A short version, before the detail: we collect what's needed to sign you into your existing company mailbox, sync and show you your mail, and send push notifications for new messages. We don't sell your data, use it for advertising, or read your mail ourselves — every message, attachment, and credential we hold exists only to relay your own mailbox back to you.
Who this is for
Employees and administrators of VSE Solar who use the VSE Mail app or web client and its backend services to access a company mailbox. It is not a consumer product and is not directed at the general public or at children.
What we collect
2.1 Account & identity
- Your sign-in email address and the password you set for VSE Mail itself.
- Display name, phone number (optional), and profile photo (optional).
- Role (standard user or admin).
2.2 Mailbox credentials
To sync and send mail on your behalf, we store the connection details for your actual mail account: the mail server's address, and an app-specific password (not your everyday account password, where your provider supports issuing one separately). This is encrypted at rest (AES-256-GCM) and used only to open an authenticated connection to your mail server — we never display, export, or log it in the clear, including to VSE Solar admins.
2.3 Mail content & attachments
- Message metadata (sender, recipients, subject, timestamps, read/flagged state, folder) and body content (text and HTML) for the mail in your account, synced from your mail server and cached so the app works offline and loads quickly.
- Attachments are fetched from your mail server when you actually open or download them, and cached afterward so a repeat open doesn't re-fetch it.
- Signature text and, if you add one, a signature logo image.
2.4 Contacts (optional)
If you grant the app permission to read your device's contacts, it uses them on-device only to suggest recipients while composing. Your contacts are never uploaded to our servers. Declining this permission still gives you autocomplete from people you've actually corresponded with through the app.
2.5 Notifications & device data
A Firebase Cloud Messaging push token for your device (to deliver new-mail alerts), and basic technical/request logs needed to run the service.
2.6 Admin actions
If you're an admin, actions you take — resetting a user's sign-in password, rotating a mailbox's app password, changing a role — are the same category of account-administration data any workplace tool records, scoped to VSE Solar accounts only.
How we use it
- Authenticate you and keep your VSE Mail account secure.
- Connect to your mail server to sync, send, schedule, and recall mail on your behalf.
- Show you your mail — inbox, folders, threads, attachments — and keep it current with real-time push.
- Deliver new-mail push notifications to your device.
- Let admins manage VSE Solar mail accounts (password resets, app-password rotation, role changes).
We do not sell your data, use it for advertising, or read your mail for any purpose beyond displaying it back to you.
Consent
Signing in and connecting your mailbox is necessary for the app to function — it's the whole point of the app — so this is core processing, not something you separately opt into each time. Device contacts access is the one optional permission: it's requested explicitly through your device's own permission prompt, only used on-device, and you can decline or revoke it at any time without losing any other feature.
Storage & security
Traffic to our servers is carried over encrypted connections. Your mailbox credentials are encrypted at rest (AES-256-GCM) and decrypted only in memory, only when needed to connect to your mail server. Your VSE Mail sign-in session is a server-side session cookie, not a password stored on your device. We apply reasonable safeguards, but no system is perfectly secure.
Retention
Synced mail and attachments are kept for as long as your account exists and broadly mirror what's in your actual mailbox — deleting a message in the app deletes it from your mail server too, the same as any mail client. Local data cached on your device (for offline reading) is removed when you log out or uninstall the app.
Your choices & rights
Subject to applicable law — including India's Digital Personal Data Protection Act, 2023 — you may access and correct your account data, revoke the optional contacts permission at any time from your device's app settings, and raise a grievance (see Section 10). Because your mailbox credentials are only ever decrypted in memory, we cannot show them back to you in the clear — you can always rotate your mail app password through your provider (or ask an admin to) if you're ever unsure of its state.
Changes
If we make a material change, we raise the policy version, and you'll be shown the updated policy and asked to agree again at your next sign-in.
Contact & grievances
Questions about this policy, or a request to exercise the rights in Section 8, can be directed to:
- it@vsesolar.com
- Grievance Officer
- Vikash Mahala
- Contact number
- 9998052588