Privacy policy
This policy explains how Nostello OÜ (“Nostello”, “we”), Ahtri Street 12, 15551 Tallinn, Estonia, handles personal data for MailToSheet. We are an EU company and apply the GDPR. Privacy officer: Sheldon Halgreen, privacy@noscotek.co.za.
1. Email content
When you export, the add-in reads the emails you selected inside Outlook, one at a time: the details you chose as columns (for example date, sender, recipients, subject, attachment names, categories) and, only if you add the body preview column or a field-extraction rule, the body text. The spreadsheet is created in memory on your device and saved by your browser or Outlook app, or uploaded directly from Outlook to your OneDrive or SharePoint through Microsoft Graph. Email bodies, subjects, names, addresses and attachment names are never sent to our servers.
2. What we process
| Data | Why | Basis | Kept |
|---|---|---|---|
| Microsoft account object ID, organisation (tenant) ID and sign-in email, verified with Microsoft Graph | Identify your licence, apply the free limit, Team seats and invited seats | Contract (Art. 6(1)(b)) | While you use the service, then 12 months |
| Monthly count of rows exported | Free-tier limit (50 per month) | Contract | 13 months |
| Billing: name, email, address, VAT number, payment status (processed by Stripe) | Subscriptions and invoices | Contract and legal obligation (Art. 6(1)(c)) | As Estonian accounting law requires (7 years) |
| Usage and error telemetry: event type (for example “scan”, “Excel exported”, “CSV exported”, “OneDrive saved”, “checkout”, “free limit reached”), counts of emails and rows, file size, duration, app version, and one-way hashed account and organisation identifiers; scrubbed technical error messages | Keep the service reliable and understand usage | Legitimate interest (Art. 6(1)(f)) | 13 months, then deleted automatically |
| Website visit statistics (Cloudflare Web Analytics, public pages only, no cookies) | Count visits in aggregate | Legitimate interest | Aggregated |
Telemetry never includes email content, subjects, email addresses, file names or IP addresses. The add-in pane itself has no analytics. Your preferences (columns, format, extraction rules, last folder) are stored in your own Outlook settings.
3. Permissions we ask Microsoft for
User.Read (your profile, to identify your licence) and Files.ReadWrite (to save into the OneDrive folder you choose). Only if you turn on the Read or Folder column, Microsoft asks you to allow Mail.ReadBasic, which covers message properties such as read status and folder but not bodies or attachments; the add-in uses it only for the emails you selected. We never request Mail.Read. Inside Outlook, the add-in reads only the emails you select.
4. Sub-processors
Cloudflare (hosting, licence database, telemetry, website analytics) and Stripe (payments). See sub-processors. Some processing may happen outside the EEA under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest, by emailing privacy@noscotek.co.za. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.
6. Security
Encrypted connections everywhere, least-privilege Microsoft permissions, signed Stripe webhooks, no storage of email content, and access to admin tools restricted by Cloudflare Access.
7. Changes
We will post changes here and tell paying customers by email about material changes.