Last updated: August 24, 2026

Privacy Policy

This Privacy Policy describes how Mhenbulk ("Mhenbulk," "we," "us," or "our") collects, uses, stores, and protects information when you use the Mhenbulk web application at https://mhenbulk.vercel.app and related services (the "Service").

Mhenbulk is an outreach platform that helps authenticated users manage contacts, organize email campaigns, send messages through connected Gmail accounts, and use tools such as Email Finder and Email Cleaner. This policy reflects how Mhenbulk actually works based on its current implementation.

1. Information you provide

When you use Mhenbulk, you may provide:

Account information — email address, password, and name when you create an account or update your profile.
Contact and list data — names, email addresses, companies, phone numbers, tags, notes, and related fields you upload, paste, import, or create in Contacts.
Campaign information — campaign names, email subject lines, message content (HTML and plain text), scheduling settings, follow-up steps, and enrollment choices.
Website URLs — URLs you submit to Email Finder or bulk website scanning features so Mhenbulk can scan publicly accessible pages for contact information.
Email lists for cleaning — addresses you paste, upload as CSV, import from Contacts, or send from Email Finder results to Email Cleaner.
Settings and preferences — workspace settings such as default batch sizes and connected sender configuration.

2. Account information

Mhenbulk accounts are authenticated through Supabase Auth. When you register or sign in, we store your account email and authentication credentials managed by Supabase. A profile record (such as your name and company name) may be created in our database when you sign up.

Each workspace is private to the account owner. Row-level security in our database restricts access to your data to your authenticated user account.

3. Contact and email data you upload

Contacts you add or import are stored in Mhenbulk so you can organize lists, run campaigns, create Smart Batches, and track outreach status. This may include fields such as email address, name, company, source information, subscription or suppression flags, and notes you enter.

You are responsible for ensuring you have a lawful basis to store and use contact information you upload to Mhenbulk.

4. Campaign information

Campaign content you create — including subject lines, message bodies, step sequences, and recipient enrollment — is stored in Mhenbulk so you can prepare, schedule, send, and review outreach. Send and delivery status for individual recipients (for example queued, sent, failed, replied, or unsubscribed) is also stored to operate campaigns and follow-ups.

5. Email content you create

Mhenbulk stores the email content you compose for campaigns. When you send through a connected Gmail account, that content is transmitted to Google's Gmail API for delivery. Mhenbulk does not read your Gmail inbox or download received mail from Gmail.

6. Connected Gmail and Google account information

If you connect a Google account for sending, Mhenbulk requests OAuth authorization with the following scopes:

https://www.googleapis.com/auth/gmail.send — to send email on your behalf through the Gmail API
openid, email, and profile — to identify your Google account during connection

Mhenbulk does not request Gmail scopes to read, modify, or manage your mailbox contents (such as inbox read or full mailbox access).

7. OAuth authentication

Google sign-in for Gmail sending uses OAuth 2.0 with PKCE. During connection, temporary HTTP-only cookies may be set to protect the OAuth state and code verifier. These cookies are short-lived and cleared after the connection flow completes.

8. Google API data we receive

When you connect Gmail, Mhenbulk may receive and store:

Google account identifier (sub)
Google account email address
Display name and basic profile fields returned by Google userinfo
OAuth access and refresh tokens (encrypted — see below)
Granted OAuth scope list and token expiry metadata
Gmail message identifiers returned by the send API after a message is accepted for delivery (used for delivery tracking and threading follow-ups)

Mhenbulk does not use Google user data to serve advertisements, and does not sell Google user data.

9. How Gmail data is used

Google and Gmail data connected to Mhenbulk is used only to:

Identify which Gmail account is connected as a sender
Maintain and refresh OAuth tokens so sending can continue
Send campaign and test messages you explicitly initiate
Record send outcomes and message identifiers needed for campaign operations
Display connection status and troubleshoot sending errors

Mhenbulk does not use Gmail connection data for mailbox verification, inbox reading, or unrelated analytics.

10. How Gmail data is stored

Connected account metadata is stored in our Supabase database. OAuth access and refresh tokens are stored separately in an encrypted credentials table using AES-256-GCM encryption with a server-side encryption key. Credentials are not exposed to other authenticated users through the application interface.

11. Whether Gmail data is shared

Mhenbulk does not sell your Gmail or Google account data. Data is shared only as needed to operate the Service:

Google — when you authorize Gmail sending and when messages are transmitted through the Gmail API
Supabase — to host authentication and store application data
Vercel — to host and run the application and scheduled background jobs, if you use our deployed environment

We do not share Google user data with third parties for their independent marketing purposes.

12. Email sending functionality

When you send through Mhenbulk, your message content and recipient addresses are processed to deliver email through your connected Gmail account (or, in some development configurations, an optional Resend provider). Mhenbulk adds List-Unsubscribe headers where configured and supports a public unsubscribe page for recipients.

Mhenbulk does not guarantee deliverability, inbox placement, or that messages will not bounce.

13. Email Finder functionality

Email Finder scans publicly accessible website pages that you submit. It extracts email addresses visible in page HTML (for example in text, mailto links, or common obfuscation patterns). Scan history, discovered addresses, source URLs, and related metadata are stored in your workspace so you can review results and optionally add them to Contacts or Email Cleaner.

Email Finder does not access private mailboxes, guess hidden addresses, bypass authentication, or circumvent website access controls.

14. Email Cleaner functionality

Email Cleaner normalizes and validates email address formatting on the server (for example trimming, lowercasing, duplicate detection, and basic typo suggestions). It does not perform SMTP mailbox verification or claim that an address is deliverable merely because the format is valid.

Cleaning jobs and row-level results are stored in your workspace, including original input, cleaned output, status, and issue notes.

15. Cookies and session data

Mhenbulk uses cookies and similar technologies for:

Authentication sessions — Supabase Auth session cookies to keep you signed in
Gmail OAuth flow — short-lived cookies during Google account connection

We do not use third-party advertising cookies or third-party analytics trackers in the current application codebase.

16. Analytics and logging

Mhenbulk does not currently integrate third-party product analytics services (such as Google Analytics) in the application. Operational logs may be written on the server for debugging and reliability (for example queue processing, OAuth errors, or scan failures). These logs are intended for service operation and are not used for cross-site advertising.

Inside the app, campaign "Analytics" refers to send and queue statistics derived from your own campaign data, not third-party web tracking.

17. Data security

We use industry-standard measures appropriate to the Service, including encrypted HTTPS transport, database access controls, row-level security, and encrypted storage of OAuth tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

18. Data retention

We retain your account, contact, campaign, and tool data while your account remains active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Background job history and scan results may remain in your workspace until you delete them or delete your account, subject to our data deletion practices.

19. Data deletion

You can remove data in several ways:

Delete contacts, campaigns, batches, and tool results within the application
Disconnect a Gmail account from Settings → Email Accounts, which revokes tokens where possible and removes stored credentials from Mhenbulk
Request account deletion by contacting us (see Contact information below). Upon verified deletion, we will delete or anonymize personal data associated with your account, subject to lawful retention requirements

You can also revoke Mhenbulk's access to your Google account at any time through your Google Account permissions page: https://myaccount.google.com/permissions.

20. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. To exercise these rights, contact us using the information below. We may need to verify your identity before responding.

21. Third-party services we use

Based on the current Mhenbulk implementation, the Service relies on:

Supabase — authentication and database hosting
Google / Gmail API — OAuth and outbound email sending when you connect Gmail
Vercel — application hosting and scheduled cron jobs (when deployed on Vercel)
Resend — optional email provider in some configurations; not the primary Gmail sending path for production Gmail-connected accounts

Your use of Google services is also subject to Google's terms and privacy policies.

22. Google API Services User Data Policy

Mhenbulk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In summary, Google user data accessed through Mhenbulk is used only to provide user-facing features you request (Gmail sending and account connection), not for unrelated purposes.

23. Children's privacy

Mhenbulk is not intended for children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

24. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page (August 24, 2026). Material changes may also be communicated through the Service or by email where appropriate.

25. Contact information

For privacy questions, data requests, or Google user data concerns, contact us at:

Email: mhentor001@gmail.com