Where does the data come from?
The information you provide when creating an account, editing your profile, publishing products or requests, posting content and sending messages is collected for those actions. Information added by authorized team members in your organization may also be associated with your account or organization.
Only information permitted by the relevant connection is obtained from the email and calendar services you connect. Session, device, connection and transaction-security records may also be generated when you use the website and application.
Data processed
Account and organisation information, profile content, product and request records, messaging and email operations data, security records and service usage events may be processed.
This includes your name and contact details, your role in the organization, company or institution information, images and files you upload, content you publish and records of the actions you request. If you apply for verification, the organizational and authorization documents you submit are also processed to review the application.
Processing purposes
Data is used to manage accounts and organisation permissions, support company and product discovery, operate communication workflows, protect security, prevent abuse and provide the requested trade tools.
Public content and access limits
Public company and institution profiles, products, requests and posts can be seen by other visitors. Keep this visibility in mind for contact details you publish on your profile and personal information in documents; do not add private information to public areas.
Access to and export of some business contact information in the directory depend on the relevant product’s permission or credit rules. Private messages, verification documents and connected-account data are not part of the same public profile scope; access is limited by the relevant action and permissions.
Usage statistics within the platform
View or click counts for products, posts and promotions, together with activity statistics in the account center, are generated from events recorded within the platform. These records are used to show the performance of content and the business tools being used.
Optional product, post, profile and promotion measurements depend on your Analytics preference in the cookie panel. This preference does not turn off operational records needed for secure sessions, actions you request, promotion delivery or account activity. Measurements can be linked to signed-in accounts, so not all usage records are anonymous.
Optional site analytics
With your permission, we use visitor, page, location and device statistics about site usage to improve our services. You can change your preference at any time.
Optional site analytics is carried out through Vercel Web Analytics and Google Analytics. Visitor counts are not registered-member counts; country, region and city information represents approximate location statistics. These reports may not cover all traffic because some visits do not consent to or block measurement.
You can find more information about the analytics services and cookies we use in our Cookie Policy.
Connected email accounts
Connecting your Google or Microsoft account is optional. Your account identity, email address and the permissions needed to send email are used to send messages from your selected account and match replies to the relevant campaign or CRM record.
Reply tracking processes metadata such as the sender, recipient, subject, date and message identifiers. The Gmail connection uses gmail.send and gmail.metadata; the Microsoft connection uses Mail.Send and Mail.ReadBasic.
Viewing message content and attachments in the CRM requires separate consent. This requests gmail.readonly for Gmail and Mail.Read for Microsoft. Content is retrieved from the provider when you open the relevant email record.
Connected accounts and team access
Email and calendar data are not published on your public company profile. If a shared inbox is used, team members in the same organization who are authorized by the account owner can access it within the read or reply permissions granted to them.
Calendar connections
Calendar connections require separate consent. Google permissions are requested to list calendars you own and manage events in the selected calendar; Microsoft permissions are requested to read calendars and manage events.
Hosting, files and email delivery
4EIN’s web interface is hosted on Vercel, while its server and database infrastructure is hosted on Render. Technical connection and transaction records may be generated on this infrastructure when pages are served, requests are processed and security is maintained. This processing is separate from permission for optional visitor analytics.
Depending on the active service configuration, uploaded files may be stored in object-storage services such as Cloudflare R2; Amazon SES may be used to deliver system or campaign emails. When you connect your own sender account, the relevant Google, Microsoft or SMTP provider also participates in sending.
Video calls and AI tools
If the video-call service is enabled, Daily processes the call connection, participant information and audio or video shared during the call. When live translation is separately enabled and approved, data is sent to the relevant providers for speech transcription and translation.
Service providers such as OpenAI may be used for AI features. Depending on the feature you use, search text, draft content, text to translate or selected company and contact information for email personalization may be sent to the provider. Do not enter private or sensitive information that is unnecessary for the relevant action in these fields.
If automated content-safety checks are enabled, profile, post and comment text may be sent to an AI provider to screen for inappropriate content. This check does not depend on you opening a separate AI tool.
Maps and externally sourced content
When you open the map view or a profile map, map content may be retrieved from OpenStreetMap services; the displayed location and technical connection information may reach the provider in the process. When address positioning on a map is used, the entered address information is sent to Nominatim to find its coordinates.
External links and images added by users may send requests to their own sources. The email editor preview and generated email content may use Google Fonts. When this content is viewed, the browser or email application may connect to the relevant provider; these connections are separate from optional site analytics.
Other optional services
If business contact discovery is enabled, information such as the company domain, search query and relevant country may be sent to Hunter or DataForSEO. Business contact information obtained from these services is used to prepare the company or email discovery results you request.
When mobile notifications are enabled and device permission is given, the device’s push token, generic notification text and in-app destination are sent to Expo. If live freight queries are enabled, the selected port, route and container information may be sent to SeaRates for a price estimate.
Who can access the data?
Data may be accessed, within the relevant function, by authorized organization members, officials carrying out review or security duties, and the infrastructure, storage, communication, analytics or AI providers being used. Lawful requests from competent authorities are also assessed separately.
Depending on the provider’s location and the infrastructure used to deliver the service, data may be processed abroad. Allowing a connection or feature does not mean that you allow unlimited use of data for other purposes.
Retention and security
Records are retained according to functional needs, the account lifecycle and security obligations. Access controls are applied in the organisation and user context.
Closing an account, deleting organization data and disconnecting a provider’s access are different actions. Any one of these does not automatically delete all other records. Transaction history, security records or information needed to protect a right are assessed separately according to the relevant purpose and legal requirements.
The validity period of a cookie preference is not the retention period for all platform records or providers. Protect your password, session information and connected-account permissions; contact us if you suspect unauthorized access to your account.
Access permissions and disconnecting
Access and refresh tokens obtained for the connection are stored encrypted. Removing a sender account clears its connection tokens from 4EIN; it does not automatically delete existing campaign and CRM history.
Disconnecting in 4EIN and revoking the app's permission in your Google or Microsoft account are separate actions. To also end access on the provider's side, manage the app permissions in the relevant account.
Use of Google API data
The use and transfer of information received from Google APIs are subject to the Limited Use requirements of the Google API Services User Data Policy.
Google API Services User Data PolicyService providers’ privacy information
The following links give access to each provider’s own descriptions of data processing. A provider’s inclusion in the list does not mean that all of its features are enabled for your account.
Preferences and requests
Profile visibility, contact preferences and account actions can be managed in the relevant settings screens. You can send requests for information, correction or deletion of your personal data to info@4ein.com; you do not need to create a new account to do so.
Specify your request, the relevant account or record, and an address where you can be reached. Identity or authority verification appropriate to the request may be needed to prevent access to someone else’s information. Do not send a password, access token or unnecessary identity document in your first message.