Duso MailLog in

Privacy Policy

Effective September 13, 2026

Duso Mail ("Duso Mail," "we," "us," or "our") is an email marketing platform operated by Duso Digital. This Privacy Policy explains what information we collect through Duso Mail, how we use it, and the choices available to you. It applies to Duso Digital staff and to client users who are given accounts on the platform.

1. Information we collect

  • Account information: name, email address, and a hashed password for staff and client users we create accounts for.
  • Client campaign data:contact lists, email content, sender addresses, and campaign/flow configuration that a client or our staff enters into the platform in order to send email on that client's behalf.
  • Delivery and engagement data: send, delivery, bounce, complaint, open, click, and unsubscribe events for emails sent through the platform, received from our sending providers (Amazon SES) or generated by recipient interactions with sent emails.
  • Connected sender information: if a client chooses to connect their own Gmail account as a sending address, we store an OAuth authorization token and the associated email address so we can send on their behalf. See Section 3 below for how Google user data is handled.
  • Technical data: IP address and basic request metadata used for security purposes, such as rate-limiting login attempts.

2. How we use information

We use the information described above to:

  • Provide, operate, and maintain the Duso Mail platform;
  • Send email campaigns and automated flows on behalf of our clients, using the sender and contact data they provide;
  • Authenticate users and protect accounts from unauthorized access;
  • Generate delivery and engagement reports for our clients and internal team;
  • Comply with legal obligations, such as processing unsubscribe requests and email suppression lists.

We do not sell personal information, and we do not use client contact lists or campaign content for any purpose other than operating the platform on behalf of the client that owns that data.

3. Use of Google user data

Duso Mail lets a client optionally connect their own Gmail account as a sending address. To do this, we request Google OAuth authorization for the gmail.send scope only, plus basic OpenID/email profile information to identify which Gmail address was connected. We do not request, and this scope does not permit, any ability to read, search, or otherwise access the contents of a connected Gmail inbox.

The OAuth token obtained is stored encrypted at rest and is used solely to send campaign and flow emails that the connecting client authored inside Duso Mail, through Google's Gmail API, on that client's behalf. The token is never shared with any third party, and a client can revoke access at any time from their Google Account settings or by disconnecting the sender inside Duso Mail, which deletes the stored token.

Duso Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sharing of information

We share information only with the service providers necessary to operate Duso Mail, including:

  • Amazon Web Services (SES and infrastructure hosting);
  • Google (Gmail API), only when a client has connected their own Gmail account as described above;
  • n8n, our workflow automation tool, used to trigger and orchestrate certain automated flow steps.

We do not share personal information with third parties for their own marketing purposes.

5. Data retention

We retain account, campaign, and engagement data for as long as an account remains active, and for a reasonable period afterward to comply with legal, tax, or record-keeping obligations. Recipients who unsubscribe are added to a suppression list and are not emailed again through the platform.

6. Your choices

Recipients of campaigns sent through Duso Mail can unsubscribe at any time using the link included in every email. Client users can request access to, correction of, or deletion of their account and associated data, and can disconnect a connected Gmail sender at any time, by contacting us using the details below.

7. Security

We use industry-standard safeguards to protect information, including encrypted credential storage, hashed passwords, rate limiting on login attempts, and transport encryption (HTTPS) for all traffic to the platform.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date at the top of this page.

9. Contact us

Questions about this Privacy Policy or your data can be sent to liam@dusodigital.com.