Privacy Policy

This Personal Data Processing Policy has been prepared by FunFirst s.r.o., with registered office at Na louži 258/13, Vršovice, 101 00 Praha 10, identification number 040 11 635, registered in the Commercial Register kept by the Municipal Court in Prague under file number C 241333 ("we ").

We operate a web application for sending newsletters and commercial communications, which can be found atemailit.com (" Platform"). You can register on the Platform and use our services or just browse information about our company and our emailit.com project.

This privacy policy tells you why and how we process your personal data when you visit the Platform website. You will also learn how we process your personal data if you enter into a contract with us through the Platform and use our services. You will also learn what cookies we use on the Platform and how we work with them. This policy also contains information about what rights you have in relation to the processing of your personal data.

If you are the recipient of newsletters and commercial communications sent to you via our Platform, you will find all the information about the processing of your personal data from the person who is listed as the sender of that email. We only assist them with sending the messages, but we are not the controller of your personal data, that is the sender.

We process your Personal Data in accordance with Regulation (EU) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the " Regulation") and Act No. 110/2019 Coll., on the processing of personal data, as amended.

If you have any questions or comments, you can contact us using these contact details, we look forward to hearing from you:
Address: FunFirst s.r.o., Na louži 258/13, 101 00 Prague 10
E-mail: support@emailit.com
phone: +420 728 919 230

1. GENERAL INFORMATION

Who manages your personal data?

Your personal data is processed and managed by us, i.e. the data controller. The controller is the one who decides how the personal data is processed. We usually make these decisions ourselves, but we may involve other people, known as joint controllers. However, we will always inform you about this.

How do we obtain your personal data?

We obtain personal data directly from you when you provide it to us, whether through the Platform or, for example, through our communications with each other.

We may obtain your personal data from public registers and records, such as the commercial or trade register, mainly for the purpose of creating invoices and other accounting documents. We may also check the registers to check the accuracy of the information and data you have provided to us.

2. INFORMATION ON THE PROCESSING OF PERSONAL DATA

What categories of your personal data do we process?

We process the following categories of personal data:
(a) basic identification data - used to uniquely and unmistakably identify you as a data subject (e.g. name and surname and/or business name, date of birth if provided, registered or residential address and identification number), user account name;

b) contact details - telephone number, email address, delivery address;
c) communication information - information from emails, records of telephone calls or other contact forms when you communicate with us, the content of our communications, details of contracts entered into through the Platform and the services we provide to you;
d) billing and banking information - this includes, but is not limited to, information appearing on invoices, information about agreed billing terms, bank details and payments received;
e) cookies - these are used to measure traffic to the website and to generate statistics relating to visitor traffic and behaviour on the website;
f) user account information - account settings, analytical data about the user account;
g) IP addresses;
h) connected application data - the AI applications and other apps you connect to your account, the access and workspaces you approve for them, when you connected and disconnected them, and the requests they make to Emailit on your behalf.

Do you have to provide us with your personal data?

In some cases, it is indeed necessary for you to provide us with your personal data. For example, if you want to enter into a contract with us and use our services, we need your personal data in order to enter into a contract with you and provide you with our services. Unfortunately, we cannot do this without it.

Why and for what purpose do we process personal data?

We always process your personal data on the basis of a lawful reason and legal basis. Such legal basis may be:
(a) the performance of a contract and our contractual obligations - in the performance of a contract between us and the provision of our services, we will process your basic identification data, contact details, information from communications between us and, where applicable, billing and banking data, in order to properly provide you with the services related to the Platform, and without processing this personal data we cannot provide our services to you;
b) compliance with legal obligations - we have many legal obligations that require us to process your personal data, where we process basic identification data, contact data, intercommunication information, billing and banking data, in order to comply with our reporting obligations to public authorities and to comply with legal archiving and other obligations, for example under the Accounting Act;
c) protection of our legitimate interests - we may protect our interests, so we may process your basic identification data, contact data, information from communications between us and billing and banking data for the purpose of (i) defending our legal claims in judicial, extrajudicial and enforcement proceedings, where the legitimate interest is the prevention of damage on our part, (ii) sending you news regarding the Platform and our services, where the legitimate interest is to build and strengthen the relationship with you as a user of the Platform, (iii) creating internal statistics, models, records and reports, where the legitimate interest is to develop and improve our services;
(d) consent - in some cases you may give us consent to process your personal data. You have the right to withdraw your consent at any time, for example by email. However, even after the period for which you have consented to the processing of your personal data has expired or in the case of withdrawal of consent, we are not obliged to delete all your personal data, we may retain those where our legitimate interest or the law allows us to do so. If you withdraw your consent, this does not affect the lawfulness of the processing of your personal data prior to withdrawal.
e) Payment card or other data, however, we do not store this information, it is only collected by the payment gateway we work with.

How long do we process personal data?

We will process and store your personal data for the duration of the service contract and for 3 years after its termination, unless otherwise stated below.

We will process personal data processed for the purpose of defending our legal claims in judicial, extrajudicial and enforcement proceedings for a period of 15 years from the end of the relationship between us and you. This period corresponds to the longest possible limitation period provided for by law.
We will process personal data processed on the basis of our obligation to comply with our legal obligations under accounting, tax and other relevant legislation for the period specified therein; for example, we will retain personal data relating to accounting matters for 5 years from the end of the business relationship and personal data relating to tax matters for 10 years from the end of the relevant tax period.

If you are a customer of ours, we are entitled to send you our newsletters for a period of 3 years from our last mutual contact. Our legitimate interest allows us to do this. If you do not wish to receive our newsletters, you can unsubscribe by clicking on the link in the email or by sending us an email and we will delete you from our database.

If you have given us consent to process your personal data, we will process it for the duration of that consent. You can withdraw your consent at any time. However, we would like to point out that even if you withdraw your consent, we may not delete all your personal data - we may retain those where our legitimate interest or the law allows us to do so.

What about cookies?

To make the Platform work, we use cookies, which are small files that our site uses your browser to store on your device. Cookies can record certain specific information from your visits to the Platform. Cookies can be divided into essential cookies, preference and analytics cookies and marketing cookies.

Necessary cookies are necessary for the Platform to work at all, for you to use our services and for us to be able to enter into a contract with you. Because they are essential to the operation of the Platform and the provision of our services, you do not have to agree to them, nor can you refuse them.

Preference cookies allow us to tailor the content of the Platform to meet your needs and interests.
Analytical cookies are used by us to compile statistics and reports. We use them to track traffic to the Platform and where you came to the Platform from. However, if you do not agree to their use either, you can again refuse them here.

Marketing cookies allow us to tailor our service offering to your needs. For example, they allow us to offer our services through targeted advertising, including third party advertising tools. However, we need your consent to do this. You can refuse these cookies here.

The cookies collected are processed by other processors:
(a) Google Analytics and Google Ads, operated by Google Inc. The cookies collected are subsequently processed by Google Inc. in accordance with its Privacy Policy, available here;

Who else may have access to your personal data from us?

In order to provide you with the best possible service, we involve other parties in the processing of your personal data. As part of such outsourcing, we may process your personal data and we do not need your consent for such processing.

However, you do not have to worry about your personal data or privacy, as our suppliers become so-called data processors and can only handle your data in the context of the activities and services they provide to us. We will also still be the ones who decide what happens to your personal data.

Examples of such people to whom we pass your personal data are providers of IT, marketing or accounting services.
Specifically, these individuals are:
a) Cloudflare

Please be assured that we will not transfer your personal data to international organisations or to countries outside the European Union. This does not apply to data that you yourself instruct us to send to a service you choose, for example to an AI application you connect to your account whose provider is outside the European Union (see the next section).

What happens when you connect an AI application to Emailit?

You can connect AI applications such as ChatGPT, Claude, Cursor, Codex or Grok to your Emailit account through our MCP server. This is optional and always your decision: you add Emailit in the AI application yourself, then sign in to Emailit and approve the connection. If you don't connect any application, nothing in this section applies to you.

What you approve. When you connect an application, we show you its name, the access it asks for and the workspaces you belong to. "Send email" access lets the application send and manage emails. "Full" access also lets it manage the other data in a workspace. You choose which workspaces the application can use: all of them, including ones you create or join later, or only the ones you select. The application acts with your role in each workspace, so where you are a Member it cannot manage API keys or delete domains. If you ask it to create a new workspace, that workspace is added to the ones it can use. The connection never gives the application your Emailit password or your payment details.

What the application can access. Within the access and workspaces you approved, the application can read and change the same data you can see and change in the Emailit dashboard: your workspaces and your role in them; sending domains and their DNS settings; contacts, audiences and subscribers, including email addresses, names, custom fields and subscription status; the emails you send, including sender, recipients, subject, content, attachments, delivery status and events such as opens and clicks with the IP address and device details recorded with them; templates, campaigns, automations and signup forms; suppressions, email verification results and DMARC reports; and webhooks, the event history and API keys. If you ask the application to create an API key or a webhook, Emailit returns the new secret to the application once, so that it can give it to you.

Your contacts' data. Much of this data is personal data of your contacts and of the recipients of your emails. We process it on your behalf as your processor, under our data processing agreement, and connecting an application and asking it to act is your instruction to us. You are the controller of that data, so you decide whether sharing it with an AI application is lawful.

What we receive and store. We receive only the requests the application sends to Emailit on your behalf, and we send the results back only to that application. We do not request or receive your conversations with the AI application, its memory, your prompts or the files you share with it. For each connection we keep the application's name and identifier, the workspaces it can use, the workspace it starts in, the access you approved, when you approved it and when it was disconnected. We store the access credentials we issue to the application only in a form that cannot be reversed. An access credential is valid for 15 minutes and is renewed automatically while the application is in use; a connection that is not used for 60 days expires. For each request we log the time, the application, the action it asked for, the result and technical details such as the IP address and user agent of the request, and, as with requests made with an API key, our operational logs may contain the data involved, such as a contact's email address. We use these logs only to provide, secure and troubleshoot the service and delete them automatically once they are no longer needed for that. We use the data that passes through the connection only to carry out the application's requests and for the purposes in this section: we do not sell it, use it for advertising or use it to train artificial intelligence models.

The AI provider. Once the application receives data from Emailit, its provider processes it under its own terms and privacy policy, as a separate controller: for ChatGPT and Codex, OpenAI (https://openai.com/policies/privacy-policy/); for Claude, Anthropic (https://www.anthropic.com/legal/privacy); for Cursor, Anysphere (https://cursor.com/privacy); for Grok, xAI (https://x.ai/legal/privacy-policy). The provider is not our processor, and we do not control how it uses, stores or transfers that data. Some providers process data outside the European Union, including in the United States. Please read the provider's privacy policy before you connect its application, and connect only applications with which you are allowed to share the data in your workspaces.

Your control. In the Emailit dashboard under Account > Connected apps you can see every application you connected and the workspaces it can use, change those workspaces and disconnect it. Changes and disconnections take effect immediately. If you leave a workspace or are removed from it, your connected applications lose access to it as well. Removing Emailit inside the AI application may not disconnect it from your account, so to be sure, disconnect it under Account > Connected apps. Disconnecting stops the application's access but doesn't delete anything in your workspaces, and data the application already received stays with its provider. Your rights described in "What are your rights as a data subject?" apply to the data in this section too.

Legal basis and retention. We process connected application data to perform our contract with you, by providing the integration you asked for, and on the basis of our legitimate interest in keeping your account and our service secure. We keep the records of your connections for as long as your account exists and afterwards as described in "How long do we process personal data?", so that we can show you which applications had access to your account and when.

Questions and security. If you have questions about connected applications or want to report a security problem with them, write to support@emailit.com.

Will personal data be processed by automated individual decision-making?

We will not process your personal data by automated individual decision-making. This means that your rights and obligations (such as whether we enter into a contract with you and provide you with our services) will not be decided automatically by any software that processes your personal data.

3. FINAL INFORMATION

What are your rights as a data subject?

As a data controller, it is also our responsibility to ensure that the processing of your personal data is carried out properly and securely. We then guarantee you the rights described in this article. You can exercise these rights with us in writing, by email or by telephone at the contacts listed above.

These rights are:
(a) to request information from us about what personal data we process about you;
b) to request access to the personal data we process about you;
c) have your personal data updated, completed or corrected;
d) under certain conditions, you may also request the erasure of your personal data or the restriction of its processing, provided that this does not conflict with applicable law or our legitimate interests;
e) if you suspect that your personal data is being unlawfully processed, you have the possibility to lodge a complaint with the Data Protection Authority;
(f) the right to data portability if the processing is automated by consent or for the performance of a contract;
g) to request a copy of the personal data processed by us.

In addition to the above rights, you also have the right to object if we process your personal data on the basis of our legitimate interest. This objection can be made by sending to our contact address or by e-mail. We will then evaluate the objection without delay, but at the latest within one month of receipt.
This Personal Data Processing Policy is valid as of 1 March 2022. It was last updated on 7 October 2026 to add the section on connected AI applications.