1. Who we are
Untitled provides the Untitled Email service. You can contact our privacy team at operations@untitledemail.com.
2. Scope and our data-protection roles
This notice applies to personal information handled through untitledsuite.com, Untitled Email, its apps and related support, domain, billing and AI features.
Untitled is normally the controller for account, subscription, service administration, support, fraud prevention and security information because we decide why and how that information is used. Where a business customer determines why personal information in its messages, contacts or connected inbox is processed, that customer may be the controller and Untitled may act as its processor or service provider. In that situation, contact the relevant business first about its use of your information; we will support it as required by our contract and data-protection law.
3. Information we collect
Account and profile information
This can include your name, email address, recovery and authentication details, profile or company image, organisation, preferences, account role and communications with support.
Sales and demo enquiries
If you ask for a demo or contact our sales team, we collect the contact, company, role and telephone details you provide, along with what you tell us about your team, interests and challenges. We use this information to respond, tailor the conversation and administer the potential business relationship.
Email and contact information
We process message headers and content, sender and recipient addresses, attachments, drafts, folders, contacts, delivery status and related metadata so the Service can send, receive, store, search and display email. If you connect another provider, we also process the account details, authorisations and tokens needed to maintain that connection.
Domain and workspace information
This includes domain names, DNS and verification records, aliases, sender identities, workspace membership, permissions, storage use and configuration history.
Billing information
We receive subscription status, plan, invoices, Stripe customer and subscription identifiers, billing contact details and limited payment-method information such as card brand and last four digits. Stripe processes full card details directly; Untitled does not receive or store your full card number.
Device, usage and security information
We collect information such as IP address, device and browser type, session identifiers, dates and times, feature interactions, error reports, email-delivery events, authentication events and security logs. We may receive information from your organisation administrator, connected inbox provider, domain provider, Stripe, email-delivery partners and people who communicate with you.
4. How and why we use information
| Purpose | Typical UK GDPR basis |
|---|---|
| Provide accounts, send and receive email, connect inboxes, manage domains, deliver AI features and provide support. | Performance of our contract with you, or steps you ask us to take before entering it. |
| Process subscriptions, invoices and account changes. | Performance of our contract and compliance with tax, accounting and other legal duties. |
| Authenticate users, prevent abuse and fraud, investigate incidents, protect deliverability and secure the Service. | Our legitimate interests in providing a safe, reliable service; compliance with legal duties where applicable. |
| Diagnose faults, understand service performance and improve features. | Our legitimate interests in maintaining and improving the Service, balanced against your rights. |
| Send service notices and respond to questions or rights requests. | Performance of our contract, legal obligation and our legitimate interests in administering the Service. |
| Respond to sales and demo requests and tailor a requested product walkthrough. | Steps you ask us to take before entering a contract and our legitimate interests in responding to business enquiries. |
| Send optional marketing or use non-essential technologies. | Your consent where required. You may withdraw it at any time. |
| Establish, exercise or defend legal claims and respond to lawful requests. | Legal obligation and our legitimate interests in protecting our rights and users. |
If we ask for information that is required to provide the Service or comply with law, we will explain this where it is not obvious. Without it, some features may not work.
5. Email content and Untitled AI
Email necessarily involves processing information about senders, recipients and message content, including people who do not have an Untitled account. We use that information to route, present, secure and troubleshoot communications and to follow account-holder instructions.
When you use Untitled AI, we may process your prompt, relevant message or conversation context, generated output, feedback and technical metadata to provide and secure the requested feature. AI providers acting for us may receive that information under contractual and data-protection safeguards. Avoid including personal or confidential information that is not needed for the request, and review generated output before using it.
7. International transfers
Some providers or email recipients may be outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we use an adequacy regulation, approved contractual clauses (including the UK addendum or international data transfer agreement), or another lawful mechanism. We assess supplementary protections where appropriate. Contact us if you would like more information about the safeguard used for a particular transfer.
8. Security
We use technical and organisational measures designed to protect personal information, such as access controls, authentication, encryption in transit where supported, monitoring and restricted staff access. No system or email transmission can be guaranteed completely secure. Protect your sign-in methods and contact us promptly if you suspect unauthorised access.
9. How long we keep information
We keep personal information only for as long as needed for the purposes described here. We consider whether an account is active, the type and sensitivity of the information, user settings and deletion requests, security and dispute needs, backup cycles, and legal or accounting requirements. Message content is generally retained while you choose to store it in the Service. Deleted information may remain for a limited period in backups or logs before it is overwritten, unless we must preserve it for security, legal claims or law. Billing and transaction records may be kept for longer where financial law requires it.
We may anonymise information so it no longer identifies a person; anonymised information may be kept and used for service analysis and improvement.
11. Your UK data-protection rights
Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time where we rely on it, without affecting earlier lawful use. You may also have rights concerning decisions made solely by automated means that have legal or similarly significant effects.
Email operations@untitledemail.com to exercise a right. We may need information to verify your identity and authority. Rights can have legal exceptions; if we cannot fulfil a request, we will explain why where the law permits. If a business customer controls the relevant information, we may direct your request to that customer.
12. Children
The Service is not directed to children under 13, and we do not knowingly create accounts for them. If you believe a child under 13 has provided personal information through the Service, contact us so we can investigate and take appropriate action. Parents, guardians and organisations remain responsible for deciding whether the Service is suitable for older children and for any permissions required by law.
13. Changes to this notice
We may update this notice when our Service, providers or legal obligations change. We will post the new version here and change the effective date. We will give additional notice through the Service or by email if a change materially affects how we use personal information.
14. Contact and complaints
Please contact us first if you have a privacy question or complaint so we can investigate it. You also have the right to complain to the UK Information Commissioner’s Office. Information about your rights and complaints is available on the ICO website.