emAIl Sentinel™ — Privacy Policy

Effective date: 2026-08-09 Operator: JJJJJ Enterprises, LLC ("JJJJJ", "we", "us", "our") Service: emAIl Sentinel, a Microsoft 365 Outlook Add-in (the "Service")

This Privacy Policy explains what data the Service accesses, how it is used, and with whom it is shared. By installing or using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, do not install or use the Service.

For most information processed through the Service, you decide which Outlook folders to watch, what rules to write, what alert channels to enable, what recipients or endpoints to use, and what third-party services to connect. JJJJJ provides the software tool that operates under your Microsoft account credentials and your own Azure OpenAI endpoint. You retain control over the email content, folders, rules, recipients, destinations, integrations, and other processing instructions that you configure through the Service. You remain responsible for determining whether you have the legal right and authority to process the content you select and to send information to the recipients, endpoints, and third-party services you configure.

The parties' legal roles may vary depending on the type of information involved, the feature being used, the applicable law, and the specific relationship between you, JJJJJ, Microsoft, and any user-selected third-party service. Nothing in this Privacy Policy is intended to assign a legal role that does not apply under the facts or applicable law. Section 9 describes the roles in more detail.

The Service is designed for individuals, professionals, consultants, and small teams who want to monitor their own Outlook folders and receive alerts based on rules they configure. The Service is not intended for enterprise-wide monitoring, centralized employee surveillance, resale, managed-service deployment, or regulated workflows without a separate written agreement (see Section 10). This Privacy Policy applies to the Service, its Microsoft AppSource listing, related support communications, and the legal and product pages JJJJJ operates for the Service; it does not apply to other JJJJJ products unless they expressly link to it.

1. Architecture Summary

emAIl Sentinel runs entirely inside your own Microsoft 365 environment, under your own Microsoft account credentials and your own Azure OpenAI Service endpoint. We do not operate any server, database, or backend that receives or stores your data. All persistent data resides in Office.context.roamingSettings, which is private to your Microsoft account and add-in installation, and is stored on Microsoft's servers as part of the Outlook service.

2. Data We Access

When you enable the Service, the following data from your Outlook account is accessed during each check cycle:

The Service does not read or transmit: - attachment file contents (only filenames); - email body text beyond the first 2,000 characters; - email addresses from your contacts list; or - messages outside the folders you explicitly configure.

3. Data You Provide

4. Microsoft API Services User Data Policy

The Service's use and transfer of information received from Microsoft APIs adheres to Microsoft's Graph API Terms of Use and Microsoft's Privacy Statement. Specifically:

• The Service only accesses, uses, stores, and shares Microsoft user data for the purposes described in this Privacy Policy and that are necessary to provide or improve user-facing functionality of the Service.
• The Service does not use Microsoft user data for advertising, including retargeting, personalized advertising, or interest-based advertising.
• The Service does not sell Microsoft user data.
• The Service does not use Microsoft user data for generalized AI model training.
• The Service does not allow humans to read Microsoft user data, except (a) with your affirmative agreement, (b) as necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations where the data has been aggregated and de-identified.
• The Service does not transfer Microsoft user data to third parties except as necessary to provide the Service (Azure OpenAI rule evaluation, outgoing alerts), as directed by the user, or as required by law.
• You can view and audit all data stored by the Service by inspecting roamingSettings via the browser developer tools in Outlook on the web.

4.1 Microsoft AppSource Compliance

As a condition of being listed on Microsoft AppSource, JJJJJ Enterprises, LLC:

• maintains compliance with Microsoft's App Certification Policies;
• submits to Microsoft's security and privacy review whenever Microsoft requests;
• accepts that Microsoft may, at its sole discretion, suspend, restrict, or revoke the Service's AppSource listing at any time. A Microsoft-initiated suspension will interrupt the Service; we are not liable for interruptions attributable to Microsoft actions.

JJJJJ will use commercially reasonable efforts to maintain the Service in compliance with Microsoft's certification policies and any security or verification conditions communicated by Microsoft. JJJJJ may modify, limit, suspend, or discontinue particular features, permissions, or integrations if reasonably necessary to satisfy Microsoft's requirements, address a security concern, or preserve the Service's authorization or AppSource availability.

4.2 Azure OpenAI Service — Content Handling and Retention

When a rule evaluates, the Service sends email metadata and the first 2,000 characters of the plain-text body to the Azure OpenAI Service endpoint you configure and own. Because you supply your own Azure OpenAI credentials and endpoint, data is processed by your own Azure OpenAI resource under your Azure subscription agreement with Microsoft. Handling of that content by Microsoft Azure is governed by the Microsoft Azure Service Agreement, the Azure OpenAI Service data processing terms, and the Microsoft Product and Services Privacy Statement, not by this Privacy Policy.

As of the effective date above and based on Microsoft's then-current public representations: - Azure OpenAI Service does not use your prompts or completions to train, retrain, or improve Microsoft's foundation models, by default; - Azure OpenAI Service may retain prompt and completion data for up to 30 days for abuse monitoring purposes, after which it is automatically deleted, unless you have opted into zero-retention (available in certain Azure regions and tiers); - Microsoft may log API requests for abuse prevention, debugging, and to comply with law.

Because you supply your own Azure OpenAI credentials, the data processing relationship is between you and Microsoft Azure under your Azure subscription — not between us and Microsoft on your behalf. Verify current Azure OpenAI data handling at learn.microsoft.com/en-us/azure/ai-services/openai/concepts/data-privacy.

You are responsible for reviewing and complying with the Azure OpenAI terms applicable to your subscription and for deciding whether particular email content is appropriate to send to your endpoint. If your emails may contain sensitive, regulated, confidential, privileged, or high-risk information, do not point the Service at those folders unless you have confirmed that your Azure configuration and legal basis are appropriate (see Section 10). AI-generated evaluations, summaries, and alerts may be incomplete, inaccurate, delayed, or misleading. The Service is an alerting and productivity tool; it does not provide legal, medical, financial, security, employment, or other professional advice, and it does not replace human review of important communications.

5. Third-Party Data Sharing

The Service shares data with third-party services only when you explicitly enable the integration:

The Microsoft 365 native channels (Teams, Calendar, Excel, To Do, OneNote) do not send data to any third party operated by us — they write to services within your own Microsoft 365 account using your own OAuth credentials via Microsoft Graph.

SMS — controller vs. processor roles. You, not JJJJJ Enterprises, LLC, decide whether SMS alerts are sent, which phone numbers receive them, and which provider delivers them. For purposes of applicable U.S. state privacy laws, you are the controller (or "business," under the CCPA) of any recipient phone numbers you supply. We transmit your data (recipient numbers and alert text) to the SMS provider you select, acting as a data conduit; the SMS provider processes that data as an independent processor or sub-processor on your behalf, under its own contract with you. See § 5.2 for our subprocessor list. JJJJJ does not independently collect recipient consent, maintain do-not-call or do-not-text lists, register messaging campaigns on your behalf, or audit your compliance with SMS laws; you are responsible for ensuring that each recipient has provided all legally required consent, that opt-out requests are honored, and that carrier and provider rules are followed.

We do not share any data with analytics services, advertising networks, data brokers, or any party not listed above.

SMS text-message disclosures. If you enable the SMS alert channel: message frequency varies (you receive a message only when an incoming email matches one of your rules); message and data rates may apply (your carrier's standard rates apply to messages you receive); you can opt out at any time by replying STOP, or by removing the number / disabling SMS in Settings, and reply HELP for help. The mobile numbers you enter are not sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes — they are transmitted only to the SMS provider you configure, using your own credentials, solely to deliver the alerts you requested. SMS is optional and consent is not a condition of purchase. Full program details and the in-app opt-in flow are published at our SMS Alert Notification page.

5.1 Links to JJJJJ Enterprises Related Products

Our website may display links to other products operated by JJJJJ Enterprises, LLC. The other emAIl Sentinel editions — emAIl Sentinel Pro (self-hosted) and the emAIl Sentinel Google Workspace Add-on for Gmail — are separate services with their own architectures and their own privacy policies. Other JJJJJ products, including Natty the Nocrastinator, PilotTrainerHQ (pilottrainerhq.com), and PlaneFacts (planefacts.online), are likewise independent services with their own privacy policies. Visiting or using those products is governed solely by their respective policies. This edition of emAIl Sentinel does not share your personal data with those other JJJJJ products.

5.2 Subprocessors

A "subprocessor" is a third party that processes personal data on behalf of another processor. The Service uses the following subprocessors:

We will notify registered users at least 30 days in advance before we add or replace a Microsoft-level subprocessor that processes email content (for example, if we introduce a non-Microsoft model provider as an optional rule evaluator in a future release). Notice will be posted at the URL where this Privacy Policy is hosted. You may stop using the Service if you object to a proposed subprocessor change before it takes effect.

5.3 Payment Data

The emAIl Sentinel add-in is free and collects no payment data. We do not process, receive, or store any payment card, bank, or other billing details through the add-in.

The separate, optional emAIl Sentinel Pro product (self-hosted) handles its own billing through its own payment processor under its own Privacy Policy; that billing is independent of this free add-in.

6. Data Retention

When you uninstall the add-in, roamingSettings associated with the add-in installation is cleared by Outlook.

To explicitly delete all stored data before uninstalling, open the add-in Settings and use Settings ▸ Clear all data, or remove the add-in from Outlook's add-in management page.

7. Data Security

• Encryption at rest. All roamingSettings values are encrypted at rest on Microsoft's infrastructure as part of the Outlook service. The Service does not implement its own encryption layer, and we do not offer customer-managed or bring-your-own encryption keys. For workloads that require FIPS 140-2 validated cryptography, customer-managed keys, or HSM-backed key storage, the Service is not suitable.
• Encryption in transit. All outbound network calls from the Service use HTTPS (TLS 1.2 or higher).
• Credential handling. Your Azure OpenAI API key is masked in the Settings UI after you save it — only the last four characters are shown; the input field is left blank so the full key is never redisplayed. SMS provider credentials are visible within the Settings UI so you can review and update them; all credentials are stored encrypted at rest as described above.
• Attack surface. The Service has no external backend, no database, and no staff access to your roamingSettings store. The only attack surface is your own Microsoft 365 account and the third-party APIs you configure.
• Operational telemetry. The add-in may log unhandled JavaScript exceptions to Azure Application Insights (or a similar Microsoft-hosted telemetry service) within our Azure subscription so we can diagnose crashes. These logs may include function names, error messages, and stack traces. They do not include your email content, your rules, your Azure OpenAI API key, or SMS credentials. Logs are retained per the service's default retention policy and are accessed only to investigate errors or abuse.
• Cookies and tracking — none. The Service does not set cookies. Our public marketing website does not set cookies, does not use third-party analytics, does not embed tracking pixels, and does not load fonts or scripts from third-party CDNs.
• Certifications. JJJJJ Enterprises, LLC does not currently hold SOC 2 Type II, ISO 27001, HIPAA, or PCI DSS certifications. The Terms of Service (§ 16) describe the security documentation we make available on request.

7.1 Incident Notification

If we become aware of a security incident affecting data the Service processes on your behalf, we will notify affected users without undue delay — and in any event within 72 hours of becoming aware of the incident where required by applicable U.S. state breach-notification law — via the email address associated with your Microsoft account, and will describe the nature of the incident, the data potentially affected, and the steps you can take.

8. Children and Young Users

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18, or under 13 in the United States as defined by the Children's Online Privacy Protection Act (COPPA). The Service provides no age-gating mechanism; parents and guardians who allow a minor access to a Microsoft account on which the Service is installed remain responsible for supervising that use.

If we learn that we have collected personal data from a child in violation of applicable law, we will take steps to delete it promptly. Contact legal@jjjjjenterprises.com if you believe a child's data has been collected.

9. Geographic Scope and Your Privacy Rights

The Service is currently offered exclusively to users located in the United States (see Terms of Service § 2). The Microsoft AppSource listing is region-restricted to the United States. We do not target the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction outside the United States, and we do not currently maintain an EU/UK representative or Standard Contractual Clauses framework for transfers from those jurisdictions. If we expand availability in the future, this Policy will be updated and existing users will be notified before any cross-border transfers begin.

Your data is processed by Microsoft (Outlook/Microsoft 365, Azure OpenAI Service) and, if you enable SMS, by your chosen SMS provider, in the United States and other regions where those subprocessors operate data centers. See § 5.2.

Controller / processor roles. For personal data contained in the emails you process through the Service (the sender address of an inbound email, its subject, body excerpt, attachment filenames, any phone numbers you supply as SMS recipients, etc.):

• You are the controller. You determine the purposes and means of processing by selecting which Outlook folders to watch, writing the rules, and choosing the alert channels.
• JJJJJ Enterprises, LLC acts as a service provider / processor on your behalf, performing the rule evaluation and alert dispatch you directed. We do not independently decide what email content to process or where to send it.
• Microsoft (Microsoft 365, Outlook, Azure OpenAI Service, and Microsoft 365 native alert channels) and your chosen SMS provider act as subprocessors (or, for SMS providers selected by you, as independent processors under a direct contract between you and them). See § 5.2.

For account-level data (support correspondence with us) JJJJJ Enterprises, LLC acts as a controller.

To the extent GDPR, UK GDPR, or similar international laws apply despite the U.S.-only scope, JJJJJ's legal bases for processing may include performance of a contract, consent for optional integrations, legitimate interests for security and abuse prevention, compliance with law, and processing at your direction. International expansion may require updated terms, a data processing agreement, representative obligations, transfer safeguards, and additional disclosures; JJJJJ may restrict or discontinue access from particular jurisdictions unless and until those requirements have been addressed.

9.1 Your Rights Under CCPA / CPRA (California Residents)

Notice at Collection (Cal. Civ. Code § 1798.100(b)). At or before the point at which the Service first collects personal information from you — which occurs when you install the add-in and open its Settings pane — this Privacy Policy is linked from the add-in Help pane and from the Microsoft AppSource listing. The categories of personal information we collect, the purposes for which they will be used, the categories of third parties with whom they may be shared, and your CCPA rights are described below and in Section 2 (Data We Access), Section 3 (Data You Provide), and Section 5 (Third-Party Data Sharing).

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the rights described below.

Categories of personal information we process. In the 12 months preceding the date you read this policy, the Service processes:

Sources. All personal information comes from your own Outlook account, from the rules, credentials, and settings you enter directly into the Service.

Business purposes. Rule evaluation, alert generation, alert delivery via the channels you configure, basic operation of the Service. We do not use personal information for advertising, profiling, or any purpose beyond the Service functions you enable.

Third parties with whom we share. Only those listed in Section 5 of this Policy, and only at your direction (i.e., only when you enable the relevant alert channel or integration).

Sale or sharing of personal information. We do not sell or share personal information as those terms are defined under CCPA/CPRA, and we have not done so in the 12 months preceding the effective date of this Policy. The Service has no advertising integrations and no cross-context behavioral advertising.

Sensitive personal information (SPI). Email body excerpts sent to Azure OpenAI for evaluation may incidentally contain sensitive personal information (for example, health information in a message from your doctor, or account numbers in a statement from your bank). The Service uses SPI only for the single, narrow, disclosed purpose of: (i) evaluating whether the email matches a rule you configured, and (ii) composing the alert message your configured channels receive. We do not use SPI to infer characteristics, build profiles, train or fine-tune any model, cross-reference against other users' data, or for any secondary purpose. SPI is not stored by the Service beyond the transient in-memory processing of each check cycle — once Azure OpenAI has returned a match decision and the alert has dispatched, the in-memory copy is discarded. This use is within the narrow set of permissible purposes enumerated at Cal. Civ. Code § 1798.121(a); accordingly, the right to limit use and disclosure of sensitive personal information does not restrict this processing further.

Your rights. - Right to know — request disclosure of the categories and specific pieces of personal information we process about you - Right to delete — request deletion of your personal information - Right to correct — request correction of inaccurate information - Right to opt out of sale/sharing — not applicable; we do not sell or share - Right to limit use of sensitive personal information — not applicable; we use SPI solely for the permissible business purposes described above (performing the Service at your direction) - Right to non-discrimination — we will not discriminate against you for exercising any CCPA right

How to exercise your rights. Email legal@jjjjjenterprises.com with the subject "CCPA Request" and your Microsoft account email address (see Section 13). We will respond within 45 days.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. To verify the agent's authority, we require:

1. a copy of a written permission signed by you (or, in lieu of written permission, a valid power of attorney issued pursuant to California Probate Code §§ 4000–4465);
2. a signed declaration under penalty of perjury from the agent confirming their authorization to act on your behalf; and
3. confirmation directly from you (by a method we specify) that you authorized the agent to submit the request.

We may deny an agent's request if the above verification is not satisfied. These requirements do not apply to agents who are attorneys licensed in California acting within the scope of their representation.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may request information about whether we disclose personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes; accordingly, a Shine the Light request will return a "no disclosures" response.

9.2 Residents of Other U.S. States with Comprehensive Privacy Laws

A growing number of U.S. states have enacted comprehensive privacy laws that grant residents rights similar (but not identical) to those granted under California's CCPA/CPRA. These include, as of the effective date of this Policy: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA — our home-state law), Oregon (OCPA), Montana (MTCDPA), Tennessee (TIPA), Delaware (DPDPA), New Jersey (NJDPA), Iowa (IPDPA), Indiana (INPDPA), New Hampshire (NHPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MCDPA), Nebraska (NDPA), Rhode Island (RI-DTPPA), and any additional state laws that enter into force after the effective date.

Rights typically available to residents of these states include the right to:

• access / confirm whether we are processing your personal data;
• correct inaccurate personal data;
• delete personal data we hold about you;
• port your personal data in a portable, machine-readable format;
• opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects about you (we do none of these, so the opt-out is automatically satisfied);
• appeal our response to a rights request under laws that provide an appeal mechanism (Virginia, Colorado, Connecticut, Texas, Oregon, and others).

To exercise any of these rights, email legal@jjjjjenterprises.com with your Microsoft account email address and the state under whose law you are making the request. We will respond within 45 days (some states allow an additional 45-day extension for complex requests; we will notify you in writing if an extension is needed). If we decline your request, you may appeal that decision by replying to the response email or by emailing legal@jjjjjenterprises.com with the subject line "Privacy Appeal"; we will review appeals within 60 days and, where a state law requires, inform you of your right to contact the state attorney general.

As with CCPA, we do not sell or share personal information, engage in targeted advertising, or conduct automated profiling producing legal or significant effects. We do not process sensitive personal data except as described in § 9.1 (SPI) above.

9.3 Do Not Track and Global Privacy Control

The Service does not track users across websites or services and does not respond to Do Not Track signals because it has no occasion to do so. The Service honors Global Privacy Control signals in the sense that it does not sell or share personal information regardless.

10. Not for Regulated or High-Risk Data

The Service is not designed for, and JJJJJ does not hold the Service out as compliant with, HIPAA, PCI DSS, SOX, GLBA, FERPA, or similar regulated-data regimes. Unless JJJJJ expressly approves a particular regulated-data use case in a separate written agreement, the Service should not be used to process protected health information, cardholder data, student education records, regulated financial records, children's data, classified information, export-controlled information, or other highly regulated information.

A separate written agreement may permit a specifically approved regulated-data workflow only if the parties have identified the applicable legal and technical requirements and confirmed that the relevant Microsoft 365 configuration, Azure OpenAI tier and region, alert channels, integrations, security measures, service providers, and contractual protections are appropriate. The availability of such an agreement is not guaranteed and must be determined case by case before regulated information is processed through the Service.

For HIPAA specifically: JJJJJ is not acting as a Business Associate, does not offer a Business Associate Agreement for the Service, and does not intend the Service to be used for PHI. If you are a healthcare provider, health plan, healthcare clearinghouse, business associate, subcontractor, or other party subject to HIPAA, you must not use the Service to monitor folders or messages containing PHI unless JJJJJ has first entered into a separate written agreement that expressly authorizes the specific HIPAA-related workflow and includes any required Business Associate Agreement or other safeguards.

You are responsible for segregating regulated and non-regulated email, choosing appropriate folders, disabling inappropriate alert channels, and ensuring that you do not send sensitive or regulated content to your Azure OpenAI endpoint, SMS providers, webhooks, MCP endpoints, or other third parties without a lawful basis and appropriate safeguards. The Service also is not intended to process attorney-client privileged communications, trade secrets, employment records, personal financial data, government identifiers, biometric data, genetic data, precise geolocation, or other sensitive personal information unless you have independently determined that the use is lawful and appropriate. Treat email-derived alerts as potentially containing confidential information.

11. Business Transactions, Legal Requests, and Protection of Rights

If JJJJJ is involved in a merger, acquisition, financing, reorganization, asset sale, bankruptcy, or similar transaction involving the Service, limited information related to the Service may be transferred as part of that transaction, subject to this Privacy Policy and applicable law. Because JJJJJ does not operate a backend storing your email content, the information available for transfer is limited.

We may disclose information we hold if we reasonably believe disclosure is necessary to comply with law, respond to valid legal process, cooperate with regulatory requests, enforce our agreements, investigate misuse, prevent fraud or security threats, protect the rights or safety of users or the public, or establish, exercise, or defend legal claims. Any disclosure will be limited to what we reasonably believe is necessary for the applicable purpose.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that reduce your rights or expand the categories of data processed, we will notify you by email to the Microsoft account associated with your use of the Service at least 30 days before the change takes effect. We will obtain affirmative consent where required by applicable law before implementing new uses of your data not described in this Policy. The "Effective date" at the top will reflect the latest revision.

13. Contact

Requests may also be sent by mail to:

JJJJJ Enterprises, LLC
20079 Stone Oak Parkway, Ste 1105-116
San Antonio, TX 78258
United States

For technical support you may also open an issue on GitHub — issues are tracked, searchable, and get the fastest response.

We will respond to data-rights requests within the timeframes specified in Section 9.1 (CCPA: 45 days) and Section 9.2 (other U.S. states: 45 days).