emAIl Sentinel Pro™ — Privacy Policy

Effective date: 2026-08-31 Operator: JJJJJ Enterprises, LLC ("JJJJJ", "Company", "we", "us", or "our") Service: emAIl Sentinel Pro, a self-hosted email-alerting application (the "Service" or the "Software")

This Privacy Policy explains what information the Service accesses, how that information is used, where it may be sent, how long it is retained, and the choices available to users. By downloading, installing, accessing, or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, do not install or use the Service.

For most information processed through the Service, you decide which mailboxes to connect, which folders or labels to monitor, what rules to write, what alert channels to enable, what recipients or endpoints to use, and which third-party services to connect. JJJJJ provides the software tool, which runs on infrastructure you control, under your own credentials. You retain control over the email content, folders, rules, recipients, destinations, integrations, and other processing instructions that you configure through the Service. The Service is designed so that your email content is processed on your own infrastructure and is not received or stored in any JJJJJ-operated backend, server, or database — none exists for this Service.

JJJJJ ordinarily acts as the licensor of a user-directed software tool rather than as a controller or processor of the email content you choose to process. Because the Service is self-hosted, JJJJJ does not sit in the data path at all. To the extent applicable privacy law characterizes JJJJJ as a processor, service provider, contractor, or similar recipient for particular limited information (such as license or support data), JJJJJ processes that information only as necessary to provide, secure, support, administer, or comply with legal obligations relating to the Service and not for unrelated commercial purposes. You remain responsible for determining whether you have the legal right and authority to process the content you select and to send information to the recipients, endpoints, and third-party services you configure.

The parties' legal roles may vary depending on the type of information involved, the feature being used, the applicable law, and the specific relationship between you, JJJJJ, Microsoft, Google, and any third-party service you select. Nothing in this Privacy Policy is intended to assign a legal role that does not apply under the facts or applicable law.

1. Scope and Roles

This Privacy Policy applies to the emAIl Sentinel Pro self-hosted application, its download and release channels, related support communications, and the legal and product pages JJJJJ operates for the Service. It does not apply to other products operated by JJJJJ Enterprises, LLC unless those products expressly link to this Privacy Policy. In particular, the emAIl Sentinel Google Workspace Add-on for Gmail and the emAIl Sentinel 365 Outlook add-in are separate editions with their own privacy policies reflecting their own architectures.

The Service is designed for individuals, professionals, consultants, and small teams who want to monitor their own mailboxes and receive alerts based on rules they configure. The Service is not intended for enterprise-wide monitoring, centralized employee surveillance, resale, managed-service deployment, or regulated workflows without a separate written agreement.

2. Architecture Summary — you self-host your mailbox processing

emAIl Sentinel Pro is software you run on your own infrastructure (your own server, virtual machine, container host, or personal computer). There is no JJJJJ server, database, or hosted account system that receives or stores your email content, your credentials, or your rules. The Service connects to the mailboxes you authorize — Microsoft 365 / Outlook (via Microsoft Graph) and/or Gmail (via the Gmail API) — evaluates new mail against rules you write using the large-language-model (LLM) provider you choose, and dispatches alerts through the channels you enable.

Persistent settings are stored in a database you operate, with secrets (mailbox tokens, API keys, channel credentials) encrypted at rest using an encryption key you configure and control.

Licensing is the one exception, and it is administered by a JJJJJ-operated service. Your deployment contacts it periodically to confirm your license is active. That request carries your license key, a randomly generated installation identifier, the software version, and the platform it runs on — and nothing else. Your email content, credentials, rules, recipients, and consent records never leave your infrastructure.

This architecture is important, but it does not mean no data ever leaves your infrastructure. When you enable AI rule evaluation, SMS providers, chat channels, webhooks, or other integrations, your deployment sends the relevant information to those services at your direction, using your own credentials, under your own contracts with those providers. Those third-party services process the information under their own terms and privacy policies.

3. Information the Service Accesses

When enabled, the Service accesses mailbox information only from the accounts you connect and, where configured, the folders or labels you select. The Service is designed to access and process the following categories of information on your own infrastructure:

The Service does not intentionally read or transmit attachment contents, your contact lists, email messages outside the accounts and folders you select, or email body text beyond the configured excerpt sent to your LLM provider.

4. Information You Provide or Configure

You may provide or configure information that allows the Service to operate. This information is stored in your own database, encrypted at rest where it is a secret, or sent to the third-party services you select.

5. How Information Is Used

The Service uses information, on your infrastructure and at your direction, for the following purposes:

• to provide, operate, maintain, and improve the Service;
• to monitor the mailboxes and folders you select and evaluate messages against the rules you write;
• to send alerts through the channels you configure, including SMS, Microsoft Teams, Google Chat, Outlook Calendar, Excel, Microsoft To Do, OneNote, Outlook categories/flags, Google Calendar, Google Sheets, Google Tasks, Google Docs, generic HTTPS webhooks;
• to record and honor SMS opt-in and opt-out state for the phone numbers you configure;
• to enable Free-trial and Pro features and administer your subscription;
• to provide support, respond to questions, troubleshoot errors, and investigate abuse or security issues;
• to comply with applicable law, respond to legal process, and enforce our Terms of Service, License, and related agreements;
• to protect the rights, safety, security, and integrity of JJJJJ, users, third-party providers, and the public.

Neither JJJJJ nor the Service uses email content, Google user data, Microsoft account data, PHI, sensitive personal information, or alert content for advertising, behavioral targeting, retargeting, data brokerage, or sale.

6. Google and Microsoft API Data

Google API Services User Data Policy and Limited Use. When you connect a Gmail mailbox, the Service requests the gmail.readonly restricted scope (and, for the Google-native alert channels you enable, calendar, tasks, spreadsheets, and documents scopes). The Service's use and transfer of information received from Google APIs is intended to comply with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• the Service accesses, uses, stores, and shares Google user data only as necessary to provide or improve user-facing functionality of the Service;
• the Service does not use Google user data for advertising, retargeting, personalized advertising, or interest-based advertising;
• the Service does not sell Google user data;
• JJJJJ does not use Google user data for generalized AI model training;
• because the Service is self-hosted, Google user data flows only to your deployment and to the providers you configure — no human at JJJJJ can read it, and JJJJJ receives none of it;
• the Service does not transfer Google user data to third parties except as necessary to provide the Service, as directed by you through your settings and integrations, or as required by law.

Google controls its own verification, restricted-scope, and security-review processes and may change its requirements or suspend, restrict, or revoke OAuth access under its policies. A Google-initiated review, restriction, suspension, or revocation may delay, limit, or interrupt Gmail-connected functionality.

Microsoft Graph. When you connect a Microsoft 365 / Outlook mailbox, the Service uses delegated Microsoft Graph permissions you consent to. Microsoft account data is likewise processed only on your infrastructure and sent only to destinations you configure, subject to the Microsoft APIs Terms of Use and your agreements with Microsoft.

7. Artificial Intelligence and LLM Processing

AI processing is central to the Service. When a rule evaluates, the Service sends email metadata, rule text, alert-format instructions, and the first 2,000 characters of the plain-text email body to the LLM provider you configure — Anthropic Claude, OpenAI, Google Gemini, Azure OpenAI, or any OpenAI-compatible endpoint (including a self-hosted model). The LLM assists in evaluating whether the message matches your rule and in formatting the alert.

JJJJJ does not receive your prompts or email content and does not use them to train AI models. However, your LLM provider is a third party (unless you self-host the model), and its handling of prompts, responses, logs, caching, retention, model improvement, abuse monitoring, and security review is governed by its own terms and policies, which may differ by account, API tier, billing status, and settings.

You are responsible for reviewing and complying with the terms of the LLM provider you select and for deciding whether particular email content is appropriate to send to it. If your emails may contain sensitive, regulated, confidential, privileged, or high-risk information, you should not point the Service at those mailboxes or folders unless you have confirmed that your LLM configuration and legal basis are appropriate — or you should use a self-hosted or otherwise contractually appropriate model endpoint.

AI-generated evaluations, summaries, and alerts may be incomplete, inaccurate, delayed, or misleading. The Service is an alerting and productivity tool. It does not provide legal, medical, financial, security, employment, or other professional advice, and it does not replace human review of important communications.

8. User-Directed Sharing and Alert Channels

Your deployment shares information only when necessary to operate the Service or when you configure the applicable integration. You control the mailboxes, folders, rules, channels, recipients, URLs, tokens, and endpoints used by the Service. The main sharing categories are:

The Microsoft- and Google-native channels operate within your own accounts using your OAuth authorization. Non-native endpoints — SMS providers, webhooks, chat services — are controlled by you and governed by their own terms and privacy policies.

9. SMS Alerts, Phone Numbers, and Consent Records

If you configure SMS alerts, you determine whether SMS messages are sent, which phone numbers receive them, which SMS provider is used, and what alert text is delivered. The intended use is self-notification: you enter your own mobile number to receive alerts about your own email, and the in-app consent disclosure is presented beside the number field at the point of entry.

The Software includes built-in consent tooling that operates on your infrastructure:

• Opt-in records. When a phone number is saved to an SMS channel, the Software records the number, opt-in status, source, and timestamp in your database and sends a one-time confirmation SMS describing the program, message frequency, and how to opt out.
• Opt-out handling. When your SMS provider's inbound webhook is configured, the Software processes STOP (and related keywords), records the opt-out, sends the required acknowledgement, and suppresses all further alerts to that number across every channel and provider until the subscriber opts back in with START. HELP receives an informational reply.
• Consent ledger. Opt-in and opt-out records are retained in your database as compliance documentation.

No mobile information is shared with any third party for that party's own marketing. Mobile numbers and message content are disclosed only to the SMS provider you configure, solely to deliver the messages you direct the Service to send.

These tools assist with, but do not replace, your own compliance obligations. You — not JJJJJ — are the sender of every SMS dispatched by your deployment. You are responsible for ensuring that each recipient has provided all legally required consent, that opt-out requests are honored (including configuring the inbound webhook so keyword replies reach the Software), that carrier and provider rules are followed (including 10DLC campaign registration for US A2P traffic), and that your use of SMS complies with the TCPA, applicable state messaging laws, and carrier rules. You should not use the Service for promotional, unsolicited, bulk, or marketing text messages.

10. Subprocessors, Service Providers, and Third-Party Services

Your configured providers are your subprocessors, not ours. When you enable a mailbox, LLM provider, SMS provider, or alert channel, your deployment transmits data directly to that provider using your own credentials, under your own contract with that provider. We are not a party to that processing and do not receive that data.

Our own subprocessors are limited to:

We do not authorize our service providers to use your personal information for their own marketing, advertising, behavioral targeting, or sale. If we add a provider that materially changes how information is processed, we will update this Privacy Policy and provide notice where required.

11. Payment Data

Payments are processed by Stripe. JJJJJ Enterprises, LLC is the seller and merchant of record; Stripe acts as our payment processor. You submit your card details directly to Stripe — JJJJJ does not collect, store, or process your payment card number, bank account information, or other payment credentials, and neither does the Software. We never see your full card number.

Stripe provides us the order and subscription metadata we need to administer your license: the purchase email address, what was bought, the billing country and postal region used to calculate sales tax, plan status, and renewal, cancellation, refund, or dispute status. We also receive the last four digits and brand of the card on the transaction record.

Your deployment validates your license against our licensing service, not against Stripe. That validation transmits your license key, a random installation identifier, the software version, and the platform — not your email content, credentials, rules, or any mailbox data.

Stripe's handling of payment data is governed by its own terms and privacy policy. We do not use payment information for marketing and do not sell it.

12. Data Retention, Deletion, and User Control

The Service is designed to minimize retention of email content. Email content is processed in memory during each check cycle and is not stored durably by the Software. Persistent settings and operational data live in your database, under your control.

Because Service data is stored on your own infrastructure, you can delete it directly: delete rules and channels in the UI, disconnect accounts (which deletes the account's rules and channels), revoke the OAuth grants in your Google account security settings or Microsoft account portal, drop the database, or tear down the deployment. Deleting or uninstalling the Service may limit or stop functionality. Some information may remain with the third-party services you configured — your LLM provider, SMS provider, chat spaces, native channels, webhook endpoints — under their own retention policies.

13. Security

We design the Software with commercially reasonable safeguards appropriate to its self-hosted architecture:

• secrets (mailbox tokens, LLM keys, channel credentials) are encrypted at rest in your database using an encryption key you configure;
• stored credentials are never returned by the Service's API or displayed back in full by the UI;
• all outbound calls to mail, LLM, SMS, and alert providers use HTTPS/TLS, and webhook destinations are required to be HTTPS;
• inbound SMS webhooks are authenticated by provider signature or a shared-secret callback path before an opt-out or opt-in is recorded;
• JJJJJ staff have no access to your deployment, your database, or your secrets, because no JJJJJ backend exists for this Service.

No method of transmission or storage is 100% secure, and the security of the Service depends heavily on factors you control: the server, container host, database, and backups you operate; your safeguarding of the encryption key and .env configuration; your account security with Microsoft, Google, and your chosen providers; and your keeping the Software and its host patched. We provide the software; you provide and secure the environment.

14. Incident Notification

If we become aware of a security incident affecting information we hold (license, purchase, or support data), we will investigate, take reasonable steps to contain and remediate, and, where legally required, notify affected users or relevant parties without undue delay in accordance with applicable law.

Because the Service does not operate a JJJJJ backend storing your email content, most potential incidents will involve your own infrastructure, your accounts, or the third-party services you configured. You are responsible for monitoring your deployment and for promptly revoking compromised credentials, rotating tokens and the encryption key, disabling affected integrations, and taking steps within your own accounts if you suspect unauthorized access. If you believe a vulnerability in the Software itself contributed to an incident, please report it to sentinel-support@jjjjjenterprises.com.

15. Not for Regulated or High-Risk Data

The Service is not designed for, and JJJJJ does not hold the Service out as compliant with, HIPAA, PCI DSS, SOX, GLBA, FERPA, or similar regulated-data regimes. Unless JJJJJ expressly approves a particular regulated-data use case in a separate written agreement, the Service should not be used to process protected health information, cardholder data, student education records, regulated financial records, children's data, classified information, export-controlled information, or other highly regulated information.

A separate written agreement may permit a specifically approved regulated-data workflow only if the parties have identified the applicable legal and technical requirements and confirmed that the relevant deployment configuration, LLM provider and tier, alert channels, integrations, security measures, service providers, and contractual protections are appropriate. The availability of such an agreement is not guaranteed and must be determined case by case before regulated information is processed through the Service.

For HIPAA specifically: JJJJJ is not acting as a Business Associate, does not offer a Business Associate Agreement for the Service, and does not intend the Service to be used for PHI. If you are subject to HIPAA, you must not use the Service to monitor mailboxes or folders containing PHI unless JJJJJ has first entered into a separate written agreement expressly authorizing the workflow and including any required safeguards.

You are responsible for segregating regulated and non-regulated email, choosing appropriate mailboxes and folders, disabling inappropriate alert channels, and ensuring that you do not send sensitive or regulated content to your LLM provider, SMS provider, webhooks, or other third parties without a lawful basis and appropriate safeguards. The Service also is not intended to process attorney-client privileged communications, trade secrets, employment records, personal financial data, government identifiers, biometric data, genetic data, precise geolocation, or other sensitive personal information unless you have independently determined that the use is lawful and appropriate. Treat email-derived alerts as potentially containing confidential information.

16. Children and Young Users

The Service is not directed to children and is not intended for use by individuals under 18. We do not knowingly collect personal information from children. You must not use the Service to process children's personal information, student records, or other child-related data. If we become aware that information from a child has been processed through the Service in a way that requires action under applicable law, we will take reasonable steps to address the issue.

17. Geographic Scope and International Users

The Service is currently intended for users located in the United States only. It is not currently intended to be offered to individuals in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions outside the United States.

If you access or use the Service from outside the United States, or use it to process information relating to individuals outside the United States, you are responsible for ensuring that your use complies with all applicable local laws, including privacy, data protection, electronic communications, AI, consumer protection, and international transfer requirements.

To the extent GDPR, UK GDPR, or similar international laws apply despite the U.S.-only scope: for the email content, rules, recipients, endpoints, and integrations you choose, you are ordinarily the controller and the operator of the processing software, and JJJJJ provides a self-hosted tool without access to that data. For the limited license and support data JJJJJ holds, our legal bases may include performance of a contract, legitimate interests in security and abuse prevention, compliance with law, and consent where required. International expansion may require updated terms, a data processing agreement, representative obligations, transfer safeguards, and additional disclosures; JJJJJ may restrict or discontinue access from particular jurisdictions unless and until those requirements have been addressed.

18. California and U.S. State Privacy Rights

Depending on where you live and which privacy laws apply, you may have rights to request access, correction, deletion, portability, restriction, or information about how your personal information is used, and to opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling. We do not sell personal information, do not share personal information for cross-context behavioral advertising, and do not use personal information for targeted advertising.

Note that the personal information JJJJJ holds about you is limited to your purchase/license data (processed via Stripe), the installation check-in records described in Sections 2 and 11, your product-email history, and any support correspondence. All of it can be deleted on request — more than was true when licensing ran entirely through the payment processor. The contents of your mailboxes, your rules, your recipients, and your consent ledger live on your own infrastructure, where you can access, correct, or delete them directly (see Section 12) — no request to JJJJJ is needed or effective for that data, because we do not have it.

California residents may have rights under the CCPA as amended by the CPRA. For California purposes, the categories of personal information JJJJJ processes are limited to identifiers, commercial information related to your purchase and subscription status, and limited internet or other electronic network activity information in the form of the license check-in records described in Section 11.

Texas residents may have rights under the Texas Data Privacy and Security Act, to the extent it applies to JJJJJ and the particular processing activity, including rights to confirm, access, correct, delete, obtain a portable copy, and opt out of certain sales, targeted advertising, or qualifying profiling. Because JJJJJ does not sell personal data or use it for targeted advertising, those opt-out rights may not apply to our current practices.

Residents of other U.S. states may have similar rights under applicable comprehensive state privacy laws. The scope of any right, available exceptions, verification requirements, response timing, and appeal rights depend on the law that applies.

To submit a privacy request, email legal@jjjjjenterprises.com with the subject line "Privacy Request", the email address associated with your purchase, and the state law under which you are making the request. We may need to verify your identity before responding, and we respond within the timeframe required by applicable law (generally 45 days). If we deny or limit a request and applicable law provides a right to appeal, you may appeal by replying to our decision or emailing legal@jjjjjenterprises.com with the subject line "Privacy Appeal". We will not discriminate against you for exercising legally available privacy rights. Certain requests may be limited where the information is controlled by you, stored only on your infrastructure, needed to provide the Service, needed for security or legal purposes, already deleted, de-identified, or held by a third-party service under its own policies.

19. Cookies, Tracking, and Marketing

The Service does not set advertising cookies, use third-party tracking pixels, sell personal information, or share personal information for targeted advertising. The public website and legal pages for the Service are intended to be informational and may operate without tracking cookies. If we later add analytics, we will update this Privacy Policy before using the data in a materially different way.

Product email. We may send you product announcements and updates about the Software. Every such message includes an unsubscribe link, and unsubscribing is honored immediately and permanently. Essential notices about your license — expiry, security, and billing — are sent regardless, as they are necessary to provide the Service.

The Service does not respond to Do Not Track signals because it does not track users across third-party sites. Global Privacy Control signals are honored in the sense that we do not sell or share personal information for targeted advertising regardless of whether such a signal is present.

20. Business Transactions, Legal Requests, and Protection of Rights

If JJJJJ is involved in a merger, acquisition, financing, reorganization, asset sale, bankruptcy, or similar transaction involving the Service, limited information related to the Service may be transferred as part of that transaction, subject to this Privacy Policy and applicable law. Because JJJJJ does not operate a backend storing your email content, the information available for transfer is limited to license, purchase, and support records.

We may disclose information we hold if we reasonably believe disclosure is necessary to comply with law, respond to valid legal process, cooperate with regulatory requests, enforce our agreements, investigate misuse, prevent fraud or security threats, protect the rights or safety of users or the public, or establish, exercise, or defend legal claims. Any disclosure will be limited to what we reasonably believe is necessary for the applicable purpose.

21. Links and Related Products

Our website and documentation may contain links to third-party websites, Microsoft and Google services, LLM providers, SMS providers, support resources, or other products operated by JJJJJ. We do not control third-party sites or services and are not responsible for their content, privacy practices, or terms.

Other products operated by JJJJJ Enterprises, LLC — including the emAIl Sentinel Gmail add-on, the emAIl Sentinel 365 Outlook add-in, Natty the Nocrastinator, PilotTrainerHQ, PlaneFacts, and future products — are separate services governed by their own terms and privacy policies. This Privacy Policy applies only to emAIl Sentinel Pro unless another product expressly adopts it.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes are effective when posted with an updated effective date, unless a later effective date is stated. If we make material changes that reduce your rights, materially expand the categories of information we receive, or materially change how information is used or shared, we will provide reasonable notice — and where we hold your contact information, we will notify you by email at least 30 days before the change takes effect. We will seek affirmative consent where required by applicable law before implementing new uses of information not described in this Privacy Policy.

23. Contact

Requests may also be sent by mail to:

JJJJJ Enterprises, LLC
20079 Stone Oak Parkway, Ste 1105-116
San Antonio, TX 78258
United States

Please do not include sensitive, regulated, privileged, or confidential email content in support requests unless specifically requested and appropriate safeguards are in place.