withdrawal or deletion request, email [email protected] from the address you use to sign in. We will respond within the time required by applicable law and may need to verify your identity.

If you are unhappy with how we handle your request, you may complain to a supervisory authority — in Singapore, the Personal Data Protection Commission (pdpc.gov.sg); in the EEA or UK, your local data-protection authority.

Note that for data held only on your own device we are typically not the controller and cannot access, export or delete it — you control that data directly.

Changes to this Policy

We may change this Policy from time to time — for example to reflect new features, new service providers, or changes in law or our practices. We reserve the right to update it at any time. When we make a material change, we will take reasonable steps to notify you before it takes effect — for example by posting a notice in the app, updating the effective date at the top of this Policy, and/or emailing the address associated with your account. Your continued use of the Service after a change takes effect means you accept the updated Policy.

Any change to how the product handles data — a new cloud feature, a new provider, a new telemetry field — is reflected here before it ships.

Contact us

For any question about this Policy or your personal data — including access, correction or deletion requests — contact our data protection contact at [email protected], or write to Datgel Asia Pte. Ltd., 1 North Bridge Road, #08-08, High Street Centre, Singapore 179094. We aim to respond within a reasonable time and in any case as required by law.