Information CRNAEmail may collect
CRNAEmail may collect information reasonably necessary to operate and protect the Service, including names; requested and issued addresses; claimed professional or academic designations; external recovery/contact email; account, authentication, and MFA records; billing and transaction records; legal-assent records; support and formal legal communications; IP address, device, browser, security, activity, system, and audit logs; storage usage and technical metadata; limited prelaunch marketing-interest events; and information voluntarily provided in an identity, credential, fraud, security, or abuse review.
Payment-card details may be collected directly by a selected payment processor rather than CRNAEmail. Production payment processing is not enabled until separately configured. The current Gift and Graduation Wish experience is marketing-only and does not collect purchaser or recipient information or create gift or wish records.
How information is used
Information may be used to process and document transactions; provision and administer accounts; verify external recovery email; authenticate users; support MFA and account recovery; send notices; provide support; maintain address-reservation integrity; detect, investigate, and address security, fraud, impersonation, abuse, and policy concerns; enforce agreements; operate storage and inactivity rules; preserve evidence; comply with law; and protect customers, CRNAEmail, providers, and infrastructure.
CRNAEmail does not routinely independently verify every customer’s credentials. If CRNAEmail elects to request identity, degree, credential, or eligibility information, it will seek information reasonably related to the review. A complaint alone does not establish wrongdoing.
Service providers and disclosures
CRNAEmail uses third-party application hosting and database infrastructure and may use providers for email hosting and routing, domains and DNS, storage, security, authentication, communications, monitoring, analytics, payments, telecommunications, and support. Information may be processed by those providers as reasonably necessary to perform their services. CRNAEmail may also disclose information when reasonably necessary to comply with law or valid legal process, investigate or respond to security or abuse, protect rights or safety, complete an authorized business transfer, or obtain professional advice.
Security and incidents
CRNAEmail uses safeguards designed to protect information, including separation of staging and production configuration, protected secrets, hashed credentials and tokens, MFA foundations, access controls, and security audit records where implemented. No system is completely secure. CRNAEmail does not promise zero-knowledge or end-to-end encryption unless expressly offered for a specific service. CRNAEmail may investigate incidents, coordinate with providers, preserve relevant evidence, take emergency protective action, communicate with affected customers, and provide notices required by law.
Retention and deletion
CRNAEmail may retain account, transaction, assent, provisioning, address-reservation, security, fraud-prevention, dispute, opt-out, notice, and audit records as reasonably necessary for operation, enforcement, legal compliance, and protection of the Service. Retention periods depend on record purpose, applicable law, contractual needs, security, and technical requirements. Mailbox-content retention is governed separately by storage, inactivity, dormancy, termination, and death rules. Deletion of mailbox contents does not release a legitimately obtained address for reassignment.
Privacy rights and contact
Depending on applicable law, a person may have rights concerning access, correction, deletion, restriction, objection, or appeal. These rights may be limited by legal, security, fraud-prevention, contractual-record, and address-reservation obligations. Formal privacy or legal requests may be sent to legal@crnaemail.com. CRNAEmail may take reasonable steps to verify a request before acting.