Our Privacy Commitment
Zoho has respected the privacy of its customers and users since long before privacy became fashionable, politically correct or legally required. We collect only the information we need for a legitimate purpose and seek to explain clearly what we collect, how we use it, who may have access to it and what you can do about it.
Zoho has never sold your information to someone else for advertising or made money by showing you other people's advertisements, and we never will. This commitment applies to MyZoho, including the free edition. MyZoho does not display third-party advertisements or use your emails, files, documents or other content for advertising or marketing.
This Privacy Policy is made by the Zoho group, consisting of the entities listed at https://www.zoho.com/legal/zoho-contracting-entities.html (collectively, "Zoho", "we", "us" or "our"). The Zoho entity applicable to you depends on your country or region as explained on that page.
Scope of this Privacy Policy
This Privacy Policy applies to the MyZoho website, MyZoho Accounts and the web and mobile applications through which MyZoho Services are provided. It applies to registered users, people who visit the MyZoho website, people who communicate or collaborate with MyZoho users, and people who contact us about MyZoho.
This Privacy Policy does not apply to Zoho business services or other Zoho products that have their own privacy policies. A MyZoho Account is separate from a Zoho Account, and MyZoho does not currently use Zoho single sign-on or federated authentication.
Information MyZoho Collects
We collect information only when we need it for a legitimate purpose. We obtain information when you provide it, when the Services collect it automatically, or when another person provides it through the Services.
Information you provide
Account registration: When you create a MyZoho Account, we collect your name, mobile phone number, selected username and password. We verify your mobile phone number using a one-time password. Your selected username is used to create your MyZoho email address.
Account information and preferences: We collect changes you make to your Account information, security settings and preferences. If we make optional profile fields available, you may choose whether to provide them.
Interactions with us: When you contact us for support, account recovery, grievance redressal, a privacy request, an infringement complaint or another reason, we receive your contact information and the information you provide in connection with the request. We retain and use it to respond, meet our legal and support obligations, and improve our internal support processes.
Feedback: When you send feedback or participate in a survey, we receive the information you choose to provide. We use it to understand your experience and improve the Services.
Information collected automatically
Browser, device and server information: When you visit the MyZoho website or use the Services, browsers, mobile devices and servers provide information such as your IP address, browser type, language preference, time zone, referring URL, date and time of access, operating system, device type, application version and mobile network information. We record this information in logs to operate and secure the Services and understand technical issues.
Essential service logs: Actions needed to provide the Services generate technical records. These may include sign-up, sign-in and sign-out events; security and recovery events; message-routing and delivery information; storage use; file and document events; sharing and permission changes; synchronization activity; and errors or failures. These records help us deliver the Services reliably, investigate problems and prevent abuse.
Application usage and diagnostics: We collect information about features used, access time and frequency, performance, errors, crashes, storage consumption and application configuration. We use this information to maintain reliability, troubleshoot problems and improve the Services.
Cookies and similar technologies: We use first-party cookies, local storage and similar technologies to maintain sessions, authenticate users, remember preferences, balance traffic, protect security and provide core functions. We do not use third-party cookies or similar technologies for non-essential or intrusive tracking. Further information about cookies used on the MyZoho website will be available at the published cookie policy.
Information from social media sites and other publicly available sources: When you provide feedback or reviews about our products, interact, or engage with us on review sites or social media sites such as Facebook, Twitter, LinkedIn and Instagram through posts, comments, questions and other interactions, we may collect such publicly available information, including profile information, to allow us to connect with you, improve our products, better understand user reactions and issues, or to reproduce and publish your feedback on our websites. We must tell you that once collected, this information may remain with us even if you delete it from these sites. Zoho may also add and update information about you, from other publicly available sources.
Information You Entrust to MyZoho
When you use the Services, you may entrust information to us by creating, uploading, storing, sending, receiving or sharing it. This may include emails and attachments; recipient and sender information; files and folders; documents, spreadsheets and presentations; contacts; calendar entries; tasks; notes; comments; sharing permissions; public links; and collaboration activity. This information may relate to you or to other people.
Zoho does not claim ownership of content you entrust to MyZoho. Any rights in that content remain with you or the relevant rights owner. We use information entrusted to MyZoho only to provide, maintain, secure and support the Services, carry out actions you request, prevent abuse, comply with law and enforce the MyZoho Terms of Service.
Device permissions
A MyZoho application may request permission to access a function or information on your device, such as notifications, contacts, photographs, files, camera or microphone, when needed for a feature you choose to use. The application will request the relevant permission through your device. You can allow, limit or withdraw the permission through your device settings, although the affected feature may then be unavailable.
How We Use Information
We use the information described above for the following purposes:
to create, verify, authenticate, secure, recover and administer your Account;
to provide email, storage, content-creation, organization, search, communication, sharing and collaboration functions;
to route and deliver messages, synchronize information and maintain your content and preferences across supported devices;
to detect and prevent spam, phishing, malware, compromised Accounts, fraud, unlawful activity and other abuse;
to monitor reliability and capacity, diagnose and correct errors, maintain performance and improve the Services;
to solicit feedback on our products and services;
to provide support and respond to questions, complaints, infringement notices, privacy requests and feedback;
to keep you posted on new products and services;
to send verification messages, security alerts, service announcements and legal or administrative notices;
to enforce the MyZoho Terms of Service, protect users and third parties, and establish, exercise or defend legal claims;
to comply with applicable law and valid requests from courts, law-enforcement agencies and other competent authorities; and
to create aggregated or de-identified information that does not reasonably identify an individual.
Legal grounds where required
Some laws require us to identify a legal ground for using personal information. Depending on the information and circumstances, we rely on one or more of the following: the need to provide the Services or perform our agreement with you; your consent; our legitimate interests or those of another person, where those interests are not overridden by your rights; compliance with a legal obligation; protection of a person's vital interests; or another ground permitted by applicable law.
Automated Processing and Human Access
Automated processing
We use automated systems for operational and security purposes, including:
routing, delivering and filtering email and identifying spam, phishing and malware;
monitoring sign-ins and other technical signals to detect compromised Accounts, fraud and abuse;
providing search, organization, synchronization and other functions requested by you;
monitoring storage, service capacity, errors and performance; and
examining content specifically reported to us and comparing it with known malicious links, malware or illegal material to help prioritize and assess the report.
Automated systems used to prevent spam and abuse may restrict a message, function or Account. You may object to an enforcement action through the procedure identified in the MyZoho Terms of Service.
Human access
Access to personal information is restricted to personnel who genuinely need it for their work. Authorized personnel may access limited information when necessary to:
provide support or recover an Account at your request;
identify, investigate and correct a technical problem;
investigate spam, malware, a compromised Account or content reported for abuse;
respond to a security incident, grievance or infringement complaint;
comply with law or a valid legal request; or
protect users, third parties, Zoho or the Services from harm.
Access is limited, logged or reviewed where appropriate, and personnel are bound by confidentiality and security obligations.
Official Communications
We use your Account and contact information to send one-time passwords, account-recovery messages, security alerts, service announcements, administrative messages, information about complaints or enforcement, and notices about changes to the Services or legal documents. You cannot opt out of communications necessary for your Account, security or use of the Services.
Who We Share Information With
We do not sell or rent personal information. We share information only as described below and only to the extent reasonably necessary for the relevant purpose.
Zoho personnel and group companies
Personnel of the relevant Zoho entities may have access where needed to provide infrastructure, engineering, security, support, incident response, legal compliance and operational assistance. They are required to follow Zoho's privacy and security requirements.
Service providers
We engage selected service providers to perform limited functions on our behalf, such as delivering one-time passwords and other communications, sending push notifications, supporting technical operations, helping protect security, and providing diagnostics or remediationtools. We provide only the information needed for the relevant function. These providers must keep the information confidential, use it only to provide the service to us, protect it appropriately, and delete or return it as required.
People you communicate and collaborate with
We share information as directed by your use of the Services. Emails and invitations are delivered to the people you identify and their service providers. Your name, email address, profile information, comments, changes and other activity may be shown to people with whom you communicate or collaborate, depending on the feature and permissions involved.
If you make content public or create a public link, anyone who obtains the link may access the content. Public content may be copied, redistributed, or indexed by search engines. Changing permissions or disabling a link does not retrieve copies already made by another person.
Third-party services you choose
If you direct the Services to interact with a third-party service, we share the information needed to complete your request. Information received by that third party is handled under its own terms and privacy practices. Review them before using the relevant feature.
Complainants
If we receive a complaint concerning your use of the Services, we willy disclose your name and contact information to the complainant in accordance with the MyZoho Terms of Service.
Legal and safety requirements
We may share account information, technical records, content or complaint information when we believe in good faith that disclosure is necessary to comply with applicable law, a court order or valid legal process; enforce our agreements; investigate or prevent fraud, abuse or security threats; protect the safety or rights of a person; or protect Zoho and the Services.
Business transfers
If Zoho is involved in a merger, acquisition, reorganization, sale of assets or transfer of the relevant Service, information may be disclosed to the parties and professional advisers involved, subject to appropriate confidentiality arrangements and applicable law.
Data Location and International Handling
Your Account, emails, files, documents and other content entrusted to MyZoho are stored in India. MyZoho content is not accessed by Zoho personnel outside India.
Some service providers may be located in or operate from other countries and may handle limited information needed for functions such as one-time-password delivery, push notifications, security, diagnostics or support tooling. We use contractual, organizational and technical safeguards required by applicable law. We do not give a service provider outside India access to MyZoho content unless the relevant function requires it and appropriate safeguards have been implemented.
Your Choices
Account information: You may review and update available Account information and preferences through your settings.
Sharing and public links: You control whom you share with and the permissions made available by the relevant feature. Review sharing settings carefully before making content public.
Optional diagnostics: Where diagnostic or crash reporting is optional, you can manage it through the application or device settings made available to you.
Cookies: You can control cookies through your browser and any consent controls we provide. Disabling essential cookies may prevent the Services from functioning properly.
Your Rights With Respect to Personal Information
We believe you should have control over your personal information. Regardless of where you live, we make the following core rights available, subject to reasonable limitations required to protect other people, prevent abuse and comply with law. Local law may give you additional rights.
Core rights for all MyZoho users
Access to information: You may ask what personal information we hold about you and how we use and share it. Much of your Account information and content can be accessed directly through the Services.
Correction: You may update inaccurate or outdated Account information through your settings or ask us to correct information that you cannot update yourself.
Withdrawal of consent: Where we ask for consent, you may withdraw it at any time through the relevant setting or by contacting us. Withdrawal stops the relevant future use but does not affect earlier lawful use. If information is necessary for a feature, withdrawing consent may prevent you from using that feature.
Deletion: You may delete content and request closure of your Account. We may retain limited information where required by law or reasonably necessary for security, fraud prevention, dispute resolution or legal claims.
Data export: You may download or export content through available features or request a copy in a commonly used format where reasonably available.
Additional rights for users in India
If you use MyZoho in India, you may raise a grievance about how we handle your personal data through our Grievance Officer. You may be required to use that internal grievance mechanism before approaching the Data Protection Board of India where applicable.
You may nominate another individual to exercise your rights in the event of your death or incapacity where Indian law provides that right. When exercising your rights, you must not impersonate another person, suppress material information, submit a false or frivolous grievance, or provide information that is not authentic.
Additional rights for users in the EEA and UK
If you are in the European Economic Area or the United Kingdom, you also have the right to restrict or object to certain uses of your information; receive portable information in a structured, commonly used and machine-readable format; and not be subject to a decision based solely on automated processing where it produces legal or similarly significant effects. You may ask for human review where applicable.
You have the right to complain to the data protection authority in your country of residence. We encourage you to contact us first so that we can try to resolve the concern, but you are not required to do so.
Additional rights for residents of certain US states
Residents of certain US states may have additional rights to know the categories, sources, purposes and recipients of personal information; correct or delete information; obtain portable information; appeal a refusal to act on a request; and exercise privacy rights without discrimination.
Some state laws provide rights to opt out of the sale of personal information, sharing for cross-context behavioural advertising or targeted advertising. MyZoho does not engage in those practices. You therefore do not need to submit an opt-out request for them.
How to exercise your rights
Use the available Account settings for actions such as updating information, changing permissions, exporting content or closing your Account. For a right that cannot be exercised through the Services, contact privacy@zohocorp.com.
We will verify your identity and authority before acting on a request. An authorized agent may submit a request where applicable law permits, but we may require proof of authorization and direct verification with the individual. We will respond within the period required by applicable law.
A request may be limited or refused where permitted by law, including where disclosure would adversely affect another person's rights, information must be retained, or a request is manifestly unfounded, excessive or fraudulent. Where required by applicable law, we will explain the reason for a refusal and how to submit any available appeal.
Data Retention and Account Clean-up
We retain personal information for as long as necessary for the purposes described in this Privacy Policy. We generally retain your Account information while your Account is active and content until you delete it or close your Account, subject to the exceptions below.
When you delete content or close your Account, the information is marked for deletion and removed from active systems through our routine clean-up processes. Information removed from active systems may remain in backups for a limited period until those backups are overwritten or deleted. During that period, backup information is isolated from ordinary use.
A free Account may be closed after 24 consecutive months of account-wide inactivity, following the notices and recovery period described in the MyZoho Terms of Service. After an Account is permanently closed, the associated MyZoho email address will remain reserved and will not be assigned to another person. We may retain the minimum identifier necessary to prevent reassignment; this does not require us to retain the former user's content.
We may retain limited information for longer where required to comply with law, respond to legal process, enforce our agreements, prevent fraud or abuse, maintain security, resolve disputes, or establish, exercise or defend legal claims. Content already sent to, shared with or copied by another person may remain with that person and is not deleted when you close your Account.
Security
We use administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration and disclosure. These include access controls, authentication, logging, monitoring, encryption where appropriate, secure development practices and incident-response procedures.
No online service is completely secure. Use a strong and unique password, protect your device and one-time passwords, keep recovery information current, review sharing permissions and notify us promptly if you believe your Account has been compromised.
Information Relating to Minors
You must be at least 18 years old to create or use a MyZoho Account. If we learn that an Account has been created by a person under 18, we may close the Account and delete the associated information, subject to applicable legal, security and safety requirements.
Third-party Websites and Services
The Services may contain links to websites and services operated by others. This Privacy Policy does not apply to their handling of information. Review the privacy policy of a third party before providing information to it.
Contact and Grievance Redressal
If you have a question, concern or request regarding this Privacy Policy or our handling of personal information, contact privacy@zohocorp.com. You may also write to us at the relevant office address listed at https://www.zoho.com/contactus.html.
Users in India may contact the Grievance Officer using the details provided in the MyZoho Abuse Reporting Procedure. You may also complain to the competent privacy, data protection or consumer authority where you live.
Notifications of Changes to this Privacy Policy
We may modify this Privacy Policy upon notice to you through a service announcement, an in-product message or an email sent to your primary email address. If we make a significant change that affects your rights or how we use personal information, we will provide reasonable advance notice unless the change is required sooner for legal or security reasons. The dates at the beginning of this Privacy Policy identify the current version and when it takes effect.