Your data should make the product work—not become the product.

Read the policy below for the data used to run the service, why it is needed, retention choices, and your rights. You can manage analytics consent here, inspect our subprocessors, or submit a verified privacy request.

Privacy Policy

Effective October 13, 2026

Elite Email Tracker provides email engagement tracking, link tracking, account analytics, and team administration. This policy describes the data the service actually processes.

Data we process

Account and billing: account email, password hash, plan, team membership, roles, device activations, and billing identifiers. Payment card details are processed by our payment provider, not stored by us.
Browser-local Gmail tracking: Gmail subjects, addresses, mailbox identifiers, reply observations, and associations with independent tracking IDs stay in account-scoped browser local storage, never Chrome Sync. Only opaque tracking IDs and eligible fresh authored link destinations register with Elite. Generic events are joined to the message locally and cannot certify a named recipient.
Other tracking and fresh cloud content: Outlook and Yahoo retain their supported cloud tracking associations. When you deliberately compose a new cloud outbox message or campaign, Elite stores its independently authored recipients, subject, content, attachments, schedule, and delivery state.
Outreach content: when a user deliberately uses Outreach, we store contacts, lists, templates, snippets, signatures, campaign steps, rendered message content, delivery state, and uploaded files so the service can personalize, schedule, send, retry, and report on that campaign.
Engagement signals: pixel requests and tracked-link redirects, timestamps, IP address, user-agent, referrer when supplied, and derived browser, mail client, operating system, device class, network/ASN/ISP, approximate city/region/country, and signal classification.
Operations: security audit events, support messages, error diagnostics, request-rate data, and delivery state needed to operate and protect the service.
Website and product usage analytics: with permission, Google Analytics 4 records page paths, approved campaign tags, traffic source, broad device context, navigation, scroll depth, time on page, funnel steps, and confirmed product outcomes. These include account creation, first mailbox connection, first verified tracked send, first document share-link creation, time to first value, daily confirmed product activity, safe action-failure categories, and paid subscription invoices with plan, currency, amount, and a transaction reference. A random analytics identifier associates consented account activity across visits. Microsoft Clarity records interaction patterns, heatmaps, diagnostics, and masked session replays. We exclude recipient-facing shared documents, signatures, polls, and videos from these tools and explicitly mask authenticated dashboard content.
Account and organization verification: email-verification status, hashed and expiring verification challenges, exact-email Team invitations, optional organization domain claims and DNS verification state, enrollment policy, join requests, and administrator audit events. Raw email, invitation, DNS, OAuth state, and session tokens are not stored in operational metrics.

What engagement intelligence means

Remote-image requests are signals, not guaranteed proof that a particular person read a message. Mail providers, privacy relays, and security scanners may fetch images or links. We classify these separately and display confidence and provenance. A proxy IP or user-agent can describe the proxy rather than the recipient; unavailable values remain unknown. Group messages use group attribution unless the provider permits recipient-specific delivery.

How data is used and shared

We use data to provide tracking, analytics, notifications, authentication, billing, fraud prevention, support, and service reliability. Team data is visible according to administrator-configured roles. We may use infrastructure, email, geolocation-database, payment, and push-notification processors under service agreements. We do not sell personal information or use tracked-message data for third-party advertising.

Google sign-in uses your verified email. Cloud Gmail access uses only identity and gmail.send to send independently authored messages; selected spreadsheets and documents use drive.file and Google Picker for files you choose. Optional Google Contacts sync uses contacts.readonly for saved names, email addresses, phone numbers and organizations. Elite CRM notes, tags, custom fields and manual edits are preserved; Elite edits do not write back to Google Contacts. Pausing, disconnecting or deleting a Google contact stops updates without deleting the enriched Elite record. Cloud access cannot read your Gmail mailbox, save provider drafts, detect replies or bounces, or change threads. The native Gmail client keeps restricted Gmail credentials, mailbox content, attachments, and private derived data on the device. Gmail browser associations stay local to the browser. Full Outlook access and the contextual Gmail Workspace add-on use their separate permission models.

Our use and transfer of all Google Workspace data, including selected files, saved contacts and derivatives, complies with the Google API Services User Data Policy and Limited Use requirements. We do not use this data for generalized or foundational model training. Native or historical private Gmail content is excluded from cloud AI and external Apple Writing Tools. Workspace AI stays unavailable until the operator supplies current no-training and retention evidence matching the actual configured provider, gateway, model, upstream service, and deployed tier.

Cloud tokens for narrow Google grants are encrypted at rest. Native restricted credentials use device secure storage. Google Picker receives a short-lived, scope-verified token held only in memory. Local operation depends on the device or browser being available; reinstalling or clearing local storage can remove associations. Owned opaque tracking records can recover local history when their pixels are present in Gmail Sent, without uploading mailbox metadata.

Stopping independent tracking prevents new event collection. Deleting local history and tracking events removes those records; minimal opaque redirect records remain so links already delivered still reach their destinations. Tracking permission checks use independently supplied contacts and permission evidence, matched to Gmail recipients locally. Strict permission mode refuses tracking when current evidence is unavailable; you can explicitly send without tracking.

Approximate IP geolocation and network data includes DB-IP Lite data under CC BY 4.0. IP Geolocation by DB-IP.

Analytics cookies and choices

Google Analytics 4 and Microsoft Clarity are disabled until you allow analytics through our privacy choices. Advertising storage, ad personalization, and advertising user data remain disabled. Your choice is stored locally in your browser and can be changed at any time with the “Privacy choices” control on this page. If you decline or enable a browser Global Privacy Control or Do Not Track signal before choosing, these analytics remain off. With permission, we retain GA4 browser and session identifiers for server-confirmed outcomes; withdrawing permission clears those identifiers and suppresses queued outcomes for the associated account. Server attribution expires after 90 days without a consented visit. We do not send form values, email addresses, internal account IDs, document contents, recipient data, or arbitrary URL query parameters to these services. Approved campaign tags must not contain personal information.

Roles and legal bases

For customer-directed tracking, the customer determines the purpose and means and is generally the controller or business; Elite Email Tracker acts as its processor or service provider. We are controller for account administration, security, billing, and our own legal obligations. Depending on context, processing may rely on consent, contract, legal obligation, or legitimate interests after the customer assesses necessity, balancing, notice, and local electronic-communications rules. Strict permission mode lets an organization require recorded recipient permission before a tracker can be inserted.

Security and retention

We use scoped installation credentials, hashed opaque tokens, encryption for provider refresh credentials, encrypted transport in production, role-based access, rate limits, audit logs, and restricted production secrets. Customers can configure engagement-event retention from 1 to 2,555 days and separate network/location retention from 0 to 365 days; defaults are 365 and 30 days. Those settings also remove old outreach delivery events and redact or delete tracked-file network events. Outreach content and files remain until the user archives or deletes them or deletes the account. Account, billing, security, and verified rights-request records may be retained longer where necessary. Backups may persist for a limited recovery window before expiration.

International transfers

Data may be processed in countries different from the sender or recipient. Where required, transfers use an applicable adequacy decision, contractual safeguards such as the European Commission Standard Contractual Clauses, and supplementary security measures. Customers should review the subprocessor list and execute the Data Processing Addendum before regulated production use.

Your choices and rights

Users can disable tracking for a message, disconnect or revoke an installation, export authorized team analytics, leave or be removed from a team, and uninstall the extension. Depending on location, account holders and recipients may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or appeal, and may complain to a regulator. Submit a verified privacy request. We may retain records required for security, disputes, or law and will explain any applicable exception.

Team owners may invite people by exact email without claiming a company domain. Optional DNS TXT verification proves control of a domain and enables invite-only, request, automatic-enrollment, or blocked policies. New verified domains remain invite-only until an administrator changes the policy. Explicit external invitations remain available unless the Team owner disables them.

Recipient responsibilities

Customers control whom they email and must use the service lawfully, provide any notices or consent their circumstances require, and avoid tracking where prohibited. The service is not intended for children under 13.