Privacy Policy

Effective 2026-11-02

Tooly Mail Relay ("the relay") is operated by itpro360 LLC on a server it runs in the United States. It forwards outgoing email for itpro360's own apps, and offers this console to itpro360 administrators. This policy explains what it handles and why.

Email passing through the relay

• Message content (headers, body, attachments) is stored on the server only until it is delivered, then deleted. Messages that can't be delivered are kept for up to 3 days while being retried, and failed messages for 7 more days so an administrator can review or resend them.
• Message log: for each message we record the time, sending app, sender and recipient addresses, size, delivery route, status and the provider's response. We keep it for 30 days to troubleshoot delivery. We never log subjects or message content.
• Delivery providers: messages are delivered through SMTP2GO or Amazon Web Services (Amazon SES); either may deliver a given message, and if one fails the other may be tried. They process the messages as our service providers under their own terms and privacy policies.

Console users

• Tooly SSO: you sign in with Tooly SSO (operated by itpro360 LLC). The relay receives your account ID (sub), email address, name, profile photo and groups. Your Tooly password and authenticator codes are never seen by the relay. See the Tooly SSO Privacy Policy.
• Break-glass account: one local emergency account stores a hashed password, an authenticator secret and hashed recovery codes.
• Account record: your Tooly details from your latest sign-in, your theme choice, when you accepted these terms, and sign-in history (time, IP address, device) for 30 days.

Security log and analytics

• Activity log: sign-ins, sign-outs, failed or denied attempts, administrator actions, settings changes, rejected SMTP logins and errors, with time, account, IP address and device (browser and system). Kept for 12 months for security.
• Analytics: first-party page counts, pages, referring sites (domain only), browser, system, device type and country (from Cloudflare). Visitors are counted with a salted, daily-changing hash of the IP address; the IP itself isn't stored for analytics. Kept about 120 days. No third-party analytics.
• Backups: daily copies of the relay's settings and logs are kept for 14 days.

Cookies and browser storage

One strictly necessary session cookie keeps you signed in. Your theme choice is saved in your browser's local storage. There are no tracking cookies, so there's no cookie banner.

Who can see it

itpro360 administrators of the relay; Cloudflare, which carries traffic to this site; SMTP2GO and Amazon Web Services for delivery; and authorities where the law requires it.

Your rights

You can download your data and delete your account in this app from your account page. To ask about email we sent through the relay, or to correct or delete other data, contact [email protected].

Other details

The console is for people 16 and over. We protect data with access limited to itpro360's network and administrators, mandatory two-step sign-in, encrypted connections to delivery providers and to this site, and short retention, but no system is perfectly secure. We'll update this page and its effective date when practices change.

Contact: [email protected].