Privacy

Last updated 30 September 2026.

Who we are

mailnote is made by CloudCircus. Contact us at support@cctodo.com.

Notes belong to the organisation (company) they were written in. The organisation decides who is a member and what is written. For that content, the organisation is the data controller and we process it on its behalf.

What we store

• Your account: email address, name (if you add it), and a hashed password or the social login you used.
• Organisations: their name and email domains, who is a member with which role, and invites (the invited address and who sent it).
• Notes, customers and projects that members write, and a history of changes (who changed what, and when).
• Email details, only for emails someone attached a note to: the subject, the names and addresses of the sender and recipients, the date, and the technical Message-ID headers (which identify the email thread).

Profile pictures

Our server looks up your picture on Gravatar (using a hash of your email address), or from the account you log in with, keeps a copy and shows it to your colleagues from our own site. Their browsers never contact Gravatar. You can turn this off in Settings; then your initials are shown.

What we don't store

• Email bodies and attachments. The Outlook add-in never reads them.
• Anything about emails without notes. When you open an email, the add-in sends its subject, people and Message-IDs to find matching notes, and we don't keep them.

When the last note on a thread is deleted or unlinked, we delete that thread's email details too.

So that it can reopen an email a note was written on, the Outlook add-in remembers, on your own device only, which emails it was open on (their Message-ID and Outlook's id for your copy, for up to 180 days). This never leaves your device.

Who can see it

Only members of the organisation see its notes and email details. We don't sell data, show ads or send notes or email details to AI services. Suggestions of related notes are computed on our own server.

Emails we send

Invites, account emails (confirming your address, resetting your password) and a note to the inviter when an invite is accepted. Note content is never put in an email.

Logs

Our server keeps technical logs (such as IP addresses and requested pages) for 30 days, to run and secure the service.

Deleting data

Owners can delete their organisation, which deletes all of its notes, customers, projects and email details at once. To delete your account, email support@cctodo.com from your account's address.