Email Sherlock Privacy Policy

Effective date: November 2, 2026

Email Sherlock is run by Work And Play LLC ("Email Sherlock," "we," "us"). This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices you have. It applies to our website (emailsherlock.ai), our email service at ask [at] emailsherlock [dot] ai, and any messages between you and Sherlock (together, the "Service").

1. Information we collect

What you send us. When you email or forward something to Sherlock, we receive the message, any attachments (such as photos of bills or letters), and the email "header" details that come with it (sender, recipients, date, subject). These often contain personal information about you and sometimes about other people, such as account details, amounts owed, addresses, insurance or medical billing information, and the names of companies you deal with.

Information you give us when you sign up. Your name, your email address, a second email address if you choose the Household plan, which plan you picked, and a record that you checked the consent box (including the date and time).

Payment information. If you choose to subscribe after your free week, you pay through Stripe, our payment processor. Stripe collects your card details directly. We never see or store your full card number. Stripe shares with us limited details such as your name, email, billing ZIP or country, the last four digits and type of your card, and whether a payment went through.

Information collected automatically. When you visit our website or submit the sign-up form, our hosting provider and we receive standard technical information, such as your IP address, browser type, and the pages you visit. We record your IP address with your sign-up as proof of consent and to prevent abuse. We do not use advertising cookies or third-party tracking pixels on our website.

Information from others. If, with your permission, Sherlock emails a company for you, that company's replies come to us, and we treat them the same way as messages you send us.

Mail from non-members. Sherlock only answers people who have signed up. If someone who isn't a member writes to a Sherlock address, we don't reply and we don't keep the message. We only keep a daily count of how many such messages arrived, with no names, addresses, or content.

2. How we use your information

We use your information only to:

• read and understand your messages, ask you follow-up questions, and reply with guidance;
• with your permission, write to companies on your behalf (see Section 4);
• run your free week, your subscription, and your billing, including the "keep Sherlock?" email near the end of your free week;
• verify requests to change the email address on your subscription (allowed once every 90 days);
• check the quality and accuracy of Sherlock's replies and fix problems;
• keep the Service safe, prevent fraud and abuse, and keep records of consent;
• send you important notices about your account or this policy; and
• meet legal, tax, and accounting obligations, and enforce our Terms.

We do not use what you send us to build advertising profiles, and we do not sell it.

3. AI processing and human review

Sherlock works by sending the content of your messages to third-party AI model providers that process it on our behalf to help write replies. We use these providers as service providers: they may use your content only to provide their service to us, and not for their own purposes. We do not use your messages to train AI models, and where a provider lets us choose, we turn off any use of your content for training. Some providers keep content for a short time (often up to 30 days) under their own terms to detect abuse, then delete it.

People may read your messages. Members of the Email Sherlock team may read your messages and Sherlock's replies to answer you, handle unusual requests, investigate problems, and check quality. Everyone who does so is required to keep your information confidential.

4. Emailing companies on your behalf

Sometimes Sherlock may offer to email a company for you, for example to dispute a charge. We only do this after you clearly say yes, for that specific message. We usually copy (CC) you on the email so you can see exactly what was sent, and the company may reply to us and to you. When we write to a company, we share only what is needed for that request, such as your name, your account or reference number, and the details of the issue. Once a company receives our email, it handles that information under its own privacy policy, which we don't control. You can tell us to stop contacting a company at any time.

5. How long we keep information

• Your messages and attachments: deleted within 30 days. We delete the content of the messages you send us, the attachments, the replies we receive from companies, and Sherlock's replies within 30 days of when we receive or send them. This includes the copies we share with AI providers, which are deleted under their own retention limits described above.
• Backups and logs. Some copies may remain for a short extra time in backup or system logs kept by us or our service providers. These copies are not used for anything else and are overwritten or deleted on a regular schedule, generally within 30 more days.
• Account and billing records: kept longer. We keep your name, email address(es), plan, sign-up date, consent record, email-change history, and payment records (from Stripe) for as long as you have an account and afterward as long as needed for tax, accounting, and legal purposes, and to resolve disputes. This is generally up to 7 years after your last payment.
• Copies outside our control. Copies of messages stay in your own email account, and any email we send to a company on your behalf stays in that company's systems. We can't delete those.
• Short summary to help you. To keep helping you after 30 days, we may keep a short note about an ongoing issue (for example, "Waiting on refund from Example Internet Co.") only if you ask us to, and we delete it when the issue is closed or you ask.

If you need us to delete something sooner, email us (see Section 11).

6. How we share information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising. We share it only:

• With service providers who help us run the Service and who must protect it and use it only for us. These include our web host and email routing provider (Cloudflare), AI model providers, our payment processor (Stripe), and an email sending provider that delivers Sherlock's replies.
• With companies you ask us to contact, as described in Section 4.
• For legal reasons, if we believe in good faith that we must comply with a law, subpoena, court order, or other legal process, or to protect the rights, property, or safety of you, us, or others, including to stop fraud.
• In a business transfer. If Email Sherlock is involved in a merger, sale, financing, or transfer of some or all of its business, your information may be transferred as part of that deal. The new owner must honor this policy for information it receives, or tell you and give you a choice before using it differently.
• With your consent, in any other case.

7. Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including encrypted connections (HTTPS) for our website, limits on who can access messages, and reputable providers. No system is perfectly secure, so we can't guarantee absolute security. If we learn of a security breach affecting your personal information, we'll notify you as required by law.

8. Please protect your sensitive information

Sherlock rarely needs your most sensitive details. Before you send a document, please black out or cover:

• full Social Security numbers (the last 4 digits are fine if needed);
• full credit card, debit card, and bank account numbers;
• PINs and security codes; and
• any passwords.

Never send us a password. Sherlock will never ask for one. If you send sensitive information anyway, we'll still protect it and delete it on the schedule above, but please don't send it.

9. Children

The Service is for adults 18 and older. We don't knowingly collect information from anyone under 18. If you believe a child has sent us information, contact us and we'll delete it.

10. Your privacy rights

Everyone. Wherever you live, you can ask us to tell you what personal information we have about you, give you a copy, correct it, or delete it. You can also cancel your subscription at any time.

California residents. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), you have the right to:

• Know what personal information we collect, use, and disclose, and to receive a copy of it;
• Delete personal information we collected from you, subject to legal exceptions (for example, records we must keep for taxes);
• Correct inaccurate personal information;
• Opt out of the "sale" or "sharing" of your personal information. We don't sell or share personal information, including of anyone under 16, so there is nothing to opt out of;
• Limit the use of sensitive personal information. We use sensitive information (such as financial account or health billing details you choose to send) only to provide the Service you asked for, as the law permits, so this right doesn't change how we handle it; and
• Not be discriminated against for using any of these rights.

In the past 12 months we have collected these categories of personal information: identifiers (name, email address, IP address); customer records and commercial information (plan, payments, and anything in the bills and letters you send); internet activity (basic website logs); and sensitive personal information you choose to send (such as account numbers, insurance, or medical billing details). We collect them from you, from Stripe, and from companies you ask us to contact, for the purposes in Section 2, and disclose them only to the recipients in Section 6. We keep them for the periods in Section 5.

California's "Shine the Light" law lets California residents ask about sharing with third parties for their own direct marketing. We don't do that.

Other states. Residents of other states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others) may have similar rights to access, correct, delete, and get a copy of their data, and to opt out of targeted advertising, sale, and profiling. We don't do targeted advertising, sell data, or use profiling that makes legal or similarly significant decisions about you. If we deny your request, you may appeal by replying to our decision; we'll respond within the time the law requires, and if you're still not satisfied you can contact your state attorney general.

Do Not Track and Global Privacy Control. Our website doesn't track you across other sites. We treat a Global Privacy Control signal as a request to opt out of sale or sharing, which we don't do anyway. Because there's no common standard for "Do Not Track" browser signals, we don't respond to them differently.

11. How to use your rights

Email len [at] emailsherlock [dot] ai with the subject "Privacy request," or write to us at the address below. Tell us what you'd like us to do. To protect you, we'll confirm your request comes from the email address on your account, and we may ask for more details if needed. You can use an authorized agent; we may ask for proof that you gave them permission. We'll respond within 45 days (we may extend once by 45 more days if needed and will tell you why). We don't charge for requests.

12. Where we process information

We're based in the United States, and our service providers process information in the United States and possibly other countries. By using the Service, you understand that your information will be processed in the United States.

13. Changes to this policy

We may update this policy. If we make a significant change, we'll email you and update the effective date before the change takes effect. We won't use information we already have in a significantly different way without your consent.

14. Contact us

Work And Play LLC (Email Sherlock)
20510 Dumont St, Woodland Hills, CA 91364
Email: len [at] emailsherlock [dot] ai