1. What Data We Collect

When you upload a .eml file, we process the raw email content including headers, body text, URLs, attachments, and embedded images. We collect your account email address, login timestamps, and usage logs (which analyses you ran and when). We do not collect payment information.

2. Why We Collect It

Email content is processed solely for phishing and threat detection analysis. Usage logs are maintained for legal compliance under the Bharatiya Sakshya Adhiniyam (BSA) 2023 and to improve detection accuracy using anonymized, aggregated data. You may opt out of model improvement data use by contacting us.

3. PII Handling — DPDP Act 2023

All personally identifiable information (PII) detected in your email — including Aadhaar numbers, PAN numbers, phone numbers, email addresses, dates of birth, bank account numbers, IFSC codes, and card numbers — is automatically redacted before the report is stored. The original unredacted content is never stored on our servers. This is performed in compliance with the Digital Personal Data Protection (DPDP) Act 2023, Article 4 (Data Minimisation).

4. Blockchain Anchoring

The SHA-256 hash of your forensic report is anchored permanently on the Ethereum Sepolia public blockchain. This creates a tamper-proof, immutable record. The full report is stored off-chain on IPFS via Pinata. You acknowledge that blockchain records cannot be deleted once anchored. This anchoring satisfies the requirements of the Bharatiya Sakshya Adhiniyam (BSA) 2023 — Section 63 and Indian Evidence Act 1872 — Section 65B for electronic records.

5. Who Can See Your Report

• Individual users: Only you can see your reports.
• Organization accounts: All members of your organization can view all analyses submitted under your org account.
• Cyber Professional accounts: Approved cyber professionals have access to extended forensic data. All their queries are logged in our audit trail without exception.

6. Data Retention

Analysis reports are retained for 90 days from the date of analysis, after which they are automatically deleted from our database. Audit logs are retained for 1 year as required by applicable law. Blockchain hash anchors are permanent and cannot be removed. You may request early deletion of your reports by contacting us — note that the blockchain hash anchor will remain even after report deletion.

7. Prohibited Use

You must not use EmailGuard AI to test phishing infrastructure you operate, to analyze emails of individuals without their consent, or to attempt to extract information about other users' analyses. Violation of these terms will result in immediate account suspension and may be reported to law enforcement.

8. Cyber Professional Access

Cyber Professional accounts are granted manually after identity verification. Approved cyber professionals agree that all queries are permanently logged, that access may be revoked at any time without notice, and that they will not use the platform to test their own phishing infrastructure or any infrastructure involved in active attacks.

9. Disclaimer

EmailGuard AI is a threat detection tool and does not guarantee detection of all phishing attempts. Results are advisory in nature. We are not liable for any damages resulting from reliance on analysis results. The system achieves 93% accuracy on our test dataset; real-world performance may vary.

10. Contact

For data deletion requests, access inquiries, or Cyber Professional applications, contact us at emailguard.sih2026@gmail.com. We will respond within 7 business days.