Privacy policy

OpenPromote (“we”, “us”) runs the website at openpromote.org and its tools, starting with EmailCurator. This policy explains what we collect when you use the website, and what we do with it.

Questions, or a request about your data: Email openpromote.2026@gmail.com or call +92 341 5887295.

• Your account: your name and email address. If you sign in with Google, Google gives us your name and email address; we never see your Google password. We don’t use passwords at all: we email you a sign-in code.
• What you write: the details you give for each email (what it’s about, who it’s for, the key facts, your signature), the emails written for you, your changes to them, and the fields you use, such as First name.
• Your contact lists: the email addresses, names and other details of the people you send to, and for personal emails, your notes about each of them. See Your contact lists.
• Your sending account: the email address and server settings you send from, and its password while a send runs. See Your email password.
• Payments: the package or no-footer pass, the amount, the date and how you paid. For JazzCash, EasyPaisa or bank transfer, also the details you enter: the account name, the wallet number or bank, the transaction ID, and a screenshot of the receipt if you add one. If you ask us about a payment, your message. For PayPal and card payments, PayPal or Payoneer handles your account or card and tells us only whether the payment went through, with its reference.
• Free emails: while you edit a free email on the send emails page, the email and your list stay in your browser. They reach us only when you get to the last step and sign in, and are then kept like any other email and list. Free emails end with a line linking to our site and to a page where the people you write to can report the email; if someone reports one, we get what they write to us.
• Feedback: ratings and notes you choose to send us.
• Blog emails: if you sign up for new blog posts, your email address, your name if you give it, the page you signed up on, and when you confirmed. You don’t need an account for this.
• Technical details: the code that keeps you signed in; how many emails you write and send, and how much AI each one used, so we know what the service costs; visits and page speed, counted by Vercel without cookies; visits and purchases, counted by Meta’s pixel (see Cookies below); and server logs (such as IP address, browser and errors) kept for a short time to fix problems and stop abuse.

• to write, check and save your emails, and to send them when you ask;
• to take payments and add your credits;
• to send you account emails: sign-in codes, a welcome, and updates about your payments;
• to send you OpenPromote news, such as new features and offers, which you can stop with the unsubscribe link in each one;
• to email you new blog posts, if you signed up and confirmed your address, until you unsubscribe;
• to help you when you contact us;
• to keep the service safe, and to stop spam, fraud and abuse;
• to understand, in totals, how the service is used, so we can improve it.

We don’t sell your data, don’t show ads, and don’t use your contact lists to contact anyone. We note whether each OpenPromote news or blog email was opened and which of its links were clicked, to know what is useful to you; we don’t do this for account emails, or for the emails you send.

The details you give for an email are sent to Google’s Gemini AI, which writes the email. We use Google’s paid service, under terms that don’t let Google use your content to improve its products.

With the same email or personal fields, your contact list never goes to the AI. With personal fields, the AI sees only the names of the fields, such as First name. Each person’s details are filled in by our own servers, after the email is written.

A personal email for each person is different: to write each person’s email, the AI is given your brief and that person’s row of your list: their first name, their other details and your notes about them. A second Gemini model checks the sentences about them against your notes. Both are Google’s paid service, under the same terms. Their email address is not sent, and you’re asked to leave anything private, like health, religion or money troubles, out of your notes.

Links you add about a person, such as a professor’s profile or a paper, are opened by our servers, and a Gemini model notes what those public pages say about the person’s work, never their private life. Only those notes, with the few words from the page that back each one up, are kept with your list, and deleted with it. Social media pages, and pages that need a login, are never opened, and every website’s robots.txt is followed. The pages themselves are kept for up to 14 days, by their address only, never with who asked for them, so the same page isn’t fetched twice.

If you fill your key facts from your CV or website, it’s read once by a Gemini model to suggest facts about you, such as your degree and projects, for you to choose from. Private details like your date of birth, ID number, address, phone, religion or marital status are left out. Your CV file is never kept: only the facts you choose, in your key facts.

While you prepare a send, your list stays in your own browser. When you press send, it goes to our servers, so that your email can keep going out after you close the page.

90 days after a send finishes, everything about the people in it is deleted: their addresses, names, details, each person’s copy of the email, and its attachments. The totals, such as how many were sent, stay in your history.

For a personal email for each person, the list is kept on our servers from the start, so the emails can be written in the background. 90 days after the job last changed or was sent, its people are deleted: their addresses, names, details, your notes and the emails written for them.

For these lists, we act for you: you decide who is on them and what they are sent. We use them only to send your email and to show you who got it. You must have the right to email the people on your lists: see the Terms of service.

Your emails go out from your own email account, so sending needs its password. We use it only to send. While a send runs, it is kept encrypted, and it is deleted as soon as the send finishes or is stopped. It is never saved in your browser.

For Gmail, use an app password rather than your main password: you can remove it in your Google account at any time.

We use a few trusted services to run OpenPromote. Each gets only what it needs to do its job:

• Vercel hosts the website and counts visits and page speed.
• Meta (Facebook) counts visits and purchases with its pixel, so we can measure our Facebook and Instagram posts and ads. It learns which pages you visit and, when you buy, the package and price, never your emails or lists.
• Neon holds our database.
• Inngest runs sends in the background. It is told which send to run, not who is in it.
• Google runs the Gemini AI, and Google sign-in if you use it.
• PayPal and Payoneer take payments in dollars, under their own privacy policies.
• An email delivery service sends our own emails to you, such as sign-in codes.
• Your own email provider (Gmail, Outlook, Yahoo Mail or another) delivers the emails you send, under its own privacy policy.

We also share data if the law requires it, or to protect people’s safety or our rights. If OpenPromote is ever sold or merged, your data would move to the new owner under this policy, and we would tell you first.

Some of these services store data outside Pakistan, for example in the United States or Europe.

• Your account and the emails you wrote: while your account is open.
• The people in a send: 90 days after the send finishes.
• The people in a personal email job, with your notes, their links, what was found on their pages and their emails: 90 days after the job last changed or was sent.
• Public web pages read for personal emails: 14 days, by their address only.
• Your email password: until the send finishes or is stopped.
• Sign-in: 30 days, or until you sign out.
• Blog subscriptions: until you unsubscribe. After that we keep only your address, marked as unsubscribed, so we never email it by mistake; ask us and we delete it.
• Server logs: a short time, as our hosting service keeps them.
• Payment records: as long as the law requires us to keep accounts, even after an account is deleted. A receipt screenshot you add is deleted 90 days after the payment is approved or rejected.

We use the cookies the website needs to work:

• Sign-in: keeps you signed in, for 30 days.
• Google sign-in: for 10 minutes while you sign in with Google, to keep that sign-in safe.

And one for advertising: Meta’s pixel sets a cookie (_fbp, for 90 days) so Meta can count visits and purchases from our Facebook and Instagram posts and ads, and show our ads to people likely to be interested. You can block it with your browser’s settings or an ad blocker, and control how Meta uses it in your Facebook ad settings; the site works the same without it.

Your browser also keeps some things on your device, so your work isn’t lost: the email you’re writing, the list and files you’re preparing to send, your sending account’s settings (never its password), and which questions you’ve already answered. They stay on your device, and clearing your browser’s site data removes them.

You can ask us to:

• show you the data we hold about you, or send you a copy;
• correct anything that’s wrong;
• delete your account and your data.

Write to us from your account’s email address, so we know it’s you. We do it within 30 days. Payment records the law requires us to keep are kept, and nothing else.

If someone on a customer’s list asks us about their details, we pass the request to that customer, who decides who they email.

Everything travels over encrypted connections. Email passwords are encrypted while a send runs. Sign-in uses one-time codes, so there is no OpenPromote password to steal, and only a few people at OpenPromote can see customer data, and only to run the service.

No system is perfectly safe. If something ever goes wrong that affects your data, we’ll tell you quickly and say what we’re doing about it.

OpenPromote is for people aged 18 and over. We don’t knowingly collect data from anyone younger.

If we change this policy, we change the date at the top of this page. If a change matters to you, such as a new use of your data, we email you before it applies.