Privacy policy
This policy explains how Nostello OÜ (“Nostello”, “we”), Ahtri Street 12, 15551 Tallinn, Estonia, handles personal data for SaveMailPDF. We are an EU company and apply the GDPR. Privacy officer: Sheldon Halgreen, privacy@noscotek.co.za.
1. Email content
When you save a PDF, the add-in reads the emails you selected inside Outlook, builds a clean copy, and asks your OneDrive (via Microsoft Graph) to convert it to PDF. A temporary file is created in your OneDrive app folder (Apps/SaveMailPDF) and permanently deleted straight after conversion. The finished PDF is saved in the folder you choose. Email bodies, attachments, subjects, names and addresses are never sent to our servers. Remote images in emails are removed and never fetched.
2. What we process
| Data | Why | Basis | Kept |
|---|---|---|---|
| Microsoft account object ID, organisation (tenant) ID and sign-in email, verified with Microsoft Graph when you save | Identify your licence, apply the free limit, Team seats and invited seats | Contract (Art. 6(1)(b)) | While you use the service, then 12 months |
| Monthly count of PDFs saved | Free-tier limit (10 per month) | Contract | 13 months |
| Billing: name, email, address, VAT number, payment status (processed by Stripe) | Subscriptions and invoices | Contract and legal obligation (Art. 6(1)(c)) | As Estonian accounting law requires (7 years) |
| Usage and error telemetry: event type (for example “PDF export”, “checkout completed”, “free limit reached”), counts of emails, pages and attachments, file size, duration, app version, and one-way hashed account and organisation identifiers; scrubbed technical error messages | Keep the service reliable and understand usage | Legitimate interest (Art. 6(1)(f)) | 13 months, then deleted automatically |
| Website visit statistics (Cloudflare Web Analytics, public pages only, no cookies) | Count visits in aggregate | Legitimate interest | Aggregated |
Telemetry never includes email content, subjects, file names, email addresses or IP addresses. The add-in pane itself has no analytics.
3. Permissions we ask Microsoft for
User.Read (your profile, to identify your licence) and Files.ReadWrite (to convert and save PDFs in your OneDrive). We do not request mailbox-wide access; the add-in reads only the emails you select in Outlook.
4. Sub-processors
Cloudflare (hosting, licence database, telemetry, website analytics) and Stripe (payments). See sub-processors. Some processing may happen outside the EEA under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest, by emailing privacy@noscotek.co.za. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.
6. Security
Encrypted connections everywhere, least-privilege Microsoft permissions, signed Stripe webhooks, no storage of email content, and access to admin tools restricted by Cloudflare Access.
7. Changes
We will post changes here and tell paying customers by email about material changes.