Sangu Mail Privacy Policy

A.   Information You Provide.

We collect information you provide to us, such as information you provide when you register an account, use the Service, update your profile, make a purchase, sign-up for our newsletters, participate in a promotion, respond to our surveys, or contact support, or apply for a job. The categories of information we collect include:

• Identifiers, including your name, email address, postal address, and phone number.

• Account credentials, including your usernames, passwords, and other information for authentication or account access. This includes your OAuth login or mail server credentials for the mail accounts you wish to link to the Service.

• Commercial or transactions information, including records of products or services you purchased, obtained, or considered.

• Payment information, including your payment instrument number (such as a credit or debit card number), expiration date, and security code as necessary to process your payments. This information is processed by our payment processors.

• User-generated content, including content within any messages you send to us (such as feedback, feature suggestions, questions, or survey responses) or publicly post on the Service (such as in product reviews or blog comments).

We collect the following information if you apply for a job via the website:

• Professional, employment, or education-related information, including your employment and work history, transcripts, writing samples, references, and other information necessary to consider you for a job.

Please do not provide any information that we do not request.

B. Information We Collect from Your Use of the Service.

• Email Information. In order to provide the Service, your email passes through our systems.  Your messages are stored temporarily while they are being processed.  This includes the contents of the emails you send and receive, as well as the data associated with your emails, such as the date, sender, recipient, subject, message-id, and header information.

• Reported Messages and Related Communications. When you submit to us an email communication for additional analysis, we keep a copy of that message in our case management system and review it with our analyst team. We use these messages and associated analyses to protect your email accounts and the accounts of other users from suspicious communications, email senders and domains. We do not share any personal information, such as your unredacted email address, or the content of any communications with any third parties without your authorization.

• Logging.  For the purpose of debugging and statistics we log some of the contents and data associated with your use of the Service.

C. Information from Your Browser or Device.

When you use the Service (including when you visit our websites or apps, or open or click on our emails), we and third parties we work with automatically collect information from your browser or device. The categories of information we automatically collect include:

• Device identifiers, including your device’s IP.

• Device information, including your device’s operating software and browser (e.g., type, version, and configuration), internet service provider, and regional and language settings.

• Non-precise location data, such as location derived from an IP address or data that indicates a city or postal code level.

The types of tracking technologies we use to automatically collect this information include:

• Cookies, which are small data files stored on your browser that save data about your visit. Cookies often include a unique identifier (e.g., cookie #123). We use three types of cookies: session cookies, persistent cookies, and analytics cookies. Session cookies make it easier for you to navigate our website and expire when you close your browser. Persistent cookies help with personalizing your experience, remembering your preferences, and supporting security features. Persistent cookies may remain on your device for extended periods of time and expire on a set expiration date or when they are deleted manually. Analytics cookies help us understand how you access and use the Service.

• Pixels (also known as web beacons), which is code embedded in a service that sends information about your use to a server. Pixels provide similar functionality to cookies. There are various types of pixels, including image pixels (which are small graphic images) and JavaScript pixels (which contains JavaScript code). When you access a service that contains a pixel, the pixel may permit us or a third party to drop or read cookies on your browser, or collect other information about your visit.

• Device fingerprinting, which is the process of analyzing and combining sets of data elements from your device’s browser, such as JavaScript objects and installed fonts, to create a “fingerprint” of your device and uniquely identify your browser and device.

• App technologies, which are technologies included in our apps that are not browser-based like cookies and cannot be controlled by browser settings. These technologies provide similar functionality to cookies.  

D. Information from Other Sources.

We also collect information from other sources. The categories of sources from which we collect information include:

• Social media platforms with which you interact.

• Third Parties that provide services to us, including analytics and fraud prevention providers.

• Partners that may offer co-branded services, sell or distribute our products, or engage in joint marketing activities.

• Publicly-available sources, including data in the public domain.

E. Information We Create or Generate.

We infer new information from other data we collect, including using automated means to generate information about your likely preferences or other characteristics.

F.  Google API

To access your email to be processed by us, we ask for authorization to access your Google email account(s) using Google’s OAUTH2 mechanism.

  1. Who is requesting Google user data?  We, Cyber Risk Research, owners of Sangu are requesting access to your Google gmail account.  We hold this access token in a digital vault and always keep this information confidential.

  2. What data are we requesting?  We are requesting full access to your Google gmail account.  This allows us to read, write, modify, and delete messages and to read, write, and modify the settings in your account.  We use this access to bring your emails into Sangu, process them, and write the results back out to your mailbox.  

  3. Why are we requesting Google user data?  We are requesting the data to be able offer our services to you.  To be able to scan your emails, our software needs to be able to read the contents of your mail, run it through our system, then add banners to messages and return the modified message back to your mailbox.  We also move spam and malicious emails to a Spam folder and this requires modify permission.  We also ask for delete permission to be able to delete messages in your mailbox that we have modified.  We will never delete a message that is not otherwise accessible.  If your mailbox is a Google mailbox and we access it using IMAP,  Google requires that we ask for full access permissions to use the IMAP protocol.  When you use Sangu with our Google Workspace account, we access the settings of this Google Workspace account to modify the settings when you add your existing email to this account.  This can be done manually but it is much easier and less error prone when we add your accounts by automation.

In all cases, the access we request are solely and explicitly used in pursuit of providing you with our service.  We do not use or look at the contents of any of your mail in any way except when you report messages to us for investigation.