Privacy policy

Who is responsible

PromoStash is operated by Akash Sahani, based in Mumbai, Maharashtra, India. In this policy, “we” refers to that operator. For privacy questions, requests, or grievances, contact Akash Sahani at hello@promostash.app.

Information we handle

• Account information: your email address, display name, receiving address and aliases, settings, sign-in sessions, and authentication records.
• Your archive: emails you receive, forward, or import, including sender and recipient details, subjects, dates, message content, links, attachment metadata, brands, and collections.
• Connected tools: the applications you authorize, their permissions, connection records, and protected access credentials.
• Billing: your selected plan, subscription status, billing period, amount and currency, and payment-provider identifiers. Payment details entered at checkout are handled by Dodo Payments and its payment providers; PromoStash does not store your full card number or security code.
• Operations and support: messages you send us, request and error information, IP addresses and browser information processed by our hosting and authentication systems, and records used to prevent abuse.

Archive information comes from you and from senders delivering to an address you use with PromoStash. An email may contain information about other people or personalized links. Only add information you are entitled to store and share.

How we use it

We use this information to create and secure your account, receive and display emails, organize and search your archive, deliver results to tools you authorize, manage subscriptions, answer support requests, investigate errors and abuse, and meet applicable legal obligations.

Where a legal basis is required, account and service processing supports our contract with you; security, troubleshooting, and support support our legitimate interests in operating a reliable service; required financial or legal records support legal obligations; and optional processing that requires consent relies on your consent. You can withdraw optional permissions, including connected-tool access. We do not sell your archive or use it for advertising.

Your email address is needed for sign-in. You can use the archive without connecting an AI tool. PromoStash does not make automated decisions that determine your eligibility for employment, credit, or similar significant matters.

Service providers

We use Vercel for website and application hosting, database infrastructure to store account and archive records, Resend for account email and incoming-email processing, and Dodo Payments for checkout and billing. These providers process the information needed for their services. Dodo Payments also handles purchase information under the terms and privacy notice presented at checkout.

We may access relevant information to provide support, investigate an incident, or comply with a lawful request. We may disclose information where legally required or reasonably necessary to protect people, prevent fraud, or establish or defend legal claims.

PromoStash is operated from India. Our providers and the tools you choose may process information in other countries, which may have different privacy laws. Contact us for information about the providers, processing locations, and transfer arrangements relevant to your account.

AI tools you connect

PromoStash does not run an AI model to analyze your archive. When you connect an external tool through MCP, that tool can retrieve data allowed by the permissions you grant. Read access can include email bodies, addresses, metadata, and personalized links. Optional collection-write access lets a tool organize collections.

The external provider handles retrieved information under its own terms and privacy settings, including any retention or model-training settings. Review these before connecting. Revoke connections and access keys from your account’s MCP settings to stop future access. Revocation does not delete copies a tool has already received.

Email images and links

Remote email images are hidden initially. If you choose to load them, PromoStash requests them through a proxy. This hides your IP address from the image server, but a personalized image URL may still let the sender record that it was requested. Remote images are processed temporarily rather than saved as permanent archive files.

Following a link in an email takes you to an external website. That site may receive information from the link and your browser. Archived links may contain private tokens; avoid sharing them with people or tools you do not trust.

Cookies and local storage

We use cookies needed for authentication and session security, and browser storage for preferences such as your theme. Blocking required cookies may prevent sign-in. The application does not include advertising pixels or marketing-analytics cookies. External checkout and websites you visit have their own cookie practices.

Retention and deletion

We keep your account and archive records while they are needed to provide your account, unless you delete individual content or your account. Successful account deletion removes your archive, collections, app access keys, and account-linked billing records from the application database and requests cancellation of active subscriptions. It does not itself issue a refund.

We retain receiving-address reservations without the account reference to prevent a former address being assigned to someone else. Delivery-processing receipts are scheduled to expire after 30 days; database cleanup is not instantaneous.

Deletion from the application does not instantly erase provider-held incoming emails, billing records, operational logs, or backups. Retention of those records depends on the provider’s configured retention, recovery needs, fraud prevention, and applicable legal or accounting requirements. Contact us for help with deletion requests involving those records.

Imported attachment files and complete original mail files are not preserved as a full backup. Archive export is not currently available as a self-service feature. Keep your original files if you need a separate copy.

Your choices and rights

You can edit account details, delete archived content, pause receiving, block senders, replace a receiving address, revoke connected tools, and request account deletion in Settings. Stopping incoming mail does not unsubscribe you from a sender’s list; manage that subscription with the sender too.

Depending on the law that applies to you, you may have rights to access, correct, erase, or obtain a copy of personal information; restrict or object to processing; withdraw consent; or raise a complaint with a relevant authority. To make a request or raise a privacy grievance, email hello@promostash.app. We may need to verify that you are entitled to make the request. We respond in accordance with applicable law.

You may object to processing based on legitimate interests. Tell us which processing concerns you so we can assess and respond to your request.

Security and updates

We use access controls, protected authentication credentials, signed provider notifications, and restrictions on email content to reduce risk. No service can guarantee absolute security. PromoStash is not an end-to-end encrypted vault; do not use it to store passwords, authentication codes, highly sensitive records, or information you cannot lawfully process.

The service is intended for adults aged 18 or older. If you believe a child has provided personal information, contact us. We update this policy when our practices change, show the revision date, and provide additional notice where required. See our Terms of Service for the rules for using PromoStash.