Back to legal information

Privacy policy

Last updated: 17/12/2025

1. Information we collect

Tutaim collects only the information necessary to provide our email security analysis service:

• Email files (.eml) or screenshots you upload for analysis
• IP address for security verification
• Temporary session information for service operation

2. Purpose of processing and Service improvement

We use the collected information to:

• Analyze files and headers for threats (main functionality).
• Training and Improvement: Files, metadata and detected threat patterns may be processed to retrain our algorithms, improve Tutaim's detection rate and generate anonymized cybersecurity statistics.

3. Data transfer and Subprocessors (Google)

To provide the advanced analysis service, Tutaim acts as Data Controller and uses Google LLC as the main Subprocessor.

• By using our service, you explicitly agree that files (.eml, images) will be transferred to Google's servers for processing through their cloud Artificial Intelligence services.
• Third-Party Privacy Warning: The processing of this data by Google is governed by its own Terms of Service and Data Processing Addendum. Tutaim has no control over the internal use that Google may make of the data under its policies. You can consult Google's policy here: https://policies.google.com/privacy.

4. Data storage, retention and deletion

Security analysis results are accessible via the generated link for 24 hours only; after that period the link expires and the information is no longer accessible through the public interface.

Original uploaded files (.eml, screenshots or similar) are kept in a restricted environment and used exclusively to: (i) perform the requested analysis, (ii) carry out manual security reviews when necessary, and (iii) improve and assess the accuracy of our detection systems.

These files are deleted once they are no longer necessary for these purposes, in line with the data minimization and storage limitation principles under applicable data protection law. Only anonymized technical data and threat patterns that do not allow identifying the user or reconstructing the original message may be retained indefinitely.

5. Data security

We implement technical and organizational security measures to protect your information:

• Data encryption in transit and at rest
• Restricted access to personal data
• Secure deletion of processed data

6. Your rights

You have the right to:

• Access information we have about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw your consent at any time

7. Contact

8. Changes to this policy

We reserve the right to update this privacy policy. Significant changes will be notified through our website.