AttachDrop · Nostello OÜ

Privacy policy

Last updated: 22 October 2026

This policy explains how Nostello OÜ (“Nostello”, “we”), Ahtri Street 12, 15551 Tallinn, Estonia, handles personal data for AttachDrop. We are an EU company and apply the GDPR. Privacy officer: Sheldon Halgreen, privacy@noscotek.co.za.

In short: your emails and attachments never reach our servers. AttachDrop runs inside Outlook; it builds ZIP files on your device and uploads to OneDrive directly through Microsoft Graph. We only keep what we need to run your licence: your Microsoft account and organisation identifiers, monthly file counts and billing status.

1. Email and attachment content

When you save, the add-in reads the emails you selected inside Outlook, one at a time, and fetches their attachments through Outlook. If you choose ZIP download, the ZIP is created in memory on your device and saved by your browser or Outlook app. If you choose OneDrive folder, each file is uploaded directly from Outlook to your OneDrive or SharePoint through Microsoft Graph. Attachments, file names, email bodies, subjects, names and addresses are never sent to our servers.

2. What we process

Data	Why	Basis	Kept
Microsoft account object ID, organisation (tenant) ID and sign-in email, verified with Microsoft Graph	Identify your licence, apply the free limit, Team seats and invited seats	Contract (Art. 6(1)(b))	While you use the service, then 12 months
Monthly count of files saved	Free-tier limit (20 per month)	Contract	13 months
Billing: name, email, address, VAT number, payment status (processed by Stripe)	Subscriptions and invoices	Contract and legal obligation (Art. 6(1)(c))	As Estonian accounting law requires (7 years)
Usage and error telemetry: event type (for example “scan”, “ZIP saved”, “OneDrive saved”, “checkout”, “free limit reached”), counts of emails and files, total size, duration, app version, and one-way hashed account and organisation identifiers; scrubbed technical error messages	Keep the service reliable and understand usage	Legitimate interest (Art. 6(1)(f))	13 months, then deleted automatically
Website visit statistics (Cloudflare Web Analytics, public pages only, no cookies)	Count visits in aggregate	Legitimate interest	Aggregated

Telemetry never includes attachment content, file names, subjects, email addresses or IP addresses. The add-in pane itself has no analytics. Your preferences (naming rule, filters, last folder) are stored in your own Outlook settings.

3. Permissions we ask Microsoft for

User.Read (your profile, to identify your licence) and Files.ReadWrite (to save into the OneDrive folder you choose). We do not request mailbox-wide Graph access; the add-in reads only the emails you select in Outlook.

4. Sub-processors

Cloudflare (hosting, licence database, telemetry, website analytics) and Stripe (payments). See sub-processors. Some processing may happen outside the EEA under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest, by emailing privacy@noscotek.co.za. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.

6. Security

Encrypted connections everywhere, least-privilege Microsoft permissions, signed Stripe webhooks, no storage of email or attachment content, and access to admin tools restricted by Cloudflare Access.

7. Changes

We will post changes here and tell paying customers by email about material changes.